From 53f861f3c0cf3a5283ccf25b6640f55a3718df17 Mon Sep 17 00:00:00 2001
From: Alys <alice.harris@oldgods.net>
Date: Sun, 16 Aug 2015 16:50:15 +1000
Subject: [PATCH] allow challenges to be edited, deleted, closed by admin users
 (moderators and staff) through the web UI (not by API calls)

---
 website/src/controllers/challenges.js        | 6 +++---
 website/views/options/social/challenges.jade | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/website/src/controllers/challenges.js b/website/src/controllers/challenges.js
index 8dea70cd1d..63e1cc865a 100644
--- a/website/src/controllers/challenges.js
+++ b/website/src/controllers/challenges.js
@@ -225,7 +225,7 @@ api.update = function(req, res, next){
     },
     function(_before, cb) {
       if (!_before) return cb('Challenge ' + cid + ' not found');
-      if (_before.leader != user._id) return cb("You don't have permissions to edit this challenge");
+      if (_before.leader != user._id && !user.contributor.admin) return cb("You don't have permissions to edit this challenge");
       // Update the challenge, since syncing will need the updated challenge. But store `before` we're going to do some
       // before-save / after-save comparison to determine if we need to sync to users
       before = _before;
@@ -307,7 +307,7 @@ api['delete'] = function(req, res, next){
     },
     function(chal, cb){
       if (!chal) return cb('Challenge ' + cid + ' not found');
-      if (chal.leader != user._id) return cb("You don't have permissions to edit this challenge");
+      if (chal.leader != user._id && !user.contributor.admin) return cb("You don't have permissions to delete this challenge");
       if (chal.group != 'habitrpg') user.balance += chal.prize/4; // Refund gems to user if a non-tavern challenge
       user.save(cb);
     },
@@ -336,7 +336,7 @@ api.selectWinner = function(req, res, next) {
     function(_chal, cb){
       chal = _chal;
       if (!chal) return cb('Challenge ' + cid + ' not found');
-      if (chal.leader != user._id) return cb("You don't have permissions to edit this challenge");
+      if (chal.leader != user._id && !user.contributor.admin) return cb("You don't have permissions to close this challenge");
       User.findById(req.query.uid, cb)
     },
     function(winner, cb){
diff --git a/website/views/options/social/challenges.jade b/website/views/options/social/challenges.jade
index 9a78e79dcc..fd1ccd7549 100644
--- a/website/views/options/social/challenges.jade
+++ b/website/views/options/social/challenges.jade
@@ -30,7 +30,7 @@ script(type='text/ng-template', id='partials/options.social.challenges.detail.me
 
 script(type='text/ng-template', id='partials/options.social.challenges.detail.html')
   // Edit button
-  div(bindonce='challenge', ng-if='challenge.leader._id==user._id')
+  div(bindonce='challenge', ng-if='challenge.leader._id==user._id || user.contributor.admin')
     div(ng-hide='challenge._locked==false')
       button.btn.btn-sm.btn-default(ng-click='edit(challenge)')=env.t('edit')
       button.btn.btn-sm.btn-success(ng-click='clone(challenge)')=env.t('clone')