This patch adds some security to the organize dialog.

1) If images are dragged from the content pane and dropped on a branch in the
   tree that the user only has view priviledges, then the drop is cancelled
   and the images are reverted.
2) The user cannot click on a branch, to which they only have view priviledges,
   the content pane does not change to the new album

1 files changed, 13 insertions, 9 deletions

diff --git a/modules/organize/js/organize.js b/modules/organize/js/organize.js
index 7a70ea5e..0f8f7fa1 100644
--- a/modules/organize/js/organize.js
+++ b/modules/organize/js/organize.js
@@ -43,11 +43,6 @@
         } else if (ui.offset.top < top + 20) {
           $("#gMicroThumbPanel").get(0).scrollTop = Math.max(0, $("#gMicroThumbPanel").get(0).scrollTop - 100);
         }
-      },
-      // @todo delete this method when drop is implemented
-      stop: function(event, ui) {
-        $(".ui-state-selected").show();
-        $(".gMicroThumbGridCell").css("borderStyle", "none");
       }
     },
 
@@ -69,10 +64,15 @@
       tolerance: "pointer",
       greedy: true,
       drop: function(event, ui) {
-        $.organize.do_drop({
-          url: move_url.replace("__TARGET_ID__", $(event.target).attr("ref")),
-          source: $(ui.helper).children("img")
-        });
+        if ($(event.target).hasClass("gViewOnly")) {
+          $(".ui-state-selected").show();
+          $(".gMicroThumbGridCell").css("borderStyle", "none");
+        } else {
+          $.organize.do_drop({
+            url: move_url.replace("__TARGET_ID__", $(event.target).attr("ref")),
+            source: $(ui.helper).children("img")
+          });
+        }
       }
     },
 
@@ -200,6 +200,10 @@
       if ($(event.currentTarget).hasClass("gBranchSelected")) {
         return;
       }
+      var parent = $(event.currentTarget).parents(".gOrganizeBranch");
+      if ($(parent).hasClass("gViewOnly")) {
+        return;
+      }
       $("#gMicroThumbPanel").selectable("destroy");
       var id = $(event.currentTarget).attr("ref");
       $(".gBranchSelected").removeClass("gBranchSelected");