From bf7f7b65836ee590b407399855a60dc381fb9142 Mon Sep 17 00:00:00 2001
From: Tyler Renelle <tylerrenelle@gmail.com>
Date: Fri, 29 Nov 2013 16:47:08 -0700
Subject: [PATCH] [#1057] use sanitized o.dayStart, not options.dayStart.
 slightly better sanitize(dayStart)

---
 dist/habitrpg-shared.js | 93 +++++++++--------------------------------
 script/helpers.coffee   |  4 +-
 2 files changed, 22 insertions(+), 75 deletions(-)

diff --git a/dist/habitrpg-shared.js b/dist/habitrpg-shared.js
index 49c422897e..0929822d63 100644
--- a/dist/habitrpg-shared.js
+++ b/dist/habitrpg-shared.js
@@ -53,7 +53,7 @@ process.chdir = function (dir) {
 };
 
 },{}],2:[function(require,module,exports){
-var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ? window : {};/**
+var global=self;/**
  * @license
  * Lo-Dash 2.2.1 (Custom Build) <http://lodash.com/>
  * Build: `lodash modern -o ./dist/lodash.js`
@@ -8753,7 +8753,6 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
 
   obj.revive = function(user, options) {
     var candidate, loseThisItem, owned, paths;
-
     if (options == null) {
       options = {};
     }
@@ -8803,7 +8802,6 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
 
   obj.tnl = function(level) {
     var value;
-
     if (level >= 100) {
       value = 0;
     } else {
@@ -8823,7 +8821,6 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
 
   obj.expModifier = function(value, weaponStr, level, priority) {
     var exp, str, strMod, totalStr;
-
     if (priority == null) {
       priority = '!';
     }
@@ -8846,7 +8843,6 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
 
   obj.hpModifier = function(value, armorDef, helmDef, shieldDef, level, priority) {
     var def, defMod, hp, totalDef;
-
     if (priority == null) {
       priority = '!';
     }
@@ -8865,7 +8861,6 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
 
   obj.gpModifier = function(value, modifier, priority, streak, user) {
     var afterStreak, streakBonus, val;
-
     if (priority == null) {
       priority = '!';
     }
@@ -8892,7 +8887,6 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
 
   obj.taskDeltaFormula = function(currentValue, direction) {
     var delta;
-
     if (currentValue < -47.27) {
       currentValue = -47.27;
     } else if (currentValue > 21.27) {
@@ -8911,8 +8905,7 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
 
 
   randomDrop = function(user, delta, priority, streak, options) {
-    var acceptableDrops, chanceMultiplier, drop, paths, rarity, reachedDropLimit, _base, _base1, _base2, _name, _name1, _ref1, _ref2, _ref3, _ref4;
-
+    var acceptableDrops, chanceMultiplier, drop, paths, rarity, reachedDropLimit, _base, _base1, _base2, _name, _name1, _ref1;
     if (streak == null) {
       streak = 0;
     }
@@ -8920,7 +8913,7 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
       options = {};
     }
     paths = options.paths || {};
-    if ((_ref1 = (_base = user.items).lastDrop) == null) {
+    if ((_base = user.items).lastDrop == null) {
       _base.lastDrop = {
         date: +moment().subtract('d', 1),
         count: 0
@@ -8933,11 +8926,11 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
     chanceMultiplier = Math.abs(delta);
     chanceMultiplier *= obj.priorityValue(priority);
     chanceMultiplier += streak;
-    if (((_ref2 = user.flags) != null ? _ref2.dropsEnabled : void 0) && Math.random() < (.05 * chanceMultiplier)) {
+    if (((_ref1 = user.flags) != null ? _ref1.dropsEnabled : void 0) && Math.random() < (.05 * chanceMultiplier)) {
       rarity = Math.random();
       if (rarity > .5) {
         drop = helpers.randomVal(eggs);
-        if ((_ref3 = (_base1 = user.items.eggs)[_name = drop.name]) == null) {
+        if ((_base1 = user.items.eggs)[_name = drop.name] == null) {
           _base1[_name] = 0;
         }
         user.items.eggs[drop.name]++;
@@ -8948,7 +8941,7 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
         drop = helpers.randomVal(_.pick(hatchingPotions, (function(v, k) {
           return __indexOf.call(acceptableDrops, k) >= 0;
         })));
-        if ((_ref4 = (_base2 = user.items.hatchingPotions)[_name1 = drop.name]) == null) {
+        if ((_base2 = user.items.hatchingPotions)[_name1 = drop.name] == null) {
           _base2[_name1] = 0;
         }
         user.items.hatchingPotions[drop.name]++;
@@ -8962,8 +8955,7 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
   };
 
