Improve changeOrder permission

closes #21

7 files changed, 138 insertions, 73 deletions

diff --git a/build/server.js b/build/server.js
index df9604e..63ed3f4 100644
--- a/build/server.js
+++ b/build/server.js
@@ -71,6 +71,18 @@ ClientTools.getByName = function(clients,name,def) {
 	}
 	return def;
 };
+ClientTools.hasPermission = function(client,permission,permissions) {
+	if((client.group & 4) != 0) {
+		return permissions.admin.indexOf(permission) != -1;
+	}
+	if((client.group & 2) != 0) {
+		return permissions.leader.indexOf(permission) != -1;
+	}
+	if((client.group & 1) != 0) {
+		return permissions.user.indexOf(permission) != -1;
+	}
+	return permissions.guest.indexOf(permission) != -1;
+};
 var DateTools = function() { };
 DateTools.__name__ = true;
 DateTools.__format_get = function(d,e) {
@@ -1437,7 +1449,7 @@ JsonParser_$52.__name__ = true;
 JsonParser_$52.__super__ = json2object_reader_BaseParser;
 JsonParser_$52.prototype = $extend(json2object_reader_BaseParser.prototype,{
 	onIncorrectType: function(pos,variable) {
-		this.errors.push(json2object_Error.IncorrectType(variable,"{ youtubePlaylistLimit : Int, youtubeApiKey : String, userVideoLimit : Int, totalVideoLimit : Int, templateUrl : String, serverChatHistory : Int, ?salt : Null<String>, requestLeaderOnPause : Bool, port : Int, permissions : { user : Array<Permission>, leader : Array<Permission>, guest : Array<Permission>, admin : Array<Permission> }, maxMessageLength : Int, maxLoginLength : Int, localAdmins : Bool, ?isVerbose : Null<Bool>, filters : Array<Filter>, emotes : Array<Emote>, channelName : String }",pos));
+		this.errors.push(json2object_Error.IncorrectType(variable,"{ youtubePlaylistLimit : Int, youtubeApiKey : String, userVideoLimit : Int, totalVideoLimit : Int, templateUrl : String, serverChatHistory : Int, ?salt : Null<String>, requestLeaderOnPause : Bool, port : Int, permissions : Permissions, maxMessageLength : Int, maxLoginLength : Int, localAdmins : Bool, ?isVerbose : Null<Bool>, filters : Array<Filter>, emotes : Array<Emote>, channelName : String }",pos));
 		json2object_reader_BaseParser.prototype.onIncorrectType.call(this,pos,variable);
 	}
 	,loadJsonNull: function(pos,variable) {
@@ -1474,7 +1486,7 @@ JsonParser_$52.prototype = $extend(json2object_reader_BaseParser.prototype,{
 				this.value.maxMessageLength = this.loadObjectField(($_=new JsonParser_$42(this.errors,this.putils,1),$bind($_,$_.loadJson)),field,"maxMessageLength",assigned,this.value.maxMessageLength,pos);
 				break;
 			case "permissions":
-				this.value.permissions = this.loadObjectField(($_=new JsonParser_$58(this.errors,this.putils,1),$bind($_,$_.loadJson)),field,"permissions",assigned,this.value.permissions,pos);
+				this.value.permissions = this.loadObjectField(($_=new JsonParser_$59(this.errors,this.putils,1),$bind($_,$_.loadJson)),field,"permissions",assigned,this.value.permissions,pos);
 				break;
 			case "port":
 				this.value.port = this.loadObjectField(($_=new JsonParser_$42(this.errors,this.putils,1),$bind($_,$_.loadJson)),field,"port",assigned,this.value.port,pos);
@@ -1510,7 +1522,7 @@ JsonParser_$52.prototype = $extend(json2object_reader_BaseParser.prototype,{
 		this.objectErrors(assigned,pos);
 	}
 	,getAuto: function() {
-		return { channelName : new JsonParser_$36([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), emotes : new JsonParser_$56([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), filters : new JsonParser_$57([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), isVerbose : new JsonParser_$46([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), localAdmins : new JsonParser_$38([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), maxLoginLength : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), maxMessageLength : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), permissions : new JsonParser_$58([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), port : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), requestLeaderOnPause : new JsonParser_$38([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), salt : new JsonParser_$48([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), serverChatHistory : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), templateUrl : new JsonParser_$36([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), totalVideoLimit : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), userVideoLimit : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), youtubeApiKey : new JsonParser_$36([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), youtubePlaylistLimit : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1)))};
