Merge branch 'master' of https://github.com/designcreateplay/NodeBB

public/src/ajaxify.js

@@ -49,7 +49,7 @@ var ajaxify = {};
 		// end
 
 		if ($('#content').hasClass('ajaxifying')) {
-			return true;
+			templates.cancelRequest();
 		}
 
 		// Remove trailing slash

public/src/templates.js

@@ -4,7 +4,8 @@
 		templates,
 		fs = null,
 		available_templates = [],
-		parsed_variables = {};
+		parsed_variables = {},
+		apiXHR;
 
 	module.exports = templates = {
 		"globals": {}
@@ -174,7 +175,7 @@
 			parse_template();
 		}
 
-		jQuery.get(RELATIVE_PATH + '/api/' + api_url, function (data) {
+		apiXHR = jQuery.get(RELATIVE_PATH + '/api/' + api_url, function (data) {
 
 			if (!data) {
 				ajaxify.go('404');
@@ -183,12 +184,12 @@
 
 			template_data = data;
 			parse_template();
-		}).fail(function (data) {
+		}).fail(function (data, textStatus) {
 			if (data && data.status == 404) {
 				return ajaxify.go('404');
 			} else if (data && data.status === 403) {
 				return ajaxify.go('403');
-			} else {
+			} else if (textStatus !== "abort") {
 				app.alertError(data.responseJSON.error);
 			}
 		});
@@ -232,6 +233,12 @@
 
 	}
 
+	templates.cancelRequest = function() {
+		if (apiXHR) {
+			apiXHR.abort();
+		}
+	}
+
 	templates.flush = function () {
 		parsed_variables = {};
 	}

src/webserver.js

@@ -16,6 +16,7 @@ var path = require('path'),
 	db = require('./database'),
 	user = require('./user'),
 	categories = require('./categories'),
+	CategoryTools = require('./categoryTools'),
 	posts = require('./posts'),
 	topics = require('./topics'),
 	ThreadTools = require('./threadTools'),
@@ -511,7 +512,7 @@ if(nconf.get('ssl')) {
 			async.waterfall([
 				function(next) {
 					// Check whether this user is allowed to access this topic
-					ThreadTools.privileges(tid, ((req.user) ? req.user.uid : 0), function(err, privileges) {
+					ThreadTools.privileges(tid, ((req.user) ? req.user.uid || 0 : 0), function(err, privileges) {
 						if (!err) {
 							if (!privileges.read) {
 								next(new Error('not-enough-privileges'));
@@ -671,6 +672,20 @@ if(nconf.get('ssl')) {
 			}
 
 			async.waterfall([
+				function(next) {
+					// Check whether this user is allowed to access this category
+					CategoryTools.privileges(cid, ((req.user) ? req.user.uid || 0 : 0), function(err, privileges) {
+						if (!err) {
+							if (!privileges.read) {
+								next(new Error('not-enough-privileges'));
+							} else {
+								next();
+							}
+						} else {
+							next(err);
+						}
+					});
+				},
 				function (next) {
 					categories.getCategoryById(cid, 0, function (err, categoryData) {
 
@@ -717,8 +732,12 @@ if(nconf.get('ssl')) {
 				}
 			], function (err, data) {
 				if (err) {
+					if (err.message === 'not-enough-privileges') {
+						return res.redirect('403');
+					} else {
 						return res.redirect('404');
 					}
+				}
 
 				if(data.categories.link) {
 					return res.redirect(data.categories.link);