Index: lams_central/src/java/org/lamsfoundation/lams/web/LessonOrderServlet.java
===================================================================
RCS file: /usr/local/cvsroot/lams_central/src/java/org/lamsfoundation/lams/web/LessonOrderServlet.java,v
diff -u -r1.2 -r1.3
--- lams_central/src/java/org/lamsfoundation/lams/web/LessonOrderServlet.java	28 Oct 2007 23:46:14 -0000	1.2
+++ lams_central/src/java/org/lamsfoundation/lams/web/LessonOrderServlet.java	29 Oct 2007 01:59:33 -0000	1.3
@@ -26,17 +26,14 @@
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Iterator;
 import java.util.List;
-import java.util.Set;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.apache.log4j.Logger;
-import org.lamsfoundation.lams.lesson.Lesson;
 import org.lamsfoundation.lams.usermanagement.Organisation;
 import org.lamsfoundation.lams.usermanagement.service.UserManagementService;
 import org.lamsfoundation.lams.util.WebUtil;
@@ -70,25 +67,7 @@
 		if (orgId != null && ids != null) {
 			Organisation org = (Organisation)service.findById(Organisation.class, orgId);
 						
-			if (org != null) {
-				// verify the ids are lessons that belong to orgId;
-				// necessary since javascript on index page doesn't restrict
-				// where user drops a lesson when sorting.
-				// TODO: remove this validation when the javascript sortable's
-				// containment parameter is working.
-				List<String> idList = Arrays.asList(ids.split(","));
-				List lessons = service.findByProperty(Lesson.class, "organisation", org);
-				for (String id : idList) {
-					try {
-						Long l = new Long(Long.parseLong(id));
-						if (!contains(lessons, l)) {
-							response.sendError(HttpServletResponse.SC_FORBIDDEN);
-						}
-					} catch(NumberFormatException e) {
-						continue;
-					}
-				}
-					
+			if (org != null) {					
 				String oldIds = org.getOrderedLessonIds();
 				String updatedIds = mergeLessonIds((oldIds!=null ? oldIds : ""), ids);
 				org.setOrderedLessonIds(updatedIds);
@@ -98,17 +77,6 @@
 		
 	}
 	
-	private boolean contains(List lessons, Long id) {
-		if (lessons != null) {
-			Iterator it = lessons.iterator();
-			while (it.hasNext()) {
-				Lesson lesson = (Lesson)it.next();
-				if (lesson.getLessonId().equals(id)) return true;
-			}
-		}
-		return false;
-	}
-	
 	// take the updated list and insert elements of the old list that don't exist in it;
 	private String mergeLessonIds(String old, String updated) {
 		List<String> oldIds = Arrays.asList(old.split(","));
Index: lams_central/web/main.jsp
===================================================================
RCS file: /usr/local/cvsroot/lams_central/web/main.jsp,v
diff -u -r1.21 -r1.22
--- lams_central/web/main.jsp	28 Oct 2007 23:46:38 -0000	1.21
+++ lams_central/web/main.jsp	29 Oct 2007 01:59:33 -0000	1.22
@@ -49,7 +49,10 @@
 					jQuery(element).Sortable({
 						accept: "j-single-lesson",
 						axis: "vertically",
-						// containment: "parent",
+						containment: [jQuery(element).offset().left,
+							jQuery(element).offset().top,
+							jQuery(element).width(),
+							jQuery(element).height()],
 						onStop: function s() {
 							var ids = [];
 							jQuery(this).parent().children("p").each(function(i, element) {