diff --git a/public/src/admin/manage/categories.js b/public/src/admin/manage/categories.js
index 6434a25aed..cb5d7e9975 100644
--- a/public/src/admin/manage/categories.js
+++ b/public/src/admin/manage/categories.js
@@ -125,10 +125,10 @@ define('admin/manage/categories', ['vendor/jquery/serializeObject/jquery.ba-seri
 	}
 
 	function itemDragDidEnd(e) {
-		var isCategoryUpdate = (newCategoryId !== -1);
+		var isCategoryUpdate = parseInt(newCategoryId, 10) !== -1;
 
 		// Update needed?
-		if ((e.newIndex != null && e.oldIndex !== e.newIndex) || isCategoryUpdate) {
+		if ((e.newIndex != null && parseInt(e.oldIndex, 10) !== parseInt(e.newIndex, 10)) || isCategoryUpdate) {
 			var parentCategory = isCategoryUpdate ? sortables[newCategoryId] : sortables[e.from.dataset.cid];
 			var modified = {};
 			var i = 0;
diff --git a/src/controllers/index.js b/src/controllers/index.js
index 04c613be1e..1ec1696e21 100644
--- a/src/controllers/index.js
+++ b/src/controllers/index.js
@@ -416,7 +416,9 @@ Controllers.handleURIErrors = function (err, req, res, next) {
 	}
 };
 
-Controllers.handleErrors = function (err, req, res) {
+// this needs to have four arguments or express treats it as `(req, res, next)`
+// don't remove `next`!
+Controllers.handleErrors = function (err, req, res, next) { // eslint-disable-line no-unused-vars
 	switch (err.code) {
 	case 'EBADCSRFTOKEN':
 		winston.error(req.path + '\n', err.message);
diff --git a/test/groups.js b/test/groups.js
index d2f2df8425..8e70341e00 100644
--- a/test/groups.js
+++ b/test/groups.js
@@ -794,7 +794,7 @@ describe('Groups', function () {
 				helpers.uploadFile(nconf.get('url') + '/api/groups/uploadpicture', logoPath, { params: JSON.stringify({ groupName: 'Test' }) }, jar, csrf_token, function (err, res, body) {
 					assert.ifError(err);
 					assert.equal(res.statusCode, 500);
-					assert(/\[\[error:no-privileges\]\]/.test(body));
+					assert.equal(body.error, '[[error:no-privileges]]');
 					done();
 				});
 			});