Menu items for restricted nodes are always visible

If you create a menu item for a node (using the menu module), that menu item will always be visible in navigation blocks. If you restrict access to that node, using node access modules such as OG or TAC, then that restriction has no effect on the display of menu items. Users who do not have access to the node are still able to see the menu links, and when they click these links, they receive an 'access denied' error.

The reason for this undesirable situation is the way that the node access system (or should I say, Drupal's access control system) is currently set up. The 'node' menu item is a static, cached item, and all users with the 'access content' permission are able to access it. The 'node/x' menu items, however, are dynamic and non-cached, and Drupal doesn't determine their actual access until a node page is requested, and the whole node access mechanism kicks in.

So in determining the access for display of menu links, Drupal simply looks at the 'access content' permission for the 'node' menu item (which is the 'parent' of all 'node/x' pages), and never gets round to looking at what node_access has to say about it.

This patch presents a complete hack solution which fixes the problem. It looks through the 'menu' table in the DB, to see if there are any user-defined menu items for node pages. For each one that it finds, it defines a cached menu item whose access is determined by the full power of node_access. The menu items must be defined in the cached part of hook_menu(), because if they're in the non-cached part, the custom items have already been loaded from the DB, and it's too late to define their permissions.

I fully admit that this patch is a hack, and that it is not a proper solution, and that it does NOT belong in core. This patch could even be implemented as a separate module, without needing to hack the core node.module. But I posted it here in order to draw people's attention to this issue, and to see if anyone can think of a better and more long-term solution. I understand that REALLY solving this problem could be quite hard, and may involve seriously re-thinking certain aspects of the menu system. But at least this is a start. And for people that need access control to be observed in displaying links to node pages, this is a solution that will work today.