Kai/habitica
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

improve access control for challenges

Browse Source
This commit is contained in:
Matteo Pagliazzi
2016-01-24 12:52:59 +01:00
parent 198d2e6ab5
commit 59f5a80af7
3 changed files with 25 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
website/src/controllers/api-v3/challenges.js
+1 -1
View File
@@ -192,7 +192,7 @@ api.getChallenge = {
let challenge = await Challenge.findById(challengeId).exec();
if (!challenge) throw new NotFound(res.t('challengeNotFound'));
let group = await Group.getGroup({user, groupId: challenge.groupId, fields: '_id type privacy'});
let group = await Group.getGroup({user, groupId: challenge.groupId, fields: '_id type privacy', optionalMembership: true});
if (!group || !challenge.canView(user, group)) throw new NotFound(res.t('challengeNotFound'));
res.respond(200, challenge);
website/src/controllers/api-v3/members.js
+7 -2
View File
@@ -76,7 +76,10 @@ function _getMembersForItem (type) {
if (type === 'challenge-members') {
challenge = await Challenge.findById(challengeId).select('_id type leader groupId').exec();
if (!challenge) throw new NotFound(res.t('challengeNotFound'));
group = await Group.getGroup({user, groupId: challenge.groupId, fields: '_id type privacy'});
// optionalMembership is set to true because even if you're not member of the group you may be able to access the challenge
// for example if you've been booted from it, are the leader or a site admin
group = await Group.getGroup({user, groupId: challenge.groupId, fields: '_id type privacy', optionalMembership: true});
if (!group || !challenge.canView(user, group)) throw new NotFound(res.t('challengeNotFound'));
} else {
group = await Group.getGroup({user, groupId, fields: '_id type'});
@@ -207,7 +210,9 @@ api.getChallengeMemberProgress = {
let challenge = await Challenge.findById(challengeId).exec();
if (!challenge) throw new NotFound(res.t('challengeNotFound'));
let group = await Group.getGroup({user, groupId: challenge.groupId, fields: '_id type privacy'});
// optionalMembership is set to true because even if you're not member of the group you may be able to access the challenge
// for example if you've been booted from it, are the leader or a site admin
let group = await Group.getGroup({user, groupId: challenge.groupId, fields: '_id type privacy', optionalMembership: true});
if (!group || !challenge.canView(user, group)) throw new NotFound(res.t('challengeNotFound'));
if (!challenge.isMember(member)) throw new NotFound(res.t('challengeMemberNotFound'));