From aa9059cb2d4540001caa43d80d0e8ff21f4c7fc8 Mon Sep 17 00:00:00 2001
From: Tyler Renelle <tylerrenelle@gmail.com>
Date: Thu, 20 Feb 2014 10:48:06 -0800
Subject: [PATCH] fix(groups): use proper mongo queries to handle guild/party
 access in groups.get, fixes #2664

---
 src/controllers/groups.js | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/controllers/groups.js b/src/controllers/groups.js
index 4bdde2b83a..12f3775ba8 100644
--- a/src/controllers/groups.js
+++ b/src/controllers/groups.js
@@ -119,17 +119,21 @@ api.list = function(req, res) {
  * Get group
  * TODO: implement requesting fields ?fields=chat,members
  */
-api.get = function(req, res) {
+api.get = function(req, res, next) {
   var user = res.locals.user;
   var gid = req.params.gid;
 
-  var q = (gid == 'party') ? Group.findOne({type: 'party', members: {'$in': [user._id]}}) : Group.findById(gid);
+  var q = (gid == 'party')
+    ? Group.findOne({type: 'party', members: {'$in': [user._id]}})
+    : Group.findOne({$or:[
+        {_id:gid, privacy:'public'},
+        // if the group is private, only return if they have access
+        {_id:gid, members: {$in:[user._id]}, type:'guild', privacy:'private'}
+      ]});
   populateQuery(gid, q);
   q.exec(function(err, group){
-    if (group && ((group.type == 'guild' && group.privacy == 'private') || (group.type == 'party'))) {
-      if(!_.find(group.members, {_id: user._id}))
-        return res.json(401, {err: "You don't have access to this group"});
-    }
+    if (err) return next(err);
+    if (!group) return res.json(404,{err: "Group not found or you don't have access."});
     res.json(group);
   });
 };