Index: contrib/image_attach/image_attach.install
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/image/contrib/image_attach/image_attach.install,v
retrieving revision 1.22
diff -u -p -r1.22 image_attach.install
--- contrib/image_attach/image_attach.install	7 Sep 2009 13:09:33 -0000	1.22
+++ contrib/image_attach/image_attach.install	8 Jun 2010 13:49:56 -0000
@@ -160,3 +160,27 @@ function image_attach_update_6103() {
   return $ret;
 }
 
+/**
+ * Backport existing image attach site's permissions so existing users don't 
+ * lose permission to attach existing images.
+ */
+function image_attach_update_6104() {
+  $ret = array();
+  $subject = ', attach images,';
+  $perms = db_query('SELECT * FROM {permission} WHERE perm LIKE "%%%s%%"', $subject);
+  $replacement = ', attach images, attach existing images,';
+  while ($row = db_fetch_array($perms)) {
+    $count = 0;
+    $new_perm = str_replace($subj, $replacement, $row['perm'], $count);
+    if (!$count) {
+      continue;
+    }
+    $query = sprintf('UPDATE {permission} SET perm = "%s" WHERE pid = %d',
+                    db_escape_string($new_perm), $row['pid']);
+    $ret[] = update_sql($query);
+  }
+  return $ret;
+}
+
+
+
Index: contrib/image_attach/image_attach.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/image/contrib/image_attach/image_attach.module,v
retrieving revision 1.76.2.3
diff -u -p -r1.76.2.3 image_attach.module
--- contrib/image_attach/image_attach.module	21 Apr 2010 21:10:40 -0000	1.76.2.3
+++ contrib/image_attach/image_attach.module	8 Jun 2010 13:49:56 -0000
@@ -42,7 +42,7 @@ function image_attach_menu() {
  * Implementation of hook_perm()
  */
 function image_attach_perm() {
-  return array('attach images');
+  return array('attach images', 'attach existing images');
 }
 
 
@@ -213,7 +213,7 @@ function image_attach_form_alter(&$form,
 
       // Check permissions and settings
       $may_attach           = user_access('attach images');
-      $may_attach_existing  = variable_get('image_attach_existing', 1);
+      $may_attach_existing  = variable_get('image_attach_existing', 1) && user_access('attach existing images');
       $may_upload           = user_access('create images');
       $has_existing_images  = !empty($node->iids);
       $maximum_images       = variable_get('image_attach_maximum_' . $type, 0);
Index: contrib/image_attach/tests/image_attach.test
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/image/contrib/image_attach/tests/image_attach.test,v
retrieving revision 1.1
diff -u -p -r1.1 image_attach.test
--- contrib/image_attach/tests/image_attach.test	10 Jan 2010 17:33:50 -0000	1.1
+++ contrib/image_attach/tests/image_attach.test	8 Jun 2010 13:49:56 -0000
@@ -7,6 +7,7 @@
 class ImageAttachTestCase extends DrupalWebTestCase {
 
   protected $user_admin;
+  protected $user_no_attach_existing;
   protected $user_no_attach;
   protected $user_no_create;
 
@@ -29,7 +30,8 @@ class ImageAttachTestCase extends Drupal
       'create images', 'view original images', 'edit own images',
       'create story content', 'edit any story content',
       'administer content types',
-      'attach images',
+      'attach images', 
+      'attach existing images',
     ));
     $this->drupalLogin($this->user_admin);
     
@@ -66,11 +68,11 @@ class ImageAttachTestCase extends Drupal
     // depending on the setting.
     variable_set('image_attach_existing', FALSE);
     $this->drupalGet('node/add/story');
-    $this->assertNoFieldById('edit-iids', '', t("With 'Attached existing images' DISABLED, existing images selection box is NOT shown on a new node form."));
+    $this->assertNoFieldById('edit-iids', '', t("With 'Attached existing images' DISABLED, existing images selection box is NOT shown on a new node form regardless of 'attach existing images' permission."));
     
     variable_set('image_attach_existing', TRUE);
     $this->drupalGet('node/add/story');
-    $this->assertFieldById('edit-iids', '', t("With 'Attached existing images' enabled, existing images selection box is shown on a new node form."));
+    $this->assertFieldById('edit-iids', '', t("With 'Attached existing images' and 'attach existing images' permission, existing images selection box is shown on a new node form."));
     
     // Check that a user who may attach images but not create them cannot see
     // the upload part of the form
@@ -97,6 +99,14 @@ class ImageAttachTestCase extends Drupal
     $this->drupalLogin($this->user_no_attach);
     $this->drupalGet('node/add/story');
     $this->assertNoText(t('Attached images'), t("A user without the 'attach images' permission can NOT attach images at all."));
+    
+    // Check that a user who may not attach existing images can see the "add" 
+    // form but not the "add existing" form.
+    $this->user_no_attach_existing = $this->drupalCreateUser(array('create story content', 'edit any story content', 'create images', 'attach images'));
+    $this->drupalLogin($this->user_no_attach_existing);
+    $this->drupalGet('node/add/story');
+    $this->assertFieldById('edit-image', '', t("A user with 'attach images' permission but NOT 'attach existing images' permission can upload a new image to attach."));
+    $this->assertNoFieldById('edit-iids', '', t("A user with 'attach images' permission but NOT 'attach existing images' permission cannot choose from existing images to attach."));
   }
   
   /**
@@ -151,4 +161,5 @@ class ImageAttachTestCase extends Drupal
     $this->assertFalse($this->setField('iids[]', $free_image_node->title));
     */
   }
+
 }