vt71: Dependent Picklists badly broken

I just tested and validated this on demo.vtiger.com.

If you have a non-admin user and make the source field of a Picklist Dependency read-only for that users role's profile then the target field is editable and ALL options are available - even if the source field is set to a value which should remove certain options.

I created a test user, assigned them to the Sales Person role, and made the Lead Source field read-only in the Sales profile.

I then created a Picklist dependency:

As the admin user I set the Lead Source to "Cold Call".

Then I visit the Lead as my test user. The Lead Status picklist (in Detail & Edit views) shows all options and allows me to select and save any of them.

If I change the field back to read-write in the Profile - the available options are then controlled as expected again.