Published status not respected

actually, no. directly looking at node->status is the job of node_access(). ;) all we have to do is correctly return NULL if we're not sure if the user should see it or not.

luckily, project_project_access() already gets this right, and we're just using the identical permission checks for the view case for project_release_access(). so, instead of duplicating the code, we just call project_project_access() directly, since it behaves exactly how we want. i think this is cleaner.

(btw, this bug also exists in 4.7.x-2.x, so this patch should be backported).

now installed on s.d.o... seems to be working fine. however, please review/test as you see fit. ;)

thanks,
-derek

after confirmation from webernet in IRC, committed to HEAD and installed for real on s.d.o.

backported to DRUPAL-4-7--2 before the 4.7.x-2.2 release.