From 0edcec7c2b3569d865d51e5d93bbc511de1c5b6b Mon Sep 17 00:00:00 2001
From: Harry Bomrah <harry@rulingcom.com>
Date: Thu, 12 May 2016 19:46:24 +0800
Subject: [PATCH] authorization fixed

---
 app/controllers/admin/text_marquees_controller.rb | 3 ++-
 app/views/admin/text_marquees/_text.html.erb      | 2 +-
 app/views/admin/text_marquees/index.html.erb      | 4 ++--
 app/views/admin/text_marquees/show.html.erb       | 2 +-
 4 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/app/controllers/admin/text_marquees_controller.rb b/app/controllers/admin/text_marquees_controller.rb
index 568f163..018bcb7 100644
--- a/app/controllers/admin/text_marquees_controller.rb
+++ b/app/controllers/admin/text_marquees_controller.rb
@@ -1,9 +1,10 @@
 class Admin::TextMarqueesController < OrbitAdminController
 	def index
 		@tags = @module_app.tags
+		uac = @module_app.categories.enabled.authorized(current_user) if @user_authorized_categories.nil?
 		categories = @module_app.categories.enabled
 		@filter_fields = filter_fields(categories, @tags)
-		@categories = categories.collect{|c|[c.title, c.id]}
+		@categories = uac.collect{|c|[c.title, c.id]}
     	@table_fields = [:title, :category]
     	@marquees = Marquee.where(:title.ne => "")
                                         .order_by(sort)
diff --git a/app/views/admin/text_marquees/_text.html.erb b/app/views/admin/text_marquees/_text.html.erb
index c2c6229..ad15546 100644
--- a/app/views/admin/text_marquees/_text.html.erb
+++ b/app/views/admin/text_marquees/_text.html.erb
@@ -3,7 +3,7 @@
 		<a href="<%= text.url %>" target="_blank"><%= text.title %></a>
 		<div class="quick-edit">
             <ul class="nav nav-pills">
-              <% if can_edit_or_delete?(text) %>
+              <% if can_edit_or_delete?(@marquee) %>
                 <li><a href="<%= admin_text_marquee_edittext_path(text) %>">
                         <%= t(:edit) %>
                     </a>
diff --git a/app/views/admin/text_marquees/index.html.erb b/app/views/admin/text_marquees/index.html.erb
index 155d61a..122d27d 100644
--- a/app/views/admin/text_marquees/index.html.erb
+++ b/app/views/admin/text_marquees/index.html.erb
@@ -15,7 +15,7 @@
     </div>
     <div class="pagination pagination-centered"></div>
   </div>
-
+<% end %>
   <div id="pageslide">
     <div class="page-title clearfix">
       <a class="pull-right" href="javascript:$.pageslide.close()">
@@ -40,7 +40,7 @@
     </div>
   </div>
 
-<% end %>
+
 <%= render 'layouts/delete_modal', delete_options: @delete_options %>
 
 <script type="text/javascript">
diff --git a/app/views/admin/text_marquees/show.html.erb b/app/views/admin/text_marquees/show.html.erb
index 169fec5..0ff5d80 100644
--- a/app/views/admin/text_marquees/show.html.erb
+++ b/app/views/admin/text_marquees/show.html.erb
@@ -12,7 +12,7 @@
   </tbody>
 </div>
 
-<% if current_user.is_admin? or current_user.is_manager?(@module_app) %>
+<% if can_edit_or_delete?(@marquee) %>
   <div class="bottomnav clearfix" style="left: 81px;">
     <div class="action pull-right">
       <a data-fx="fade" class="btn btn-primary" href="/admin/text_marquees/<%= @marquee.id.to_s %>/newtext">