Index: modules/project/project.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/project/project.module,v
retrieving revision 1.300
diff -u -p -u -p -r1.300 project.module
--- modules/project/project.module	28 Sep 2007 14:59:57 -0000	1.300
+++ modules/project/project.module	2 Oct 2007 21:07:19 -0000
@@ -103,13 +103,12 @@ function project_perm() {
 function project_db_rewrite_sql($query, $primary_table, $primary_field) {
   if ($primary_field == 'nid') {
     $return = array();
-    $types = "'project_project'";
     $access_projects = user_access('access projects');
     $admin_projects = user_access('administer projects');
     if (module_exists('project_issue')) {
+      $issues_exist = TRUE;
       $access_issues = user_access('access project issues');
       $access_own_issues = user_access('access own project issues');
-      $types .= ", 'project_issue'";
     }
     else {
       $access_issues = TRUE;
@@ -138,8 +137,18 @@ function project_db_rewrite_sql($query, 
     // the {node} table's alias is in the query.
     $where = array();
 
-    // First, if the type is not one of the project* ones, we don't care.
-    $where[] = "($alias.type NOT IN ($types))";
+    // Some node types will be restriced by our query, but we want to ignore
+    // every other node type. So, we build up a list of node types to restrict
+    // based on the user's permissions, and allow everything else.
+    $restricted_types = array();
+    if (!$access_projects) {
+      $restricted_types[] = "'project_project'";
+    }
+    if (!empty($issues_exist) && !$access_issues) {
+      $restricted_types[] = "'project_issue'";
+    }
+    // If the type is not one of the restricted project* ones, we don't care.
+    $where[] = "($alias.type NOT IN (". implode(', ', $restricted_types) ."))";
 
     // Now, see if the current user can access their own, and allow those.
     global $user;