### Steps to reproduce

1. Be a non admin user

2. Have two projects

1. "Project read only": The user is member in here but does not have the "Manage work package relations" permission

2. "Project writable": The user is member with the permission "Manage work package relations" permission

3. Have two work packages one in each project

1. "Work package read only"

2. "Work package writable"

4. Go to the writable ticket "Work package writable"

5. Go to the relations tab and open the modal to create a new "Blocks" permission (Also possible for other relations)

6. Insert "Work package read only"

7. Click "Add"


### What is the buggy behavior?

* The relation is created.


### What is the expected behavior?

* Begin of the insertionWe enfore symmetry;End of the insertion Begin of the deletion CreatingEnd of the deletion the Begin of the deletion relationship should not be possible as theEnd of the deletion user Begin of the insertionneeds writeEnd of the insertion Begin of the deletion lacksEnd of the deletion permission on Begin of the insertionbothEnd of the insertion Begin of the deletion one of theEnd of the deletion work Begin of the insertionpackages in order to be able to create the relation.End of the insertion Begin of the deletion packages.End of the deletion

* Begin of the insertionRelations with read-only permissions are still visible inEnd of the insertion Begin of the deletion Ideally,End of the deletion the Begin of the insertionresults. However, selecting one throw an in-line error below the field with text:

* "The selectedEnd of the insertion Begin of the deletion read onlyEnd of the deletion work package Begin of the insertionis read-only and cannotEnd of the insertion Begin of the deletion should notEnd of the deletion be Begin of the insertionaddedEnd of the insertion Begin of the deletion suggestedEnd of the deletion as a Begin of the insertionrelation."


End of the insertion Begin of the deletion work package to create a relation to.


End of the deletion ### Screenshots and other files

<img class="op-uc-image op-uc-image_inline" src="/api/v3/attachments/314824/content">

### Technical notes

This is possible because the `relations/base_contract.rb` only checks the `model.from` work package for the permission.