Incorrect permission checks for certain content types

I encountered exactly the same issue.

The ImageField module could work with Node Reference URL but the ImageField Assist module isn't already stable.

So lets hope this bug will be fix soon.

Thanks for this awesome module.

(Sorry for the possible mistakes, English isn't my native language.)

Edit: I found a simple solution to fix this issue without much code:

Just replace:
if ($referenceable && user_access('create ' . $field['type_name'] . ' content')) {
by:
if ($referenceable && (user_access('create ' . $field['type_name'] . ' content') || user_access('create images'))) {

It worked for me.

Same problems with Ubercart products.
I've replaced the line 111 code with:
if ($referenceable && (user_access('create ' . $field['type_name'] . ' content') || user_access('create ' . $field['type_name'] . ' products'))) {
to handle any content types that are ubercart product classes.

Hi

This is my first patch so please excuse me if I did something wrong.

I looked at the API and instead of trying to look for every possible "create xxx yyyy" we can use the node_access() api function (http://api.drupal.org/api/function/node_access/6)

The new line of code simply reads

if ($referenceable && node_access('create', $field['type_name'])) {

patch has tabs instead of spaces.

I was just bit by this too - since a user with 'administer nodes' has permission to create all node types, but the link was not showing.

Here's a patch incorporating the above fix plus a little optimization fix and cleanup (which I already had in progress).

oops - guess that optimization is no good for a field with multiple instance. Oh well.

Thanks pwolanin and nightowl77! Committed.

Would 'edit own' ensure that only people can add content via nodereference_url to content that they have the ability to edit.
Otherwise if I give everyone the ability to create a gallery, anyone can add a gallery image to anyone else's gallery.

change to this in patch in #7
if ($referenceable && node_access('edit own', $field['type_name'])) {

I don't think there's a "edit own". I think it's "update".

Can anyone please check this issue? The "add [content type]" link shows up to every user that has permissions to create that node type even though it's on someone else's content, like adding photos to another user's gallery for example.

Thanks!
Ricardo

Just for personal reference (and might be useful to others), my issue was solved with the patch on the issue #640822: Multi-user content types (like galleries) with right permssions patch

Ricardo