Merge branch 'saas-showbuilder' into saas-showbuilder-colors

airtime_mvc/application/controllers/PlaylistController.php

@@ -74,6 +74,16 @@ class PlaylistController extends Zend_Controller_Action
     private function createFullResponse($obj = null, $isJson = false,
         $formIsValid = false)
     {
+        $user = Application_Model_User::getCurrentUser();
+        $isAdminOrPM = $user->isUserType(array(UTYPE_SUPERADMIN, UTYPE_ADMIN, UTYPE_PROGRAM_MANAGER));
+
+        if (!$isAdminOrPM && $obj->getCreatorId() != $user->getId()) {
+            $this->view->objType = $obj instanceof Application_Model_Block ? "block" : "playlist";
+            $this->view->obj = $obj;
+            $this->view->html = $this->view->render('playlist/permission-denied.phtml');
+            return;
+        }
+
         $isBlock = false;
         $viewPath = 'playlist/playlist.phtml';
         if ($obj instanceof Application_Model_Block) {

airtime_mvc/application/controllers/WebstreamController.php

@@ -55,7 +55,20 @@ class WebstreamController extends Zend_Controller_Action
         if ($webstream) {
             Application_Model_Library::changePlaylist($id, "stream");
         }
-        $this->view->obj = new Application_Model_Webstream($webstream);
+
+        $obj = new Application_Model_Webstream($webstream);
+
+        $user = Application_Model_User::getCurrentUser();
+        $isAdminOrPM = $user->isUserType(array(UTYPE_SUPERADMIN, UTYPE_ADMIN, UTYPE_PROGRAM_MANAGER));
+
+        if (!$isAdminOrPM && $webstream->getDbCreatorId() != $user->getId()) {
+            $this->view->objType = "webstream";
+            $this->view->obj = $obj;
+            $this->view->html = $this->view->render('playlist/permission-denied.phtml');
+            return;
+        }
+
+        $this->view->obj = $obj;
         $this->view->action = "edit";
         $this->view->html = $this->view->render('webstream/webstream.phtml');
     }

airtime_mvc/application/views/scripts/playlist/permission-denied.phtml

@@ -0,0 +1,5 @@
+<?php if ($this->objType == "block") { $displayText = "smart block"; } else { $displayText = $this->escape($this->objType); } ?>
+<h3>You do not have permission to edit this <?php echo $displayText; ?>.</h3>
+<input class="obj_id" type="hidden" value="<?php echo $this->obj->getId(); ?>"/>
+<input class='obj_type' type='hidden' value="<?php echo $this->escape($this->objType); ?>"/>
+<input type="hidden" class="playlist_name_display" contenteditable="true" value="<?php echo $this->escape($this->obj->getName()); ?>">

airtime_mvc/public/js/airtime/schedule/full-calendar-functions.js

@@ -55,7 +55,8 @@ function dayClick(date, allDay, jsEvent, view){
             //remove the +show button if it exists.
             if(addShow.length == 1){
                  var span = $(addShow).parent();
-                $(span).prev().remove();
+
+                $(span).next().remove();
                 $(span).remove();
             }