Any user with "View revisions" can revert or delete revisions

In the "og_moderation_node_revision_access()" a call to _node_revision_access() always passes the 'view' $op instead of the $op that is passed to the function. That means that any user with the ability to 'view' revisions will also be able to delete or revert them.

function og_moderation_node_revision_access($node, $op = 'view') {
  if ($gids = og_get_entity_groups('node', $node)) {
    foreach ($gids as $gid => $value) {
      if (og_user_access($gid, "access revisions options of " . $node->type . " content")) {
        return TRUE;
      }
    }
  }
  return _node_revision_access($node, $op = 'view');
}

The following patch fixes this by just passing the $op variable:

  return _node_revision_access($node, $op);