+		return { channelName : new JsonParser_$36([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), emotes : new JsonParser_$56([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), filters : new JsonParser_$57([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), isVerbose : new JsonParser_$46([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), localAdmins : new JsonParser_$38([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), maxLoginLength : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), maxMessageLength : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), permissions : new JsonParser_$59([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), port : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), requestLeaderOnPause : new JsonParser_$38([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), salt : new JsonParser_$48([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), serverChatHistory : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), templateUrl : new JsonParser_$36([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), totalVideoLimit : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), userVideoLimit : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), youtubeApiKey : new JsonParser_$36([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), youtubePlaylistLimit : new JsonParser_$42([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1)))};
 	}
 	,__class__: JsonParser_$52
 });
@@ -1597,7 +1609,7 @@ JsonParser_$56.prototype = $extend(json2object_reader_BaseParser.prototype,{
 		this.value = null;
 	}
 	,loadJsonArray: function(a,pos,variable) {
-		this.value = this.loadJsonArrayValue(a,($_=new JsonParser_$64(this.errors,this.putils,2),$bind($_,$_.loadJson)),variable);
+		this.value = this.loadJsonArrayValue(a,($_=new JsonParser_$65(this.errors,this.putils,2),$bind($_,$_.loadJson)),variable);
 	}
 	,__class__: JsonParser_$56
 });
@@ -1618,19 +1630,19 @@ JsonParser_$57.prototype = $extend(json2object_reader_BaseParser.prototype,{
 		this.value = null;
 	}
 	,loadJsonArray: function(a,pos,variable) {
-		this.value = this.loadJsonArrayValue(a,($_=new JsonParser_$62(this.errors,this.putils,2),$bind($_,$_.loadJson)),variable);
+		this.value = this.loadJsonArrayValue(a,($_=new JsonParser_$63(this.errors,this.putils,2),$bind($_,$_.loadJson)),variable);
 	}
 	,__class__: JsonParser_$57
 });
-var JsonParser_$58 = function(errors,putils,errorType) {
+var JsonParser_$59 = function(errors,putils,errorType) {
 	if(errorType == null) {
 		errorType = 0;
 	}
 	json2object_reader_BaseParser.call(this,errors,putils,errorType);
 };
-JsonParser_$58.__name__ = true;
-JsonParser_$58.__super__ = json2object_reader_BaseParser;
-JsonParser_$58.prototype = $extend(json2object_reader_BaseParser.prototype,{
+JsonParser_$59.__name__ = true;
+JsonParser_$59.__super__ = json2object_reader_BaseParser;
+JsonParser_$59.prototype = $extend(json2object_reader_BaseParser.prototype,{
 	onIncorrectType: function(pos,variable) {
 		this.errors.push(json2object_Error.IncorrectType(variable,"{ user : Array<Permission>, leader : Array<Permission>, guest : Array<Permission>, admin : Array<Permission> }",pos));
 		json2object_reader_BaseParser.prototype.onIncorrectType.call(this,pos,variable);
@@ -1648,16 +1660,16 @@ JsonParser_$58.prototype = $extend(json2object_reader_BaseParser.prototype,{
 			++_g;
 			switch(field.name) {
 			case "admin":
-				this.value.admin = this.loadObjectField(($_=new JsonParser_$59(this.errors,this.putils,1),$bind($_,$_.loadJson)),field,"admin",assigned,this.value.admin,pos);
