Permissions too broad, og administrator can edit all site menus

I am having a similar problem. I want to be able to give the "administer group menu" permission to og admins and have them edit (and ideally, create) their og menus. However, it seems to actually enable the functionality I must also give them "administer menu" in the menu module which allows them to edit every menu.

In the function og_menu_form_alter, which implements hook_form_alter, the form_id used "page_node_form" will only work for pages...

A quick fix :
In og_menu.module, change line 110 from :

function og_menu_form_alter(&$form, $form_state, $form_id) {
  switch($form_id) {
    case 'page_node_form':
      
      (...)
    
      break;
    case 'menu_edit_item':

To...

function og_menu_form_alter(&$form, $form_state, $form_id) {

  if ($form['#id'] == 'node-form' && $form['menu']) {
	
    if (!user_access('administer group menu')) {
      global $user;
      
      // get menu options for user
      $result = db_query("SELECT * FROM {menu_custom} JOIN ({og_uid}, {og_menu_groups}) ON ({menu_custom}.menu_name = {og_menu_groups}.mid AND {og_menu_groups}.gid = {og_uid}.nid) WHERE {og_uid}.uid = %d ORDER BY menu_name;", $user->uid);
      
      // filter Parent item list to reveal only member associated groups as parents
      $filtered = array();
      
      while ($menu = db_fetch_array($result)) {
        //$menus[] = $menu['menu_name'];

        foreach ($form['menu']['parent']['#options'] as $key => $item) {
          $pos = strpos($key, $menu['menu_name']);
          // use === to check position since we're expecting the needle to be in position 0
          if ($pos !== FALSE)
            $filtered[$key] = $item;
        }
      }
      
      // update list
      $form['menu']['parent'] = array(
        '#type' => 'select',
        '#title' => 'Parent page',
        '#default-value' => $form['menu']['parent']['#default_value'],
        '#options' => $filtered,
        '#description' => $form['menu']['parent']['#description'],
        '#attributes' => $form['menu']['parent']['#attributes'],
      );
    }
  }
  switch($form_id) {
    case 'menu_edit_item':

I just catched the duplicate issue #544446: Permissions allow access to all OG menus, resolved with a patch. Marking as duplicate.