14964 user without edit permission able to update work package attributes

[``* `#14964 User without edit permission able to update work package attributes``](https://www.openproject.org/work_packages/14964)

:exclamation: Consider #1766 too
@hschink I would advise against using `p` as a variable name. Even though [`Kernel.p`](http://www.ruby-doc.org/core-2.1.2/Kernel.html#method-i-p) is a method and not a reserved word, creating a variable with the same name makes for ambiguity.