+				this.value.admin = this.loadObjectField(($_=new JsonParser_$60(this.errors,this.putils,1),$bind($_,$_.loadJson)),field,"admin",assigned,this.value.admin,pos);
 				break;
 			case "guest":
-				this.value.guest = this.loadObjectField(($_=new JsonParser_$59(this.errors,this.putils,1),$bind($_,$_.loadJson)),field,"guest",assigned,this.value.guest,pos);
+				this.value.guest = this.loadObjectField(($_=new JsonParser_$60(this.errors,this.putils,1),$bind($_,$_.loadJson)),field,"guest",assigned,this.value.guest,pos);
 				break;
 			case "leader":
-				this.value.leader = this.loadObjectField(($_=new JsonParser_$59(this.errors,this.putils,1),$bind($_,$_.loadJson)),field,"leader",assigned,this.value.leader,pos);
+				this.value.leader = this.loadObjectField(($_=new JsonParser_$60(this.errors,this.putils,1),$bind($_,$_.loadJson)),field,"leader",assigned,this.value.leader,pos);
 				break;
 			case "user":
-				this.value.user = this.loadObjectField(($_=new JsonParser_$59(this.errors,this.putils,1),$bind($_,$_.loadJson)),field,"user",assigned,this.value.user,pos);
+				this.value.user = this.loadObjectField(($_=new JsonParser_$60(this.errors,this.putils,1),$bind($_,$_.loadJson)),field,"user",assigned,this.value.user,pos);
 				break;
 			default:
 				this.errors.push(json2object_Error.UnknownVariable(field.name,this.putils.convertPosition(field.namePos)));
@@ -1666,19 +1678,19 @@ JsonParser_$58.prototype = $extend(json2object_reader_BaseParser.prototype,{
 		this.objectErrors(assigned,pos);
 	}
 	,getAuto: function() {
-		return { admin : new JsonParser_$59([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), guest : new JsonParser_$59([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), leader : new JsonParser_$59([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), user : new JsonParser_$59([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1)))};
+		return { admin : new JsonParser_$60([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), guest : new JsonParser_$60([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), leader : new JsonParser_$60([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), user : new JsonParser_$60([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1)))};
 	}
-	,__class__: JsonParser_$58
+	,__class__: JsonParser_$59
 });
-var JsonParser_$59 = function(errors,putils,errorType) {
+var JsonParser_$60 = function(errors,putils,errorType) {
 	if(errorType == null) {
 		errorType = 0;
 	}
 	json2object_reader_BaseParser.call(this,errors,putils,errorType);
 };
-JsonParser_$59.__name__ = true;
-JsonParser_$59.__super__ = json2object_reader_BaseParser;
-JsonParser_$59.prototype = $extend(json2object_reader_BaseParser.prototype,{
+JsonParser_$60.__name__ = true;
+JsonParser_$60.__super__ = json2object_reader_BaseParser;
+JsonParser_$60.prototype = $extend(json2object_reader_BaseParser.prototype,{
 	onIncorrectType: function(pos,variable) {
 		this.errors.push(json2object_Error.IncorrectType(variable,"Array<Permission>",pos));
 		json2object_reader_BaseParser.prototype.onIncorrectType.call(this,pos,variable);
@@ -1687,19 +1699,19 @@ JsonParser_$59.prototype = $extend(json2object_reader_BaseParser.prototype,{
 		this.value = null;
 	}
 	,loadJsonArray: function(a,pos,variable) {
-		this.value = this.loadJsonArrayValue(a,($_=new JsonParser_$60(this.errors,this.putils,2),$bind($_,$_.loadJson)),variable);
+		this.value = this.loadJsonArrayValue(a,($_=new JsonParser_$61(this.errors,this.putils,2),$bind($_,$_.loadJson)),variable);
 	}
-	,__class__: JsonParser_$59
+	,__class__: JsonParser_$60
 });
-var JsonParser_$60 = function(errors,putils,errorType) {
+var JsonParser_$61 = function(errors,putils,errorType) {
 	if(errorType == null) {
 		errorType = 0;
 	}
 	json2object_reader_BaseParser.call(this,errors,putils,errorType);
 };
-JsonParser_$60.__name__ = true;
-JsonParser_$60.__super__ = json2object_reader_BaseParser;
-JsonParser_$60.prototype = $extend(json2object_reader_BaseParser.prototype,{
+JsonParser_$61.__name__ = true;
+JsonParser_$61.__super__ = json2object_reader_BaseParser;
+JsonParser_$61.prototype = $extend(json2object_reader_BaseParser.prototype,{
 	onIncorrectType: function(pos,variable) {
