BUGFIX: Don't return child categories if you can't see the parent

category.

app/models/site.rb

@@ -43,9 +43,13 @@ class Site
 
       allowed_topic_create = Set.new(Category.topic_create_allowed(@guardian).pluck(:id))
 
+      by_id = {}
       categories.each do |category|
         category.permission = CategoryGroup.permission_types[:full] if allowed_topic_create.include?(category.id)
+        by_id[category.id] = category
       end
+
+      categories.reject! {|c| c.parent_category_id && !by_id[c.parent_category_id]}
       categories
     end
   end

spec/models/site_spec.rb

@@ -11,11 +11,21 @@ describe Site do
     category.set_permissions(:everyone => :create_post)
     category.save
 
-    Site.new(Guardian.new(user))
+    guardian = Guardian.new(user)
+
+    Site.new(guardian)
         .categories
         .keep_if{|c| c.name == category.name}
         .first
         .permission
         .should_not == CategoryGroup.permission_types[:full]
+
+    # If a parent category is not visible, the child categories should not be returned
+    category.set_permissions(:staff => :full)
+    category.save
+
+    sub_category = Fabricate(:category, parent_category_id: category.id)
+    Site.new(guardian).categories.should_not include(sub_category)
   end
+
 end