diff --git a/app/controllers/jobs_controller.rb b/app/controllers/jobs_controller.rb
index ac83ec2..b524827 100644
--- a/app/controllers/jobs_controller.rb
+++ b/app/controllers/jobs_controller.rb
@@ -1,60 +1,60 @@
 class JobsController < ApplicationController
-  before_action :fetch_job, only: [:show, :edit, :update, :destroy, :toggle_enable]
   before_action :fetch_host, only: [:new, :edit, :show, :create, :update, :toggle_enable]
+  before_action :fetch_job, only: [:show, :edit, :update, :destroy, :toggle_enable]
 
   # GET /jobs
   def new
     @job = @host.job_templates.new
   end
 
   # POST /jobs
   def create
     @job = @host.job_templates.new(fetch_params)
     @restore_location = params[:job_template][:restore_location]
     if @restore_location && @job.save_and_create_restore_job(@restore_location)
       redirect_to host_path(@host)
     else
       render :new
     end
   end
 
   # GET /jobs/1
   def show; end
 
   # GET /jobs/1/edit
   def edit;end
 
   # PUT /jobs/1
   def update
     if @job.update_attributes(fetch_params)
       redirect_to host_job_path(@host, @job)
     else
       render :edit
     end
   end
 
   # DELETE /jobs/1
   def destroy
   end
 
   # PATCH /hosts/1/jobs/1/enable
   def toggle_enable
     @job.enabled = !@job.enabled
     @job.save
     redirect_to host_path(@host)
   end
 
   private
 
   def fetch_job
-    @job = JobTemplate.find(params[:id])
+    @job = @host.job_templates.find(params[:id])
   end
 
   def fetch_host
-    @host = Host.find(params[:host_id])
+    @host = current_user.hosts.find(params[:host_id])
   end
 
   def fetch_params
     params.require(:job_template).permit(:name, :fileset_id, :schedule_id)
   end
 end
diff --git a/spec/controllers/jobs_controller_spec.rb b/spec/controllers/jobs_controller_spec.rb
index 7533db6..7632c50 100644
--- a/spec/controllers/jobs_controller_spec.rb
+++ b/spec/controllers/jobs_controller_spec.rb
@@ -1,70 +1,76 @@
 require 'spec_helper'
 
 describe JobsController do
   let!(:host) { FactoryGirl.create(:host) }
+  let(:user) { FactoryGirl.create(:user) }
+
+  before do
+    host.users << user
+    controller.stub(:current_user) { user }
+  end
 
   describe 'GET #new' do
     before { get :new, host_id: host.id }
 
     it 'initializes a job' do
       expect(assigns(:job)).to be
     end
 
     it 'renders' do
       expect(response).to render_template(:new)
     end
   end
 
   describe 'POST #create' do
     context 'with valid params' do
       let(:params) do
         {
           host_id: host.id,
           job_template: FactoryGirl.build(:job_template, restore_location: '/foo').
             attributes.symbolize_keys.slice(:name, :schedule_id, :fileset_id, :restore_location)
         }
       end
 
       it 'creates the jobs (:backup, :restore)' do
         expect { post :create, params }.
           to change { JobTemplate.count }.by(2)
       end
 
       it 'redirects to host' do
         post :create, params
         expect(response).to redirect_to(host_path(host))
       end
 
       it 'calls save_and_create_restore_job' do
         JobTemplate.any_instance.
           should_receive(:save_and_create_restore_job).with('/foo')
         post :create, params
       end
     end
 
     context 'with invalid params' do
       let(:params) do
         {
           host_id: host.id,
           job_template: FactoryGirl.build(:job_template).attributes.symbolize_keys.
             slice(:name, :fileset_id)
         }
       end
 
       it 'initializes a job with errors' do
         post :create, params
         expect(assigns(:job)).to be
       end
 
       it 'does not create the job' do
         expect { post :create, params }.
           to_not change { JobTemplate.count }
       end
 
       it 'renders :new' do
         post :create, params
         expect(response).to render_template(:new)
       end
     end
   end
 end