Index: nodeasblock.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/nodeasblock/nodeasblock.module,v
retrieving revision 1.3.2.11
diff -u -p -r1.3.2.11 nodeasblock.module
--- nodeasblock.module	18 Jun 2008 06:29:54 -0000	1.3.2.11
+++ nodeasblock.module	18 Jun 2008 21:15:44 -0000
@@ -213,15 +213,17 @@ function nodeasblock_nodeapi(&$node, $op
 
     case 'insert':
     case 'update':
-      // First delete the entry from the table if it exists.
-      db_query('DELETE FROM {nodeasblock} WHERE nid = %d', $node->nid);
-      if ($node->nodeasblockset['nodeasblock'] || variable_get("nodeasblock_$node->type", NODEASBLOCK_DISABLED) == NODEASBLOCK_ALWAYS) {
-        db_query('INSERT INTO {nodeasblock} VALUES (%d)', $node->nid);
-        drupal_set_message(t('The block configuration has been saved.'));
-        nodeasblock_save_block($node);
-      }
-      break;
-      
+      // only modify/create block if current user has access
+      if (user_access('create blocks for nodes')) {
+        // First delete the entry from the table if it exists.
+        db_query('DELETE FROM {nodeasblock} WHERE nid = %d', $node->nid);
+        if ($node->nodeasblockset['nodeasblock'] || variable_get("nodeasblock_$node->type", NODEASBLOCK_DISABLED) == NODEASBLOCK_ALWAYS) {
+          db_query('INSERT INTO {nodeasblock} VALUES (%d)', $node->nid);
+          drupal_set_message(t('The block configuration has been saved.'));
+          nodeasblock_save_block($node);
+        }
+        break;
+      }      
     case 'delete':
       db_query("DELETE FROM {nodeasblock} WHERE nid = $node->nid");
       // Calling _block_rehash() will delete the block entry from