From db309ce8a114aa23af657105e71e92be5754819e Mon Sep 17 00:00:00 2001
From: Baris Soner Usakli <barisusakli@gmail.com>
Date: Fri, 31 Jan 2014 22:25:59 -0500
Subject: [PATCH] closes #661

---
 src/routes/api.js | 93 ++++++++++++++++++++++++++---------------------
 src/webserver.js  | 17 ++++++---
 2 files changed, 62 insertions(+), 48 deletions(-)

diff --git a/src/routes/api.js b/src/routes/api.js
index 1fa7cfe9fd..e139c5672e 100644
--- a/src/routes/api.js
+++ b/src/routes/api.js
@@ -58,13 +58,18 @@ var path = require('path'),
 			app.get('/home', function (req, res) {
 				var uid = (req.user) ? req.user.uid : 0;
 				categories.getAllCategories(uid, function (err, data) {
-					// Remove disabled categories
+
 					data.categories = data.categories.filter(function (category) {
 						return (!category.disabled || parseInt(category.disabled, 10) === 0);
 					});
 
-					// Retrieve category information for /
-					function iterator(category, callback) {
+					function canSee(category, next) {
+						categoryTools.privileges(category.cid, ((req.user) ? req.user.uid || 0 : 0), function(err, privileges) {
+							next(!err && privileges.read);
+						});
+					}
+
+					function getRecentReplies(category, callback) {
 						categories.getRecentReplies(category.cid, uid, parseInt(category.numRecentReplies, 10), function (err, posts) {
 							category.posts = posts;
 							category.post_count = posts.length > 2 ? 2 : posts.length; // this was a hack to make metro work back in the day, post_count should just = length
@@ -72,46 +77,50 @@ var path = require('path'),
 						});
 					}
 
-					async.each(data.categories, iterator, function (err) {
-						// Assemble the MOTD
-						var	motdString,
-							assemble = function() {
-								data.motd_class = (parseInt(meta.config.show_motd, 10) === 1 || meta.config.show_motd === undefined) ? '' : ' none';
-								data.motd_class += (meta.config.motd && meta.config.motd.length > 0 ? '' : ' default');
-								data.motd_class += meta.config.motd_class ? ' ' + meta.config.motd_class : '';
-
-								data.motd = require('marked')(motdString);
-								res.json(data);
-							};
-						if (!meta.config.motd) {
-							// Construct default MOTD
-							translator.translate('\n\n# NodeBB <small><span>v' + pkg.version + '</span></small>\n\n<h5>[[global:motd.welcome]]</h5>\
-								<div class="btn-group">\
-									<a target="_blank" href="https://www.nodebb.org" class="btn btn-link btn-md">\
-										<i class="fa fa-comment"></i>\
-										<span>&nbsp;[[global:motd.get]]</span>\
-									</a>\
-									<a target="_blank" href="https://github.com/designcreateplay/NodeBB" class="btn btn-link btn-md">\
-										<i class="fa fa-github"></i>\
-										<span>&nbsp;[[global:motd.fork]]</span>\
-									</a>\
-									<a target="_blank" href="https://facebook.com/NodeBB" class="btn btn-link btn-md">\
-										<i class="fa fa-facebook"></i>\
-										<span>&nbsp;[[global:motd.like]]</span>\
-									</a>\
-									<a target="_blank" href="https://twitter.com/NodeBB" class="btn btn-link btn-md">\
-										<i class="fa fa-twitter"></i>\
-										<span>&nbsp;[[global:motd.follow]]</span>\
-									</a>\
-								</div>\
-							', function(motd) {
-								motdString = motd;
+					async.filter(data.categories, canSee, function(visibleCategories) {
+						data.categories = visibleCategories;
+
+						async.each(data.categories, getRecentReplies, function (err) {
+
+							var	motdString,
+								assemble = function() {
+									data.motd_class = (parseInt(meta.config.show_motd, 10) === 1 || meta.config.show_motd === undefined) ? '' : ' none';
+									data.motd_class += (meta.config.motd && meta.config.motd.length > 0 ? '' : ' default');
+									data.motd_class += meta.config.motd_class ? ' ' + meta.config.motd_class : '';
+
+									data.motd = require('marked')(motdString);
+									res.json(data);
+								};
+
+							if (!meta.config.motd) {
+								translator.translate('\n\n# NodeBB <small><span>v' + pkg.version + '</span></small>\n\n<h5>[[global:motd.welcome]]</h5>\
+									<div class="btn-group">\
+										<a target="_blank" href="https://www.nodebb.org" class="btn btn-link btn-md">\
+											<i class="fa fa-comment"></i>\
+											<span>&nbsp;[[global:motd.get]]</span>\
+										</a>\
+										<a target="_blank" href="https://github.com/designcreateplay/NodeBB" class="btn btn-link btn-md">\
+											<i class="fa fa-github"></i>\
+											<span>&nbsp;[[global:motd.fork]]</span>\
+										</a>\
+										<a target="_blank" href="https://facebook.com/NodeBB" class="btn btn-link btn-md">\
+											<i class="fa fa-facebook"></i>\
+											<span>&nbsp;[[global:motd.like]]</span>\
+										</a>\
+										<a target="_blank" href="https://twitter.com/NodeBB" class="btn btn-link btn-md">\
+											<i class="fa fa-twitter"></i>\
+											<span>&nbsp;[[global:motd.follow]]</span>\
+										</a>\
+									</div>\
+								', function(motd) {
+									motdString = motd;
+									assemble();
+								});
+							} else {
+								motdString = meta.config.motd;
 								assemble();
-							});
-						} else {
-							motdString = meta.config.motd;
-							assemble();
-						}
+							}
+						});
 					});
 				});
 			});
diff --git a/src/webserver.js b/src/webserver.js
index 03a61850d2..13946b6044 100644
--- a/src/webserver.js
+++ b/src/webserver.js
@@ -487,16 +487,21 @@ module.exports.server = server;
 					}, next);
 				},
 				"categories": function (next) {
+					function canSee(category, next) {
+						CategoryTools.privileges(category.cid, ((req.user) ? req.user.uid || 0 : 0), function(err, privileges) {
+							next(!err && privileges.read);
+						});
+					}
+
 					categories.getAllCategories(0, function (err, returnData) {
 						returnData.categories = returnData.categories.filter(function (category) {
-							if (parseInt(category.disabled, 10) !== 1) {
-								return true;
-							} else {
-								return false;
-							}
+							return parseInt(category.disabled, 10) !== 1;
 						});
 
-						next(null, returnData);
+						async.filter(returnData.categories, canSee, function(visibleCategories) {
+							returnData.categories = visibleCategories;
+							next(null, returnData);
+						});
 					});
 				}
 			}, function (err, data) {