Function theme_priorities_surveys missing access rights check

Hum, hum ...
Here is my test case. Whith out those new checks, if for example you have a "closed" survey, then an anonymous user with out the permission to see the results, will see a link to the results page but will receive an "access denied" while trying to access that page! Hence adding those 2 checks will prevent displaying something a user will not be able to access later.

Yes but this doesn't change anything as long as the feature "anonymous voting" in not allowed. You have a similar scenario for a survey in public status. Imagine that logged in user can set the priorities but can't see the results unless they belong to a second role. In this case the user will be able to vote, he will see the link to go to the results page while he hasn't got the right to see them. Hence for consistency and to not confuse the user we need to check his acces rights before displaying any link.

Ok, thanks a lot for looking at this. In fact I have more mods for theme_priorities_surveys() as in my understanding, there is no need to check empty($survey) at the beginning of the function. Indeed if there is no survey the user will never access an empty page as priorities_overview_access() will always return "false" and hence, we will always receive an "access denied" message.
Hence, please see below, my rewrite of this function (which comes whith all the enhancements). I'm currently using it on my test platform ... and so far so good! Though you may find something hidden somewhere.
Regards,

function theme_priorities_surveys($surveys) {
  // There is no need to check if empty($survey) is true here, as if there is no survey or if there is no priority available for a given survey, the user will never access an empty page as the function priorities_overview_access() will always return "false". Hence, we will always receive an "access denied".

  $output = '';

  $surveys = array_filter($surveys, create_function('$survey', 'return priorities_get_set_access($survey);'));
    
  for ($status = 0; $status < 4; $status++) {
    $surveys_by_status = array_filter($surveys, create_function('$survey', 'return ($survey["status"] == '. $status . ');'));
    if (!empty($surveys_by_status)) {
      $output .= '<h2>' . ucfirst(t('!status surveys', array('!status' => priorities_survey_status($status)))) . '</h2>';
      $output .= '<ul>';
      foreach ($surveys_by_status as $survey) {
        $output .= '<li>' . priorities_titles('title', $survey);
        // If the survey is desable we shouldn't display anything but the title with no link.
        if (!$status == 3) {
          // Add a link to the survey main page and everything is put between 2 ().
          $output .= '&nbsp;- (' . l('Main page', 'priorities/' . $survey['survey_name']);
          // Before displaying a link we must check if the user can set priorities.
          if ($status < 2 && priorities_set_access($survey)) {
            $output .=  '&nbsp;/ ' . l(variable_get('priorities_set_title', t('Set priorities to answer this survey')), 'priorities/' . $survey['survey_name'] .'/set');
          }
          // Before displaying a link we must check if the user can see the results.
          if (in_array($status, array(0, 2)) && priorities_get_access($survey)) {
            $output .= '&nbsp;/ ';
            $output .= l(variable_get('priorities_results_title', t('Get results for this survey')), 'priorities/' . $survey['survey_name'] .'/results');
          }
          $output .= ')' . '</li>';
        }
        $output .= '</ul>';
      }
    }
  }
  // For better convenience let user with "administer priorities" permission add a new survey from this page.
  if (user_access('administer priorities')) {
    $output .= '<p>' . l(t('Add a new survey'), 'admin/settings/priorities/add') . '</p>';
  }

  return $output;
}

Ok works as expected. We can see now the message if there is no survey. For consistency of the display I suggest to use drupal_set_message(). Here is a proposal:

  if (empty($surveys)) {
    $message = '';
    // As we use drupal_set_message we need to remove all <p>.
    $message .= t('No survey has yet been defined.');
    if (user_access('administer priorities')) {
      $message .= l(t(' You can create your first survey.'), 'admin/settings/priorities/add');
    }
    else {
      $message .= t(' Only admins with proper permission can create a survey.');
    }
    // For consistency, let's use drupal_set_message.
    drupal_set_message($message, 'warning', FALSE);
    return $output;
  }

instead of:

  if (empty($surveys)) {
    $output .= '<p>' . t('No survey has yet been defined.') . '</p>';
    if (user_access('administer priorities')) {
      $output .= '<p>' . l(t('You can create a survey.'), 'admin/settings/priorities/add') . '</p>';
    }
    else {
      $output .= '<p>' . t('Only admins with proper permission can create a survey.') . '</p>';
    }
  }