Object auth for ad_banner

app/controllers/admin/ad_banners_controller.rb

@@ -1,7 +1,8 @@
 class Admin::AdBannersController < OrbitBackendController
   layout "new_admin"
   before_filter :authenticate_user!
-  before_filter :for_app_manager
+  before_filter :for_app_manager,:except => [:index,:show] 
+  before_filter :for_app_sub_manager
 
   def destroy
     @ad_banner = AdBanner.find(params[:id])

app/controllers/admin/module_apps_new_interface_controller.rb

@@ -37,8 +37,9 @@ class Admin::ModuleAppsNewInterfaceController < ApplicationController
 
   protected
   def update_setting_by_params
+    user_sat = []
     ma = ModuleApp.find params[:module_app][:id]
-    user_sat = User.find params[:users].keys
+    user_sat = User.find params[:users].keys if params.has_key? :users
     users_to_new = user_sat - ma.managing_users
     users_to_remove = ma.managing_users - user_sat