When using apply to children flag in repo group permission

change prompt, RhodeCode only applied this to user groups if
repository was private. Only thing that shouldn't be allowed is
to change the DEFAULT user permission when repository is private.

rhodecode/model/repos_group.py

@@ -185,8 +185,9 b' class ReposGroupModel(BaseModel):'
                     repos_group=obj, user=user, perm=perm
                 )
             elif isinstance(obj, Repository):
-                #we do this ONLY IF repository is non-private
-                if obj.private:
+                # private repos will not allow to change the default permissions
+                # using recursive mode
+                if obj.private and user == User.DEFAULT_USER:
                     return
 
                 # we set group permission but we have to switch to repo
@@ -208,6 +209,8 b' class ReposGroupModel(BaseModel):'
                 RepoModel().grant_users_group_permission(
                     repo=obj, group_name=users_group, perm=perm
                 )
+
+        # start updates
         updates = []
         log.debug('Now updating permissions for %s in recursive mode:%s'
                   % (repos_group, recursive))