 		this.value = "guest";
 		this.errors.push(json2object_Error.IncorrectType(variable,"Permission",pos));
@@ -1711,17 +1723,17 @@ JsonParser_$60.prototype = $extend(json2object_reader_BaseParser.prototype,{
 	,loadJsonString: function(s,pos,variable) {
 		this.value = this.loadString(s,pos,variable,["guest","user","leader","admin","writeChat","addVideo","removeVideo","requestLeader","rewind","clearChat","setLeader","changeOrder","lockPlaylist"],"guest");
 	}
-	,__class__: JsonParser_$60
+	,__class__: JsonParser_$61
 });
-var JsonParser_$62 = function(errors,putils,errorType) {
+var JsonParser_$63 = function(errors,putils,errorType) {
 	if(errorType == null) {
 		errorType = 0;
 	}
 	json2object_reader_BaseParser.call(this,errors,putils,errorType);
 };
-JsonParser_$62.__name__ = true;
-JsonParser_$62.__super__ = json2object_reader_BaseParser;
-JsonParser_$62.prototype = $extend(json2object_reader_BaseParser.prototype,{
+JsonParser_$63.__name__ = true;
+JsonParser_$63.__super__ = json2object_reader_BaseParser;
+JsonParser_$63.prototype = $extend(json2object_reader_BaseParser.prototype,{
 	onIncorrectType: function(pos,variable) {
 		this.errors.push(json2object_Error.IncorrectType(variable,"{ replace : String, regex : String, name : String, flags : String }",pos));
 		json2object_reader_BaseParser.prototype.onIncorrectType.call(this,pos,variable);
@@ -1759,17 +1771,17 @@ JsonParser_$62.prototype = $extend(json2object_reader_BaseParser.prototype,{
 	,getAuto: function() {
 		return { flags : new JsonParser_$36([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), name : new JsonParser_$36([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), regex : new JsonParser_$36([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), replace : new JsonParser_$36([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1)))};
 	}
-	,__class__: JsonParser_$62
+	,__class__: JsonParser_$63
 });
-var JsonParser_$64 = function(errors,putils,errorType) {
+var JsonParser_$65 = function(errors,putils,errorType) {
 	if(errorType == null) {
 		errorType = 0;
 	}
 	json2object_reader_BaseParser.call(this,errors,putils,errorType);
 };
-JsonParser_$64.__name__ = true;
-JsonParser_$64.__super__ = json2object_reader_BaseParser;
-JsonParser_$64.prototype = $extend(json2object_reader_BaseParser.prototype,{
+JsonParser_$65.__name__ = true;
+JsonParser_$65.__super__ = json2object_reader_BaseParser;
+JsonParser_$65.prototype = $extend(json2object_reader_BaseParser.prototype,{
 	onIncorrectType: function(pos,variable) {
 		this.errors.push(json2object_Error.IncorrectType(variable,"{ name : String, image : String }",pos));
 		json2object_reader_BaseParser.prototype.onIncorrectType.call(this,pos,variable);
@@ -1801,7 +1813,7 @@ JsonParser_$64.prototype = $extend(json2object_reader_BaseParser.prototype,{
 	,getAuto: function() {
 		return { image : new JsonParser_$36([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1))), name : new JsonParser_$36([],this.putils,0).loadJson(new hxjsonast_Json(hxjsonast_JsonValue.JNull,new hxjsonast_Position("",0,1)))};
 	}
-	,__class__: JsonParser_$64
+	,__class__: JsonParser_$65
 });
 var JsonParser_$7 = function(errors,putils,errorType) {
 	if(errorType == null) {
@@ -4017,6 +4029,9 @@ server_Main.prototype = {
 				this.serverMessage(client,"videoLimitPerUserError");
 				return;
 			}
+			if(!data.addVideo.atEnd && !this.checkPermission(client,"changeOrder")) {
+				data.addVideo.atEnd = true;
+			}
 			var item = data.addVideo.item;
 			item.author = client.name;
 			var local = "" + this.localIp + ":" + this.port;
@@ -4406,25 +4421,12 @@ server_Main.prototype = {
 		this.broadcast(data);
 	}
 	,checkPermission: function(client,perm) {
-		var state = this.hasPermission(client,perm);
+		var state = ClientTools.hasPermission(client,perm,this.config.permissions);
 		if(!state) {
 			this.send(client,{ type : "ServerMessage", serverMessage : { textId : "accessError"}});
 		}
 		return state;
 	}
-	,hasPermission: function(client,perm) {
-		var p = this.config.permissions;
-		if((client.group & 4) != 0) {
-			return p.admin.indexOf(perm) != -1;
-		}
-		if((client.group & 2) != 0) {
