non-member can have more permission than a group member

By default using public groups, non-member can create content inside a group and will become a group member.

But if you want users only comment on existing content inside a group and not allow creation of new content (and change the permissions accordingly), they will still be able to create new content as long as they are no group members.

This is a result of permission overwrite of commons_groups.module

If they create a new content they will become a member and now they are not allowed to create content anymore - will look strange for a user.

The patch attached corrects this behaviour.
If you do not explicitly grant a permission to a non-member, the code will check if a member has the requested permission. If not, the permission will not be granted to non-members.