xfdesktop in desktop-menu-file.c should use xfce_resource_lookup not xfce_get_userfile. Currently it uses the latter which means any file is automatically assumed to be in ~/.xfce4 I'm going to attach a patch shortly when I've worked out how to fix it :)
Created attachment 112 Patch to fix this bug from 4.1.99.1 (4.2 RC1) This modifies the call to desktop_menu_file_parse to take an extra parameter which is a gboolean and only TRUE when we're including a relative file. When it is true it uses xfce_resource_lookup to work out the real path to the filename passed and then parses this menu instead of always looking in the deprecated ~/.xfce4. It means if the menu was originally in /etc/xdg/xfce4/desktop/menu.xml then any included files will be read from there and if it was in ~/.config/xfce4/desktop/menu.xml they'll be read from there instead. Please apply pre 4.2 (Debian will most likely ship with this applied whatever happens to allow its menu system to work properly so if you have any comments on the patch please send them my way)
Created attachment 118 much simpler patch that (i think) does the same thing is there something wrong with doing it this way? i'd rather touch less code if possible. the only difference (i think), is that it'll always grab whatever's in the search path first. so if the main menu is $sysconfdir/xdg/xfce4/desktop/menu.xml, but there's an included menu2.xml that exists both there and in ~/.config/xfce4/desktop/, it'll use the one in the user's homedir. i prefer it this way. everything should be customisable without the user having to edit system files, and it should be as flexible as possible. i'm not sure i can see a place (aside from a kiosk environment, which is addressed elsewhere) where it would be more desirable to use the system location if the user location is present. if i've misunderstood something, feel free to smack me.
actually, i'm just going to commit this and mark FIXED so i don't forget about it before RC2. reopen if i suck. (and yeah, i changed XFCE_RESOURCE_DATA to XFCE_RESOURCE_CONFIG in the commit. stupid me.)
The patch looks good. I'll try to get a chance to check CVS tomorrow.