--- mail2web.module	2008-08-08 13:59:01.000000000 -0400
+++ ../mail2web.module	2008-09-17 14:58:31.000000000 -0400
@@ -137,18 +137,21 @@ function mail2web_message_alter(&$messag
   if ($params && ($reply = mail2web_mailbox_mail())) {
     $message['params']['mail']['headers']['Message-ID'] = mail2web_build_messageid($params);
     $message['params']['mail']['headers']['Reply-To'] = $reply;
-    // Add marker text into the message header part taking care of already existing text
-    if ($text = variable_get('mail2web_reply_text', t('((( Reply ABOVE this LINE to POST a COMMENT )))'))) {
-      $prefix = array($text);
-      if (!empty($message['body']['#prefix'])) {
-        $prefix[] = $message['body']['#prefix'];
+    // adding check to determine if the user has access to actually update the node when the comment comes back
+    // do not send the message with the mail2web_reply_text unless they pass these tests
+    if (mail2web_access_check($event->objects['node'])) {
+      // Add marker text into the message header part taking care of already existing text
+      if ($text = variable_get('mail2web_reply_text', t('((( Reply ABOVE this LINE to POST a COMMENT )))'))) {
+        $prefix = array($text);
+        if (!empty($message['body']['#prefix'])) {
+          $prefix[] = $message['body']['#prefix'];
+        }
+        // This glue text is a best guess, may cause trouble though, also with filtering (?).
+        // So we better explicitly set glue text for all sending methods
+        $info += array('glue' => "\n");
+        $message['body']['#prefix'] = implode($info['glue'], $prefix);
       }
-      // This glue text is a best guess, may cause trouble though, also with filtering (?).
-      // So we better explicitly set glue text for all sending methods
-      $info += array('glue' => "\n");
-      $message['body']['#prefix'] = implode($info['glue'], $prefix);
     }
-    
   }
 }
 
@@ -156,6 +159,12 @@ function mail2web_message_alter(&$messag
  * Implementation of hook_mailhandler()
  */
 function mail2web_mailhandler($node, $result, $i, $header, $mailbox) {
+  // if the user does not have access to the node or is not able to pass the checks then
+  // return a null since we do not want to update the existing node information
+  if (mail2web_access_check($node)) {
+    return null;
+  }
+
   // The In-reply-to header is cleaned and passed in $node->threading
   if ($node->threading && ($params = mail2web_check_messageparams($node->threading, $header)) && empty($params['error'])) {
     // Now check user id , just go ahead if they match and it is a valid user
@@ -197,6 +206,29 @@ function mail2web_mailhandler($node, $re
 }
 
 /**
+ * Handle access checking for updating / creating nodes
+ *
+ * Check if the user has permissions to update the node or create comments based
+ * off their access permissions return FALSE if all checks fail otherwise TRUE for permission granted
+ *
+ * @param $node
+ *   Node object
+ */
+function mail2web_access_check($node) {
+  global $user;
+  // checking if the user has the relative comments or node permissions
+  // that will allow us to return true and hence send the information in the email
+  if (user_access('post comments') ||
+      user_access('post comments without approval') ||
+      user_access('administer comments') ||
+      node_access('update', $node) ||
+      node_access('create', $node)) {
+    return TRUE;
+  }
+  return FALSE;
+}
+
+/**
  * Handle errors and bounce mail when authentication or validation fail
  * 
  * We handle the incoming email carefully and don't add any user data in the response