fix move, note to self: understand decorators :(

edgware/files/views.py

@@ -314,14 +314,17 @@ def makeFilePublic(request):
   
 
 @csrf_exempt
-@user_passes_test_json(canEditFiles)
+# @user_passes_test_json(canEditFiles)
+@login_required
 def moveFiles(request):
   response = {}
+  user = request.user
   files = json.loads(request.POST.get("ids", "[]"))
   study_id = int(request.POST.get("study", "0"))
   study = Category.objects.get(pk=study_id)
   for f in files:
     fil = File.objects.get(pk=f)
+    if fil.can_edit(user):
       fil.move_to(study)
   response['status'] = 'pass'
   return render_to_json_response(errors)