=== modified file 'dhis-2/dhis-api/src/main/java/org/hisp/dhis/dataelement/DataElementCategoryOption.java'
--- dhis-2/dhis-api/src/main/java/org/hisp/dhis/dataelement/DataElementCategoryOption.java	2014-10-23 08:30:41 +0000
+++ dhis-2/dhis-api/src/main/java/org/hisp/dhis/dataelement/DataElementCategoryOption.java	2014-11-10 11:43:54 +0000
@@ -143,8 +143,7 @@
 
     public boolean includes( OrganisationUnit ou )
     {
-        return organisationUnits == null || organisationUnits.isEmpty()
-                || ou.isEqualOrChildOf( organisationUnits );
+        return organisationUnits == null || organisationUnits.isEmpty() || ou.isDescendant( organisationUnits );
     }
 
     public boolean includesAny( Set<OrganisationUnit> orgUnits )
@@ -156,6 +155,7 @@
                 return true;
             }
         }
+        
         return false;
     }
 

=== modified file 'dhis-2/dhis-api/src/main/java/org/hisp/dhis/organisationunit/OrganisationUnit.java'
--- dhis-2/dhis-api/src/main/java/org/hisp/dhis/organisationunit/OrganisationUnit.java	2014-10-21 08:44:43 +0000
+++ dhis-2/dhis-api/src/main/java/org/hisp/dhis/organisationunit/OrganisationUnit.java	2014-11-10 11:43:54 +0000
@@ -350,7 +350,29 @@
         return false;
     }
 
-    public boolean isEqualOrChildOf( Set<OrganisationUnit> ancestors )
+    public boolean isDescendant( OrganisationUnit ancestor )
+    {
+        if ( ancestor == null )
+        {
+            return false;
+        }
+
+        OrganisationUnit unit = this;
+
+        while ( unit != null )
+        {
+            if ( ancestor.equals( unit ) )
+            {
+                return true;
+            }
+            
+            unit = unit.getParent();
+        }
+        
+        return false;
+    }
+    
+    public boolean isDescendant( Set<OrganisationUnit> ancestors )
     {
         if ( ancestors == null || ancestors.isEmpty() )
         {

=== modified file 'dhis-2/dhis-services/dhis-service-analytics/src/main/java/org/hisp/dhis/analytics/security/DefaultAnalyticsSecurityManager.java'
--- dhis-2/dhis-services/dhis-service-analytics/src/main/java/org/hisp/dhis/analytics/security/DefaultAnalyticsSecurityManager.java	2014-10-16 06:17:19 +0000
+++ dhis-2/dhis-services/dhis-service-analytics/src/main/java/org/hisp/dhis/analytics/security/DefaultAnalyticsSecurityManager.java	2014-11-10 11:43:54 +0000
@@ -100,7 +100,7 @@
         {
             OrganisationUnit queryOrgUnit = (OrganisationUnit) object;
             
-            if ( !queryOrgUnit.isEqualOrChildOf( viewOrgUnits ) )
+            if ( !queryOrgUnit.isDescendant( viewOrgUnits ) )
             {
                 throw new IllegalQueryException( "User: " + user.getUsername() + " is not allowed to view org unit: " + queryOrgUnit.getUid() );
             }

=== modified file 'dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/dataapproval/DefaultDataApprovalLevelService.java'
--- dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/dataapproval/DefaultDataApprovalLevelService.java	2014-11-10 11:15:43 +0000
+++ dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/dataapproval/DefaultDataApprovalLevelService.java	2014-11-10 11:43:54 +0000
@@ -476,18 +476,23 @@
     @Override
     public DataApprovalLevel getUserApprovalLevel( User user, OrganisationUnit orgUnit )
     {
-        if ( user != null )
-        {
-            for ( OrganisationUnit ou : user.getOrganisationUnits() )
+        if ( user == null || orgUnit == null )
+        {
+            return null;
+        }
+        
+        OrganisationUnit organisationUnit = null;
+        
+        for ( OrganisationUnit unit : user.getOrganisationUnits() )
+        {
+            if ( orgUnit.isDescendant( unit ) )
             {
-                if ( orgUnit.isEqualOrChildOf( org.hisp.dhis.system.util.CollectionUtils.asSet( ou ) ) )
-                {
-                    return userApprovalLevel( ou, user );
-                }
+                organisationUnit = unit;
+                break;
             }
         }
 
-        return null;
+        return organisationUnit != null ? getUserApprovalLevel( organisationUnit, user ) : null;
     }
 
     @Override
@@ -628,11 +633,11 @@
      */
     private int requiredApprovalLevel( OrganisationUnit orgUnit, User user )
     {
-        DataApprovalLevel userLevel = userApprovalLevel( orgUnit, user );
+        DataApprovalLevel userLevel = getUserApprovalLevel( orgUnit, user );
 
-        return userLevel == null ? 0 :
-                userLevel.getLevel() == getAllDataApprovalLevels().size() ? APPROVAL_LEVEL_UNAPPROVED :
-                        userLevel.getLevel() + 1;
+        return userLevel == null ? 0 : 
+            userLevel.getLevel() == getAllDataApprovalLevels().size() ? APPROVAL_LEVEL_UNAPPROVED :
+            userLevel.getLevel() + 1;
     }
 
