? 552418-na.patch
? 5x-hook.patch
? 5x-menu.patch
Index: CHANGELOG.txt
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/menu_node_edit/CHANGELOG.txt,v
retrieving revision 1.10
diff -u -p -r1.10 CHANGELOG.txt
--- CHANGELOG.txt	28 Oct 2009 18:15:55 -0000	1.10
+++ CHANGELOG.txt	28 Oct 2009 18:31:35 -0000
@@ -4,6 +4,7 @@ CHANGELOG for Menu Node Edit
 
 28-OCT-2009
 -- #534330 by roboneale. Adds token support.
+-- #552418 by BenKewell. Makes MNE extend node access instead of replace it.
 
 15-OCT-2009
 -- #605916 fixes bad links to node/add.
Index: README.txt
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/menu_node_edit/README.txt,v
retrieving revision 1.4
diff -u -p -r1.4 README.txt
--- README.txt	28 Oct 2009 18:15:55 -0000	1.4
+++ README.txt	28 Oct 2009 18:31:36 -0000
@@ -11,6 +11,7 @@ CONTENTS
 3. Menu Node Edit and Node Access
 4. Permissions
 4.1 Security Considerations
+4.2 Access Check Process
 5. Using the Module
 5.1 Terminology
 5.2 Menu Node Edit Settings
@@ -94,10 +95,10 @@ each node type on your site:
 
   -- 'edit any TYPE content in assigned sections'
 
-This permission should be used with care. It allows Menu Node Edit to override
+This permission should be used with care. It allows Menu Node Edit to extend
 any other node access permissions for the approved content types. You should 
 assign this permission only if you want users to be able to edit certain types
-of content if and only if they are also assigned to one of his sections.
+of content if and only if the content is also assigned to one of her sections.
 
 ----
 4.1 Security Considerations
@@ -114,6 +115,21 @@ this permission to ensure that you are c
 exposes to these users.
 
 ----
+4.2 Access Check Process
+
+When editing access to a node is requested, the following checks take place:
+
+  -- Check for active menu sections.
+  -- Check for the user's active sections.
+  -- If either are empty, return Node Access rules.
+  -- If Node Access returns TRUE, return TRUE.
+  -- Check to see if the user can edit the node's content type in her section(s).
+  -- If not, return FALSE.
+  -- Check the user's allowed sections against this node.
+  -- If allowed, return TRUE.
+  -- Otherwise, return FALSE.
+
+----
 5. Using the Module
 
 The Menu Node Edit module is not designed for all use cases. Please read this
Index: menu_node_edit.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/menu_node_edit/menu_node_edit.module,v
retrieving revision 1.10
diff -u -p -r1.10 menu_node_edit.module
--- menu_node_edit.module	28 Oct 2009 18:15:55 -0000	1.10
+++ menu_node_edit.module	28 Oct 2009 18:31:37 -0000
@@ -130,38 +130,45 @@ function menu_node_edit_user_page_access
  *   Boolean TRUE or FALSE.
  */
 function menu_node_edit_check($node, $account = NULL) {
-  $items = menu_node_edit_check_rules($node->nid, $account);
-  // If nothing returned, we have no stake here, so return normal access control.
-  if (empty($items)) {
-    return node_access('update', $node, $account);
-  }
-  // Otherwise, check the user's privileges.
-  $access = menu_node_edit_check_user($items, $account);
-  // This only matters if $access returns TRUE and the user
-  // does not have access to all node types in this section.
-  if ($access && !user_access('edit all '. $node->type .' content in assigned sections', $account)) {
-    return node_access('update', $node, $account);
+  $items = menu_node_edit_check_rules($node, $account);
+  // If an array is not returned, we have no stake here, so return normal access control.
+  if (!is_array($items)) {
+    return $items;
+  }
+  // If node_access() returned true, we will not get this far.
+  // The 'edit all X content in assigned sections' is an extension of normal
+  // node editing privileges. Without it, no need to run more checks.
+  if (!user_access('edit all '. $node->type .' content in assigned sections', $account)) {
+    return FALSE;
   }
-  return $access;
+  // Otherwise, check the user's privileges from this module.
+  return menu_node_edit_check_user($items, $account);
 }
 
 /**
  * Determine if this node is a menu item that is subject to our rules.
  *
- * @param $nid
- *   The node id being checked.
+ * @param $node
+ *   The node being checked.
  * @param $account
  *   The user account being checked (optional).
  * @return
- *   The necessary menu item information, or FALSE.
+ *   The necessary menu item information, or TRUE if node access declares
+ *   access, or FALSE if we have no stake in this node.
  */
-function menu_node_edit_check_rules($nid, $account = NULL) {
-  $items = menu_node_get_links($nid);
+function menu_node_edit_check_rules($node, $account = NULL) {
+  $items = menu_node_get_links($node->nid);
   $sections = menu_node_edit_get_sections();
-  // In the following cases, this module makes no assertions.
-  if (empty($items) || empty($sections) || user_access('administer nodes', $account)) {
-    return FALSE;
+  // In the following cases, this module makes no assertions
+  // and we fall back to node_access() rules.
+  if (empty($items) || empty($sections)) {
+    $items = FALSE;
+  }
+  // Let node_access() trump our rules.
+  if (node_access('update', $node, $account)) {
+    return TRUE;
   }
+  // Return FALSE or an array of items.
   return $items;
 }