4.6.2 node.module incorrectly assumes 404 when access denied

Tested patch against 4.6.2 branch attached.

New patch. Correctly handles both 403s and 404s. Adds an extra query to verify which is happening.

The patch doesn't include enough context to show that the query is subject to a check of is_numeric(arg(1)). I don't think this is vulnerable to SQL injection, but I'd be grateful if someone else would check and I apologise if I'm missing something.

The patched code in context:

case 'view':
      if (is_numeric(arg(1))) {
        $node = node_load(array('nid' => arg(1)), $_GET['revision']);
        if ($node->nid) {
          drupal_set_title(check_plain($node->title));
          print theme('page', node_show($node, arg(2)));
        }
        else if (db_fetch_object(db_query('SELECT nid FROM {node} WHERE nid=%s', arg(1)))) {
          drupal_access_denied();
        }
        else {
          drupal_not_found();
        }
      }
      break;

The cvs version of this patch http://drupal.org/node/27873 has the same context.

Thanks very much killes, that was dumb of me.

New patch attached.