If a user doesn't have access to see signatures, they still see an active link in $links that leads to an "access denied" page. It would be nicer if they saw un-hyperlinked text or no signature count at all. I achieved the latter by adding a permission check on line 1071.

/**
* implementation of petition_link().
*/
function petition_link($type, $object, $teaser = FALSE) {
  $links = array();
  if(($type == 'node') AND $object->type == 'petition' && user_access('view_signatures')) {
   $links['signature_counts'] = array(
        'title' => format_plural($object->signatures, '1 signature', '@count signatures'),
        'href' => "node/$object->nid/signatures"
      );
  }

  return $links;
}

Comments

VirtualNorman’s picture

I just posted a related issue "view signatures" permission not checked or used. Guess I could have posted it here as a comment.