Long field names exceed variable 48-character limit

If it just gonna cause more problems I wouldn't bother using the truncating method
I reckon a better way might be to create a single variable for this module just called "nodeaccess_userreference" which is an array where the keys are the field names.

Hmm good point.
I quickly wrote this function (haven't tried it) we could use something like this instead of variable_get and variable_set, it will check for the old data

<?php

/**
 * Set and get nodeaccess userreference field settings.
 *
 * @param $type_name
 *   The node type.
 * @param $field_name
 *   The name of the field.
 * @param $variable
 *   If set will update the value of the settings for this field.
 * @return
 *   The stored or updated value of the settings for this field.
 */

function nodeaccess_userreference_field_settings($type_name, $field_name, $variable = NULL) {

  // 'get' the variable
  $data = variable_get('nodeaccess_userreference', NULL);
  if (!$data || !isset($data[$type_name][$field_name])) {
    // Attempt to get result from old variables.
    $old_data = variable_get($field_name .'_'. $type_name, NULL);
    if (is_array($old_data)) {
      variable_del($field_name .'_'. $type_name);
      $data[$type_name][$field_name] = $old_data;
    }
    else {
      // default
      $data[$type_name][$field_name] = array(
        'view' => 0, 
        'update' => 0, 
        'delete' => 0,
      );
    }
  }

  // change and 'set' the variable
  if ($variable) {
    $data[$type_name][$field_name] = $variable;
    variable_set('nodeaccess_userreference', $data);
  }

  return $data[$type_name][$field_name];
}

?>

To get the settings:

<?php

$data = nodeaccess_userreference_field_settings($field['type_name'], $field['field_name']);

// or

$data = nodeaccess_userreference_field_settings($form['type_name']['#value'], $form['field_name']['#value']);

?>

To update the settings:

<?php

nodeaccess_userreference_field_settings($form['type_name']['#value'], $form['field_name']['#value'], $data);

?>

I think it's fine

I mean I thought about those when I was doing it, and whilst this isn't perfect, it works and won't be a problem. In terms of being intuitive - it's not an api function for people to use, it does the job of the update without requiring a second function - that's cool. The secondary check shouldn't be too much of a performance hit because variable_get is pretty quick and that part of the code should only ever run once on a particular field anyway, because from then on the default or stored value will be in the new settings - eventually that secondary code can be removed. Doing a mass update would be a little harder too :/

thanks!