From ac04e0401680a5fded23c5e2acb19325c0dfaf21 Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@designcreateplay.com>
Date: Wed, 8 Jan 2014 21:50:19 -0500
Subject: [PATCH] fixed #719

---
 src/categories.js | 40 ++++++++++++++++++++++++----------------
 src/routes/api.js |  2 +-
 src/websockets.js |  2 +-
 3 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/src/categories.js b/src/categories.js
index 8a6726f3bd..0bf5e91e5c 100644
--- a/src/categories.js
+++ b/src/categories.js
@@ -2,9 +2,11 @@ var db = require('./database.js'),
 	posts = require('./posts.js'),
 	utils = require('./../public/src/utils.js'),
 	user = require('./user.js'),
-	async = require('async'),
 	topics = require('./topics.js'),
 	plugins = require('./plugins'),
+	CategoryTools = require('./categoryTools'),
+
+	async = require('async'),
 	winston = require('winston'),
 	nconf = require('nconf');
 
@@ -210,28 +212,34 @@ var db = require('./database.js'),
 		});
 	};
 
-	Categories.getRecentReplies = function(cid, count, callback) {
+	Categories.getRecentReplies = function(cid, uid, count, callback) {
 		if(count === 0) {
 			return callback(null, []);
 		}
 
-		db.getSortedSetRevRange('categories:recent_posts:cid:' + cid, 0, count - 1, function(err, pids) {
+		CategoryTools.privileges(cid, uid, function(err, privileges) {
+			if (privileges.read) {
+				db.getSortedSetRevRange('categories:recent_posts:cid:' + cid, 0, count - 1, function(err, pids) {
 
-			if (err) {
-				winston.err(err);
-				return callback(err, []);
-			}
+					if (err) {
+						winston.err(err);
+						return callback(err, []);
+					}
 
-			if (pids.length === 0) {
-				return callback(null, []);
-			}
+					if (pids.length === 0) {
+						return callback(null, []);
+					}
 
-			posts.getPostSummaryByPids(pids, true, function(err, postData) {
-				if(err) {
-					return callback(err);
-				}
-				callback(null, postData);
-			});
+					posts.getPostSummaryByPids(pids, true, function(err, postData) {
+						if(err) {
+							return callback(err);
+						}
+						callback(null, postData);
+					});
+				});
+			} else {
+				callback(null, []);
+			}
 		});
 	};
 
diff --git a/src/routes/api.js b/src/routes/api.js
index 33156ea955..776660cec1 100644
--- a/src/routes/api.js
+++ b/src/routes/api.js
@@ -56,7 +56,7 @@ var path = require('path'),
 					});
 
 					function iterator(category, callback) {
-						categories.getRecentReplies(category.cid, parseInt(category.numRecentReplies, 10), function (err, posts) {
+						categories.getRecentReplies(category.cid, uid, parseInt(category.numRecentReplies, 10), function (err, posts) {
 							category.posts = posts;
 							category.post_count = posts.length > 2 ? 2 : posts.length; // this was a hack to make metro work back in the day, post_count should just = length
 							callback(null);
diff --git a/src/websockets.js b/src/websockets.js
index b52807b23b..702297e80d 100644
--- a/src/websockets.js
+++ b/src/websockets.js
@@ -758,7 +758,7 @@ websockets.init = function(io) {
 		});
 
 		socket.on('api:categories.getRecentReplies', function(tid) {
-			categories.getRecentReplies(tid, 4, function(err, replies) {
+			categories.getRecentReplies(tid, uid, 4, function(err, replies) {
 				socket.emit('api:categories.getRecentReplies', replies);
 			});
 		});