1.make module app forbid unearthed access except from admin

2.override sidebar link when it's object_auth or app_auth.

app/controllers/admin/module_apps_new_interface_controller.rb

@@ -1,10 +1,24 @@
 class Admin::ModuleAppsNewInterfaceController < OrbitBackendController
-  before_filter :authenticate_user!
-  before_filter :is_admin?
+  before_filter :check_auth
+  # before_filter :authenticate_user!
+  # before_filter :is_admin?
   include AdminHelper
 
   layout "new_admin"
   
+  def check_auth
+
+    unless is_admin? and is_manager?
+      flash[:error] = "unauthorized access"
+      if request.env["HTTP_REFERER"]
+        redirect_to :back
+      else
+        render(:file => File.join(Rails.root, 'public/403.html'), :status => 403, :layout => false)
+      end
+      false
+    end
+  end
+
   def setting
     @sys_users = User.all(conditions: {admin: false}).includes(:avatar).not_guest_user
     @module_app = ModuleApp.find(params[:module_app_id])