From 25fe1d34d6bafe8aaf1a96b7a04f77016255b28d Mon Sep 17 00:00:00 2001 From: Matteo Pagliazzi Date: Thu, 7 May 2015 18:56:41 +0200 Subject: [PATCH] fix(groups): you should not be able to join a group you are not invited to --- website/src/controllers/groups.js | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/website/src/controllers/groups.js b/website/src/controllers/groups.js index e515cd95a7..b352df6f7d 100644 --- a/website/src/controllers/groups.js +++ b/website/src/controllers/groups.js @@ -398,7 +398,8 @@ api.likeChatMessage = function(req, res, next) { api.join = function(req, res, next) { var user = res.locals.user, - group = res.locals.group; + group = res.locals.group, + isUserInvited = false; if (group.type == 'party' && group._id == (user.invitations && user.invitations.party && user.invitations.party.id)) { User.update({_id:user.invitations.party.inviter}, {$inc:{'items.quests.basilist':1}}).exec(); // Reward inviter @@ -409,13 +410,19 @@ api.join = function(req, res, next) { group.quest.members[user._id] = undefined; group.markModified('quest.members'); } - } - else if (group.type == 'guild' && user.invitations && user.invitations.guilds) { + isUserInvited = true; + } else if (group.type == 'guild' && user.invitations && user.invitations.guilds) { var i = _.findIndex(user.invitations.guilds, {id:group._id}); - if (~i) user.invitations.guilds.splice(i,1); - user.save(); + if (~i){ + user.invitations.guilds.splice(i,1); + user.save(); + }else{ + isUserInvited = group.privacy === 'private' ? false : true; + } } + if(!isUserInvited) return res.json(401, {err: "Can't join a group you're not invited to."}); + if (!_.contains(group.members, user._id)){ group.members.push(user._id); group.invites.splice(_.indexOf(group.invites, user._id), 1);