-			return p.leader.indexOf(perm) != -1;
-		}
-		if((client.group & 1) != 0) {
-			return p.user.indexOf(perm) != -1;
-		}
-		return p.guest.indexOf(perm) != -1;
-	}
 	,badNickName: function(name) {
 		if(name.length == 0) {
 			return true;
diff --git a/res/client.js b/res/client.js
index 94af960..6f01550 100644
--- a/res/client.js
+++ b/res/client.js
@@ -68,6 +68,18 @@ ClientTools.getByName = function(clients,name,def) {
 	}
 	return def;
 };
+ClientTools.hasPermission = function(client,permission,permissions) {
+	if((client.group & 4) != 0) {
+		return permissions.admin.indexOf(permission) != -1;
+	}
+	if((client.group & 2) != 0) {
+		return permissions.leader.indexOf(permission) != -1;
+	}
+	if((client.group & 1) != 0) {
+		return permissions.user.indexOf(permission) != -1;
+	}
+	return permissions.guest.indexOf(permission) != -1;
+};
 var EReg = function(r,opt) {
 	this.r = new RegExp(r,opt.split("u").join(""));
 };
@@ -1259,7 +1271,7 @@ client_Main.prototype = {
 		var data = JSON.parse(e.data);
 		if(this.config != null && this.config.isVerbose) {
 			var t = data.type;
-			haxe_Log.trace("Event: " + data.type,{ fileName : "src/client/Main.hx", lineNumber : 347, className : "client.Main", methodName : "onMessage", customParams : [Reflect.field(data,t.charAt(0).toLowerCase() + HxOverrides.substr(t,1,null))]});
+			haxe_Log.trace("Event: " + data.type,{ fileName : "src/client/Main.hx", lineNumber : 348, className : "client.Main", methodName : "onMessage", customParams : [Reflect.field(data,t.charAt(0).toLowerCase() + HxOverrides.substr(t,1,null))]});
 		}
 		client_JsApi.fireOnceEvent(data);
 		switch(data.type) {
@@ -1333,10 +1345,11 @@ client_Main.prototype = {
 		case "Logout":
 			this.updateClients(data.logout.clients);
 			this.personal = new Client(data.logout.clientName,0);
+			this.onUserGroupChanged();
+			this.showGuestLoginPanel();
 			this.settings.name = "";
 			this.settings.hash = "";
 			client_Settings.write(this.settings);
-			this.showGuestLoginPanel();
 			break;
 		case "Message":
 			this.addMessage(data.message.clientName,data.message.text);
@@ -1421,7 +1434,11 @@ client_Main.prototype = {
 			break;
 		case "UpdateClients":
 			this.updateClients(data.updateClients.clients);
+			var oldGroup = this.personal.group;
 			this.personal = ClientTools.getByName(this.clients,this.personal.name,this.personal);
+			if(this.personal.group != oldGroup) {
+				this.onUserGroupChanged();
+			}
 			break;
 		case "UpdatePlaylist":
 			this.player.setItems(data.updatePlaylist.videoList);
@@ -1469,6 +1486,21 @@ client_Main.prototype = {
 			this.addMessage(message.name,message.text,message.time);
 		}
 		this.player.setItems(connected.videoList,connected.itemPos);
+		this.onUserGroupChanged();
+	}
+	,onUserGroupChanged: function() {
+		var button = window.document.querySelector("#queue_next");
+		if(ClientTools.hasPermission(this.personal,"changeOrder",this.config.permissions)) {
+			button.disabled = false;
+		} else {
+			button.disabled = true;
+		}
+		var adminMenu = window.document.querySelector("#adminMenu");
+		if((this.personal.group & 4) != 0) {
+			adminMenu.style.display = "block";
+		} else {
+			adminMenu.style.display = "none";
+		}
 	}
 	,guestLogin: function(name) {
 		if(name.length == 0) {
@@ -1550,6 +1582,7 @@ client_Main.prototype = {
 			return;
 		}
 		this.personal = newPersonal;
+		this.onUserGroupChanged();
 		this.hideGuestLoginPanel();
 	}
 	,showGuestLoginPanel: function() {
@@ -1563,9 +1596,6 @@ client_Main.prototype = {
 		window.document.querySelector("#guestpassword").style.display = "none";
 		window.document.querySelector("#chatbox").style.display = "flex";
 		window.document.querySelector("#exitBtn").textContent = Lang.get("exit");
-		if((this.personal.group & 4) != 0) {
-			window.document.querySelector("#adminMenu").style.display = "block";
-		}
 	}
 	,showGuestPasswordPanel: function() {
 		window.document.querySelector("#guestlogin").style.display = "none";
diff --git a/res/css/des.css b/res/css/des.css
index aa423bd..8788bdd 100644
--- a/res/css/des.css
+++ b/res/css/des.css
@@ -132,6 +132,14 @@ button:focus ion-icon {
   color: var(--foreground);
 }
 
