--- a/app/controllers/application.rb
+++ b/app/controllers/application.rb
@@ -2,6 +2,7 @@
 # Likewise, all the methods added will be available for all controllers.
 
 class ApplicationController < ActionController::Base
+  
   session :session_key => '_ks1_session_id', :secret => GitlabConfig["cookie_secret"]
   include AuthenticatedSystem
   include ExceptionNotifiable
@@ -62,5 +63,12 @@ class ApplicationController < ActionController::Base
     def render_not_found
       render :file => "#{RAILS_ROOT}/public/ac_404.html", :status => 404
     end
+    
+    def authorised
+      if !@is_member
+        flash[:error] = "Access denied."
+        redirect_to root_path
+      end
+    end
 
 end

--- a/app/controllers/articles_controller.rb
+++ b/app/controllers/articles_controller.rb
@@ -3,8 +3,10 @@
 #
 class ArticlesController < ApplicationController
 
-  after_filter :after_article
-  before_filter :find_project
+  after_filter :after_article, :only => [ :find_by_permalink ]
+  before_filter :find_project, :except => [ :find_by_date, :find_by_permalink, :find_by_type, :find_by_category,
+    :find_by_user, :find_by_sitename, :find_by_sitename_and_type, :find_by_project_and_type ]
+  before_filter :authorised, :only => [ :update, :edit, :destroy, :new, :create ]
   
   # Show all articles, render grouped by year, month
   def index
@@ -34,7 +36,7 @@ class ArticlesController < ApplicationController
   def edit
     if @project
       # Project article
-      @article = Article.find_by_id(params[:id], current_user)
+      @article = Article.find_by_id!(params[:id])
       if @article
         @title = "Editing: " + @project.title + ": " + @article.title
         render :action => "ac_project_edit"
@@ -237,7 +239,7 @@ protected
 
   # Increase view count for a permalink page
   def after_article
-    if action_name == "find_by_permalink" and @article != nil then
+    if @article
       @article.views = @article.views + 1
       @article.save!
     end

--- a/app/controllers/committers_controller.rb
+++ b/app/controllers/committers_controller.rb
@@ -1,4 +1,5 @@
 class CommittersController < ApplicationController
+
   before_filter :login_required, :only => [:new, :create, :destroy, :list]
   before_filter :find_project
   before_filter :find_repository, 

--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@@ -3,6 +3,7 @@ class ProjectsController < ApplicationController
   before_filter :login_required, :only => [:create, :update, :destroy, :new]
   before_filter :require_user_has_ssh_keys, :only => [:new, :create]
   before_filter :find_project, :except => [:index, :category, :new, :create]
+  before_filter :authorised, :only => [ :update, :edit, :destroy, :new, :create ]
   
   after_filter :increment_project_view
   

--- a/app/controllers/repositories_controller.rb
+++ b/app/controllers/repositories_controller.rb
@@ -7,18 +7,12 @@ class RepositoriesController < ApplicationController
   session :off, :only => [:writable_by]
   
   def index
-    if params[:project_id] != nil
-      @project = Project.find_by_slug(params[:project_id], current_user)
-      if @project != nil
-        @repositories = @project.repositories.find(:all)
-        @title, @url_suffix = Project.tab_settings(PRJ_TAB_REPOS)
-        render :action => "ac_index"
-      else
-        flash[:error] = "Project not found."
-        redirect_to projects_path
-      end
+    if @project
+      @repositories = @project.repositories.find(:all)
+      @title, @url_suffix = Project.tab_settings(PRJ_TAB_REPOS)
+      render :action => "ac_index"
     else
-      flash[:error] = "No project specified."
+      flash[:error] = "Project not found."
       redirect_to projects_path
     end
   end
@@ -107,6 +101,7 @@ class RepositoriesController < ApplicationController
   end
   
   private    
+
     def require_adminship
       unless @project.admin?(current_user)
         respond_to do |format|

--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -1,5 +1,6 @@
 # This controller handles the login/logout function of the site.  
 class SessionsController < ApplicationController
+
   # render new.rhtml
   def new
     render :action => "ac_new"

--- a/app/controllers/site_controller.rb
+++ b/app/controllers/site_controller.rb
@@ -1,5 +1,6 @@
 class SiteController < ApplicationController
-  before_filter :login_required, :only => [:dashboard]
+
+  before_filter :login_required, :only => [ :dashboard ]
   
   def index
     @articles = Article.find_home(current_user)

--- a/app/controllers/wikis_controller.rb
+++ b/app/controllers/wikis_controller.rb
@@ -1,7 +1,8 @@
 class WikisController < ApplicationController
 
   before_filter :find_project
-  after_filter :after_wiki
+  before_filter :authorised, :only => [ :update, :edit, :destroy, :new, :create ]
+  after_filter :after_wiki, :only => [ :show ]
   
   def index
     if @project
@@ -164,7 +165,7 @@ protected
 
   # Increase view count for a wiki page
   def after_wiki
-    if action_name == "show" and @wiki != nil then
+    if @wiki
       @wiki.views = @wiki.views + 1
       @wiki.save!
     end

--- a/app/models/article.rb
+++ b/app/models/article.rb
@@ -88,6 +88,11 @@ protected
     find(:first, :conditions => ["status = '#{:published}' AND id = '#{id}' AND ( audience = '#{:public}' OR project_id IN (" << @projects << ") )"])
   end
   
+  # No membership test version
+  def self.find_by_id! (id)
+    find(:first, :conditions => ["id = '#{id}'"])
+  end
+  
   # finds articles for a user based on the user slug e.g. /profiles/test-user/articles
   def self.find_by_user (user_id, curruser)
     @projects = Project.list_for_user(curruser)
@@ -105,7 +110,7 @@ protected
     @projects = Project.list_for_user(curruser)
     find(:first, :conditions => ["status = '#{:published}' AND permalink = '#{permalink}' AND ( audience = '#{:public}' OR project_id IN (" << @projects << ") )"])
   end
-  
+
   #
   def self.find_by_type (article_type, curruser)
     @projects = Project.list_for_user(curruser)
@@ -129,7 +134,7 @@ protected
     find(:all, :conditions => ["status = '#{:published}' AND project_id = '#{project_id}' AND ( audience = '#{:public}' OR project_id IN (" << projects_allowed << ") )"], :order => "created_at DESC")
   end
 
-  # only called if caller a member
+  # No membership test version
   def self.find_by_project! (project_id)
     find(:all, :conditions => ["project_id = '#{project_id}'"], :order => "created_at DESC")
   end

--- a/test/fixtures/tickets.yml
+++ b/test/fixtures/tickets.yml
@@ -15,6 +15,12 @@
 #
 # Add message box prompt on delete wiki and article
 #
+# Add delete wiki to actions box
+#
+# Change edit and del links to images on lists (like article and wiki)
+#
+# Can't edit a deleted wiki / article etc.
+#
 
 
 #