diff --git a/course/category.php b/course/category.php
index 8193e751f00..cb7b2a6ee96 100644
--- a/course/category.php
+++ b/course/category.php
@@ -160,7 +160,17 @@
             $courses = array();        
             foreach ( $data as $key => $value ) {
                 if (preg_match('/^c\d+$/', $key)) {
-                    array_push($courses, substr($key, 1));
+                    $courseid = substr($key, 1);
+                    array_push($courses, $courseid);
+
+                    // check this course's category
+                    if ($movingcourse = get_record('course', 'id', $courseid)) {
+                        if ($movingcourse->category != $id ) {
+                            error('The course doesn\'t belong to this category');
+                        }
+                    } else {
+                        error('Error finding the course');
+                    }
                 }
             } 
             move_courses($courses, $data->moveto);
@@ -169,7 +179,6 @@
     /// Hide or show a course
 
         if ((!empty($hide) or !empty($show)) and confirm_sesskey()) {
-            require_capability('moodle/course:visibility', $context);
             if (!empty($hide)) {
                 $course = get_record("course", "id", $hide);
                 $visible = 0;
@@ -178,8 +187,10 @@
                 $visible = 1;
             }
             if ($course) {
-                if (! set_field("course", "visible", $visible, "id", $course->id)) {
-                    notify("Could not update that course!");
+                $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
+                require_capability('moodle/course:visibility', $coursecontext);
+                if (!set_field('course', 'visible', $visible, 'id', $course->id)) {
+                    notify('Could not update that course!');
                 }
             }
         }
@@ -212,8 +223,11 @@
                                          'category',  $category->id,
                                          'sortorder', $movecourse->sortorder + 1);
             }
-
             if ($swapcourse and $movecourse) {        // Renumber everything for robustness
+                // check course's category
+                if ($movecourse->category != $id) {
+                    error('The course doesn\'t belong to this category');
+                }
                 begin_sql();
                 if (!(    set_field("course", "sortorder", $max, "id", $swapcourse->id)
                        && set_field("course", "sortorder", $swapcourse->sortorder, "id", $movecourse->id)