diff --git a/refstack-ui/app/components/products/partials/management.html b/refstack-ui/app/components/products/partials/management.html
index ced8e59d..b41cf300 100644
--- a/refstack-ui/app/components/products/partials/management.html
+++ b/refstack-ui/app/components/products/partials/management.html
@@ -1,5 +1,5 @@
 <div class="pull-right">
-    <a ng-ig="ctrl.product.can_manage"
+    <a ng-if="ctrl.product.can_manage"
        href="javascript:void(0)"
        ng-click="ctrl.openProductEditModal()">
        Edit
diff --git a/refstack-ui/app/components/products/productController.js b/refstack-ui/app/components/products/productController.js
index 5541c6e5..3d7695b5 100644
--- a/refstack-ui/app/components/products/productController.js
+++ b/refstack-ui/app/components/products/productController.js
@@ -336,7 +336,7 @@
 
         var ctrl = this;
 
-        ctrl.version = version;
+        ctrl.version = angular.copy(version);
         ctrl.parent = parent;
 
         ctrl.close = close;
@@ -369,6 +369,8 @@
                 '/versions/', ctrl.version.id ].join('');
             var content = {'cpid': ctrl.version.cpid};
             $http.put(url, content).success(function() {
+                // Update the original version object.
+                version.cpid = ctrl.version.cpid;
                 ctrl.showSuccess = true;
             }).error(function(error) {
                 ctrl.showError = true;
@@ -400,7 +402,7 @@
         ctrl.saveChanges = saveChanges;
         ctrl.removeProperty = removeProperty;
 
-        ctrl.product = product;
+        ctrl.product = angular.copy(product);
         ctrl.productName = product.name;
         ctrl.productProperties = [];
 
diff --git a/refstack-ui/app/components/vendors/vendorController.js b/refstack-ui/app/components/vendors/vendorController.js
index 5bc738fc..7035e6d1 100644
--- a/refstack-ui/app/components/vendors/vendorController.js
+++ b/refstack-ui/app/components/vendors/vendorController.js
@@ -267,7 +267,7 @@
         ctrl.saveChanges = saveChanges;
         ctrl.removeProperty = removeProperty;
 
-        ctrl.vendor = vendor;
+        ctrl.vendor = angular.copy(vendor);
         ctrl.vendorName = vendor.name;
         ctrl.vendorProperties = [];
         ctrl.isAdmin = $rootScope.auth.currentUser.is_admin;
diff --git a/refstack/api/controllers/products.py b/refstack/api/controllers/products.py
index 313c8628..16e756dd 100644
--- a/refstack/api/controllers/products.py
+++ b/refstack/api/controllers/products.py
@@ -79,8 +79,10 @@ class VersionsController(validation.BaseRestControllerWithValidation):
 
         creator = api_utils.get_user_id()
         pecan.response.status = 201
+        allowed_keys = ['id', 'product_id', 'version', 'cpid']
         return db.add_product_version(self.product_id, version_info['version'],
-                                      creator, version_info.get('cpid'))
+                                      creator, version_info.get('cpid'),
+                                      allowed_keys)
 
     @secure(api_utils.is_authenticated)
     @pecan.expose('json', method='PUT')