fix a few major permission holes

longs/views.py

@@ -271,6 +271,9 @@ def long_clone(request, pk):
     new_item.pk = None  # autogen a new pk (item_id)
     # new_item.name = "Copy of " + new_item.name #need to change uniques
 
+    if request.user not in new_item.get_author_objects() and not request.user.is_superuser:
+        raise PermissionDenied()  # or Http404
+
     form = LongForm(request.POST or None, instance=new_item)
 
     series_formset = SeriesFormSet()