+button[disabled],
+button[disabled]:hover {
+  background-color: var(--background-chat);
+  color: var(--midground);
+  opacity: 0.5;
+  cursor: default;
+}
+
 button > * {
   line-height: 1;
 }
diff --git a/src/ClientTools.hx b/src/ClientTools.hx
index 26faab6..e83e450 100644
--- a/src/ClientTools.hx
+++ b/src/ClientTools.hx
@@ -1,5 +1,8 @@
 package;
 
+import Types.Permissions;
+import Types.Permission;
+
 class ClientTools {
 
 	public static function setLeader(clients:Array<Client>, name:String):Void {
@@ -25,4 +28,12 @@ class ClientTools {
 		return def;
 	}
 
+	public static function hasPermission(client:Client, permission:Permission, permissions:Permissions):Bool {
+		final p = permissions;
+		if (client.isAdmin) return p.admin.contains(permission);
+		if (client.isLeader) return p.leader.contains(permission);
+		if (client.isUser) return p.user.contains(permission);
+		return p.guest.contains(permission);
+	}
+
 }
diff --git a/src/Types.hx b/src/Types.hx
index 4061b09..02a2cee 100644
--- a/src/Types.hx
+++ b/src/Types.hx
@@ -27,17 +27,19 @@ typedef Config = {
 	templateUrl:String,
 	youtubeApiKey:String,
 	youtubePlaylistLimit:Int,
-	permissions:{
-		guest:Array<Permission>,
-		user:Array<Permission>,
-		leader:Array<Permission>,
-		admin:Array<Permission>
-	},
+	permissions:Permissions,
 	emotes:Array<Emote>,
 	filters:Array<Filter>,
 	?isVerbose:Bool,
 	?salt:String
-};
+}
+
+typedef Permissions = {
+	guest:Array<Permission>,
+	user:Array<Permission>,
+	leader:Array<Permission>,
+	admin:Array<Permission>
+}
 
