purchase tokens accessControl bug fix

2013-03-03 11:34:09 -05:00
parent cc4d1b2508
commit 69c8d78352
1 changed files with 2 additions and 1 deletions
@@ -53,9 +53,10 @@ userAccess = (store) ->

    oldBalance = @session.req?._racerModel?.get("users.#{id}.balance") || 0
    purchasingSomethingOnClient = newBalance < oldBalance
-    accept(purchasingSomethingOnClient or @session.req?._isServer)
+    accept(purchasingSomethingOnClient or derbyAuth.isServer(@))

  store.writeAccess "*", "users.*.flags.ads", -> # captures, value, accept, err ->
+    accept = arguments[arguments.length - 2]
    err = arguments[arguments.length - 1]
 #    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.bustedSession(@)
    return accept(false) if derbyAuth.bustedSession(@)