14
AAAAAAh. If the user has any admin ability (regardless of module) then they get full access. All my registered users have admin access to the Poll module (so they can create polls). Since they were admins for Polls, the xoopsgallery module treated them as an admin too. Once I removed their admin ability completely, the xoopsgallery functions fine.
This doesn't seem right - it should be checking that they are admins for this module - but it will work in the meantime. If anyone has a clue how to fix this correctly, I'd be much ablidged.
Thanks