 enum abstract Permission(String) {
 	var GuestPerm = "guest";
diff --git a/src/client/Main.hx b/src/client/Main.hx
index 8e20ee3..ad614c5 100644
--- a/src/client/Main.hx
+++ b/src/client/Main.hx
@@ -9,6 +9,7 @@ import js.html.Event;
 import js.html.Element;
 import js.html.VideoElement;
 import js.html.InputElement;
+import js.html.ButtonElement;
 import js.html.WebSocket;
 import js.Browser;
 import js.Browser.document;
@@ -368,14 +369,17 @@ class Main {
 			case Logout:
 				updateClients(data.logout.clients);
 				personal = new Client(data.logout.clientName, 0);
+				onUserGroupChanged();
+				showGuestLoginPanel();
 				settings.name = "";
 				settings.hash = "";
 				Settings.write(settings);
-				showGuestLoginPanel();
 
 			case UpdateClients:
 				updateClients(data.updateClients.clients);
+				final oldGroup = personal.group.toInt();
 				personal = clients.getByName(personal.name, personal);
+				if (personal.group.toInt() != oldGroup) onUserGroupChanged();
 
 			case Message:
 				addMessage(data.message.clientName, data.message.text);
@@ -522,6 +526,19 @@ class Main {
 			addMessage(message.name, message.text, message.time);
 		}
 		player.setItems(connected.videoList, connected.itemPos);
+		onUserGroupChanged();
+	}
+
+	function onUserGroupChanged():Void {
+		final button:ButtonElement = cast ge("#queue_next");
+		if (personal.hasPermission(ChangeOrderPerm, config.permissions)) {
+			button.disabled = false;
+		} else {
+			button.disabled = true;
+		}
+		final adminMenu = ge("#adminMenu");
+		if (isAdmin()) adminMenu.style.display = "block";
+		else adminMenu.style.display = "none";
 	}
 
 	public function guestLogin(name:String):Void {
@@ -602,6 +619,7 @@ class Main {
 		final newPersonal = clients.getByName(clientName);
 		if (newPersonal == null) return;
 		personal = newPersonal;
+		onUserGroupChanged();
 		hideGuestLoginPanel();
 	}
 
@@ -617,7 +635,6 @@ class Main {
 		ge("#guestpassword").style.display = "none";
 		ge("#chatbox").style.display = "flex";
 		ge("#exitBtn").textContent = Lang.get("exit");
-		if (isAdmin()) ge("#adminMenu").style.display = "block";
 	}
 
 	function showGuestPasswordPanel():Void {
diff --git a/src/server/Main.hx b/src/server/Main.hx
index 07f782a..565daab 100644
--- a/src/server/Main.hx
+++ b/src/server/Main.hx
@@ -472,6 +472,9 @@ class Main {
 					serverMessage(client, "videoLimitPerUserError");
 					return;
 				}
+				if (!data.addVideo.atEnd && !checkPermission(client, ChangeOrderPerm)) {
+					data.addVideo.atEnd = true;
+				}
 				final item = data.addVideo.item;
 				item.author = client.name;
 				final local = '$localIp:$port';
@@ -721,7 +724,7 @@ class Main {
 	}
 
 	function checkPermission(client:Client, perm:Permission):Bool {
-		final state = hasPermission(client, perm);
+		final state = client.hasPermission(perm, config.permissions);
 		if (!state) send(client, {
 			type: ServerMessage, serverMessage: {
 				textId: "accessError"
@@ -730,14 +733,6 @@ class Main {
 		return state;
 	}
 
-	function hasPermission(client:Client, perm:Permission):Bool {
-		final p = config.permissions;
-		if (client.isAdmin) return p.admin.indexOf(cast perm) != -1;
-		if (client.isLeader) return p.leader.indexOf(cast perm) != -1;
-		if (client.isUser) return p.user.indexOf(cast perm) != -1;
-		return p.guest.indexOf(cast perm) != -1;
-	}
-
 	final htmlChars = ~/[&^<>'"]/;
 
 	public function badNickName(name:String):Bool {