     /**
@@ -657,7 +662,7 @@
      * @param orgUnit organisation unit to test.
      * @return approval level for user.
      */
-    private DataApprovalLevel userApprovalLevel( OrganisationUnit orgUnit, User user )
+    private DataApprovalLevel getUserApprovalLevel( OrganisationUnit orgUnit, User user )
     {
         int orgUnitLevel = organisationUnitService.getLevelOfOrganisationUnit( orgUnit );
 

=== modified file 'dhis-2/dhis-services/dhis-service-core/src/test/java/org/hisp/dhis/organisationunit/OrganisationUnitServiceTest.java'
--- dhis-2/dhis-services/dhis-service-core/src/test/java/org/hisp/dhis/organisationunit/OrganisationUnitServiceTest.java	2014-10-07 13:46:29 +0000
+++ dhis-2/dhis-services/dhis-service-core/src/test/java/org/hisp/dhis/organisationunit/OrganisationUnitServiceTest.java	2014-11-10 11:43:54 +0000
@@ -362,31 +362,56 @@
     }
     
     @Test
-    public void testIsEqualOrChildOf()
-    {
-        OrganisationUnit unit1 = createOrganisationUnit( '1' );
-        organisationUnitService.addOrganisationUnit( unit1 );
-
-        OrganisationUnit unit2 = createOrganisationUnit( '2', unit1 );
-        unit1.getChildren().add( unit2 );
-        organisationUnitService.addOrganisationUnit( unit2 );
-
-        OrganisationUnit unit3 = createOrganisationUnit( '3', unit2 );
-        unit2.getChildren().add( unit3 );
-        organisationUnitService.addOrganisationUnit( unit3 );
-
-        OrganisationUnit unit4 = createOrganisationUnit( '4' );
-        organisationUnitService.addOrganisationUnit( unit4 );
-        
-        assertTrue( unit1.isEqualOrChildOf( asSet( unit1 ) ) );
-        assertTrue( unit2.isEqualOrChildOf( asSet( unit1 ) ) );
-        assertTrue( unit3.isEqualOrChildOf( asSet( unit1 ) ) );
-        assertTrue( unit2.isEqualOrChildOf( asSet( unit1, unit3 ) ) );
-        
-        assertFalse( unit2.isEqualOrChildOf( asSet( unit3 ) ) );
-        assertFalse( unit4.isEqualOrChildOf( asSet( unit1 ) ) );
-    }
-
+    public void testIsDescendantSet()
+    {
+        OrganisationUnit unit1 = createOrganisationUnit( '1' );
+        organisationUnitService.addOrganisationUnit( unit1 );
+
+        OrganisationUnit unit2 = createOrganisationUnit( '2', unit1 );
+        unit1.getChildren().add( unit2 );
+        organisationUnitService.addOrganisationUnit( unit2 );
+
+        OrganisationUnit unit3 = createOrganisationUnit( '3', unit2 );
+        unit2.getChildren().add( unit3 );
+        organisationUnitService.addOrganisationUnit( unit3 );
+
+        OrganisationUnit unit4 = createOrganisationUnit( '4' );
+        organisationUnitService.addOrganisationUnit( unit4 );
+        
+        assertTrue( unit1.isDescendant( asSet( unit1 ) ) );
+        assertTrue( unit2.isDescendant( asSet( unit1 ) ) );
+        assertTrue( unit3.isDescendant( asSet( unit1 ) ) );
+        assertTrue( unit2.isDescendant( asSet( unit1, unit3 ) ) );
+        
+        assertFalse( unit2.isDescendant( asSet( unit3 ) ) );
+        assertFalse( unit4.isDescendant( asSet( unit1 ) ) );
+    }
+
+    @Test
+    public void testIsDescendantObject()
+    {
+        OrganisationUnit unit1 = createOrganisationUnit( '1' );
+        organisationUnitService.addOrganisationUnit( unit1 );
+
+        OrganisationUnit unit2 = createOrganisationUnit( '2', unit1 );
+        unit1.getChildren().add( unit2 );
+        organisationUnitService.addOrganisationUnit( unit2 );
+
+        OrganisationUnit unit3 = createOrganisationUnit( '3', unit2 );
+        unit2.getChildren().add( unit3 );
+        organisationUnitService.addOrganisationUnit( unit3 );
+
+        OrganisationUnit unit4 = createOrganisationUnit( '4' );
+        organisationUnitService.addOrganisationUnit( unit4 );
+        
+        assertTrue( unit1.isDescendant( unit1 ) );
+        assertTrue( unit2.isDescendant( unit1 ) );
+        assertTrue( unit3.isDescendant( unit1 ) );
+        
+        assertFalse( unit2.isDescendant( unit3 ) );
+        assertFalse( unit4.isDescendant( unit1 ) );
+    }
+    
     @Test
     public void testGetOrganisationUnitAtLevelAndBranch()
         throws Exception