diff --git a/commons_groups.module b/commons_groups.module
index f554f56..0d34dd2 100644
--- a/commons_groups.module
+++ b/commons_groups.module
@@ -355,33 +355,45 @@ function commons_groups_default_message_type_alter(&$defaults) {
 
 /**
 * Implements hook_og_user_access_alter().
+ *
+ * Deny create permissions from non-members on "non-public" groups (i.e. groups
+ * that don't allow joining without approval).
 */
-function commons_groups_og_user_access_alter(&$temp_perm, $context) {
-  // Grant access to non-group members to be able to post into groups
-  // where the group node is public and content is public within the group.
-  $commons_groups_entity_types = commons_groups_get_group_content_entity_types();
-  $group_content_restricted = (bool) (isset($context['group']->group_content_access[LANGUAGE_NONE][0]['value']) && $context['group']->group_content_access[LANGUAGE_NONE][0]['value'] == 2);
-  // @TODO: Consider using a static here.
-  $user_is_member = (bool)og_is_member('node', $context['group']->nid, 'user', $context['account']);
-  foreach ($commons_groups_entity_types['node'] as $type => $options) {
-    // We do a literal user_access() check on the create permission here
-    // because we can't call node_access() OR og_user_access without causing recursion.
-    // The code flow is:
-    // node_access()>og_node_access()=>og_user_access_entity=>og_user_access=>
-    // og_user_access_alter()=>commons_groups_og_user_access_alter().
-    // See also: http://drupal.org/node/1910874.
-
-    // In most cases users who don't have access to post content should already be false. But just in case they aren't, we'll set the permission here.
-    if ($context['string'] == "create $type content" && !user_access("create $type content", $context['account'])) {
-      $temp_perm["create $type content"] = FALSE;
-      return;
-    }
+function commons_groups_og_user_access_alter(&$perm, $context) {
+  $account = $context['account'];
+  $cache = &drupal_static(__FUNCTION__, array());
+  if (!empty($cache[$account->uid])) {
+    // We already changed the permissions.
+    return;
+  }
 
-    // If a group is not restricted, or the user is a member, and the user can create content of a certain type, let them post temporarily
-    if ($context['string'] == "create $type content" && (!$group_content_restricted || $user_is_member) && user_access("create $type content", $context['account'])) {
-      $temp_perm["create $type content"] = TRUE;
-      return;
-    }
+  $cache[$account->uid] = TRUE;
+  $group_type = $context['group_type'];
+  $group = $context['group'];
+
+  if ($group_type != 'node') {
+    return;
+  }
+
+  $wrapper = entity_metadata_wrapper($group_type, $group);
+  if ($wrapper->field_og_subscribe_settings->value() == 'join') {
+    // Group is public.
+    return;
+  }
+
+  if (og_is_member($group_type, $group->nid, 'user', $account)) {
+    // The user is a group member, so comply to the OG permissions.
+    return;
+  }
+
+  // Make sure user can view group (i.e. it's not private).
+  if (!entity_access('view', $group_type, $group)) {
+    return;
+  }
+
+  $commons_groups_entity_types = commons_groups_get_group_content_entity_types();
+  foreach (array_keys($commons_groups_entity_types['node']) as $type) {
+    $perm["create $type content"] = FALSE;
   }
 }