closes #661

src/routes/api.js

@@ -58,13 +58,18 @@ var path = require('path'),
 			app.get('/home', function (req, res) {
 				var uid = (req.user) ? req.user.uid : 0;
 				categories.getAllCategories(uid, function (err, data) {
-					// Remove disabled categories
+
 					data.categories = data.categories.filter(function (category) {
 						return (!category.disabled || parseInt(category.disabled, 10) === 0);
 					});
 
-					// Retrieve category information for /
-					function iterator(category, callback) {
+					function canSee(category, next) {
+						categoryTools.privileges(category.cid, ((req.user) ? req.user.uid || 0 : 0), function(err, privileges) {
+							next(!err && privileges.read);
+						});
+					}
+
+					function getRecentReplies(category, callback) {
 						categories.getRecentReplies(category.cid, uid, parseInt(category.numRecentReplies, 10), function (err, posts) {
 							category.posts = posts;
 							category.post_count = posts.length > 2 ? 2 : posts.length; // this was a hack to make metro work back in the day, post_count should just = length
@@ -72,8 +77,11 @@ var path = require('path'),
 						});
 					}
 
-					async.each(data.categories, iterator, function (err) {
-						// Assemble the MOTD
+					async.filter(data.categories, canSee, function(visibleCategories) {
+						data.categories = visibleCategories;
+
+						async.each(data.categories, getRecentReplies, function (err) {
+
 							var	motdString,
 								assemble = function() {
 									data.motd_class = (parseInt(meta.config.show_motd, 10) === 1 || meta.config.show_motd === undefined) ? '' : ' none';
@@ -83,8 +91,8 @@ var path = require('path'),
 									data.motd = require('marked')(motdString);
 									res.json(data);
 								};
+
 							if (!meta.config.motd) {
-							// Construct default MOTD
 								translator.translate('\n\n# NodeBB <small><span>v' + pkg.version + '</span></small>\n\n<h5>[[global:motd.welcome]]</h5>\
 									<div class="btn-group">\
 										<a target="_blank" href="https://www.nodebb.org" class="btn btn-link btn-md">\
@@ -115,6 +123,7 @@ var path = require('path'),
 						});
 					});
 				});
+			});
 
 			app.get('/login', function (req, res) {
 				var data = {},

src/webserver.js

@@ -487,17 +487,22 @@ module.exports.server = server;
 					}, next);
 				},
 				"categories": function (next) {
+					function canSee(category, next) {
+						CategoryTools.privileges(category.cid, ((req.user) ? req.user.uid || 0 : 0), function(err, privileges) {
+							next(!err && privileges.read);
+						});
+					}
+
 					categories.getAllCategories(0, function (err, returnData) {
 						returnData.categories = returnData.categories.filter(function (category) {
-							if (parseInt(category.disabled, 10) !== 1) {
-								return true;
-							} else {
-								return false;
-							}
+							return parseInt(category.disabled, 10) !== 1;
 						});
 
+						async.filter(returnData.categories, canSee, function(visibleCategories) {
+							returnData.categories = visibleCategories;
 							next(null, returnData);
 						});
+					});
 				}
 			}, function (err, data) {
 				res.send(