Calling menu_get_object within hook_init is triggering menu access checks prematurely causing a number of Access Denied pages.

We are having a major problem with the latest release where we are getting Access Denied pages within a space. After digging, I determined the root cause for this problem is that within the spaces_init function, you are calling menu_get_object, which is building the router_item array prematurely before certain object load methods are called. For our specific case, this is casing certain access checks which rely on $user->og_groups to fail leading to a number of Access Denied errors.

Here is the code that is causing the problem....

/**
 * Implementation of hook_init().
 */
function spaces_init() {

  ...
  ...

  /**
   * If the current menu object is not part of the space, this will
   * redirect it to the correct space.
   *
   * Since the menu returns TRUE in the cases a redirect is needed if
   * the user has access to the item, the object will be stored in the
   * menu for this to fetch and redirect.
   */

  // Can't call menu_get_item in hook_init without this.
  if (variable_get('menu_rebuild_needed', FALSE) || !variable_get('menu_masks', array())) {
    menu_rebuild();
  }

  // Simplist case, get the node.
  if ($object = menu_get_object()) {
    $type = 'node';
  }
  // user has various load functions
  elseif (($item = menu_get_item()) && isset($item['map'])) {
    foreach (array_filter($item['map'], 'is_object') as $object) {
      $type = isset($object->nid) ? 'node' : (isset($object->uid) ? 'user' : NULL);;
      break;
    }
  }

  // If the space is incorrect, reroute.
  if (isset($type) && !spaces_is_spaces_object($type, $object)) {
    spaces_router($type, $object);
  }
}

The only problem here is that I am not totally sure of a fix for this, since menu_get_object does way more than just node_load an object. I honestly don't know the ramifications of calling a direct DB query, but this issue is causing some major issues with our release and we may need to downgrade the module until a proper resolution for this is made. I could work up a patch, but it would most likely just use the arg() to determine the object ID and directly load it which will certainly be REALLY ugly and somewhat hacky.

Any advise you have is appreciated on this...

Travis.