   obj.score = function(user, task, direction, options) {
-    var addPoints, calculateDelta, cron, delta, exp, gp, hp, lvl, num, paths, priority, streak, subtractPoints, times, type, value, _ref1, _ref2, _ref3, _ref4;
-
+    var addPoints, calculateDelta, cron, delta, exp, gp, hp, lvl, num, paths, priority, streak, subtractPoints, times, type, value, _ref1, _ref2, _ref3;
     if (options == null) {
       options = {};
     }
@@ -8994,7 +8986,6 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
       }
       return _.times(times, function() {
         var nextDelta;
-
         nextDelta = obj.taskDeltaFormula(value, direction);
         if (adjustvalue) {
           value += nextDelta;
@@ -9004,7 +8995,6 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
     };
     addPoints = function() {
       var weaponStr;
-
       weaponStr = items.getItem('weapon', user.items.weapon).strength;
       exp += obj.expModifier(delta, weaponStr, user.stats.lvl, priority) / 2;
       if (streak) {
@@ -9015,7 +9005,6 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
     };
     subtractPoints = function() {
       var armorDef, headDef, shieldDef;
-
       armorDef = items.getItem('armor', user.items.armor).defense;
       headDef = items.getItem('head', user.items.head).defense;
       shieldDef = items.getItem('shield', user.items.shield).defense;
@@ -9030,7 +9019,7 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
           subtractPoints();
         }
         if (task.value !== value) {
-          ((_ref4 = task.history) != null ? _ref4 : task.history = []).push({
+          (task.history != null ? task.history : task.history = []).push({
             date: +(new Date),
             value: value
           });
@@ -9106,8 +9095,7 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
 
 
   updateStats = function(user, newStats, options) {
-    var gp, paths, tnl, _ref1;
-
+    var gp, paths, tnl;
     if (options == null) {
       options = {};
     }
@@ -9144,7 +9132,7 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
         }
       }
       user.stats.exp = newStats.exp;
-      if ((_ref1 = user.flags) == null) {
+      if (user.flags == null) {
         user.flags = {};
       }
       if (!user.flags.customizationsNotification && (user.stats.exp > 10 || user.stats.lvl > 1)) {
@@ -9179,8 +9167,7 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
 
 
   obj.cron = function(user, options) {
-    var daysMissed, expTally, lvl, now, paths, todoTally, _base, _base1, _ref1, _ref2, _ref3, _ref4;
-
+    var daysMissed, expTally, lvl, now, paths, todoTally, _base, _base1, _ref1;
     if (options == null) {
       options = {};
     }
@@ -9207,8 +9194,7 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
     }
     todoTally = 0;
     user.todos.concat(user.dailys).forEach(function(task) {
-      var absVal, completed, id, repeat, scheduleMisses, type, _ref2;
-
+      var absVal, completed, id, repeat, scheduleMisses, type;
       if (!task) {
         return;
       }
@@ -9219,7 +9205,6 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
           scheduleMisses = 0;
           _.times(daysMissed, function(n) {
             var thatDay;
-
             thatDay = moment(now).subtract('days', n + 1);
             if (helpers.shouldDo(thatDay, repeat, user.preferences)) {
               return scheduleMisses++;
@@ -9236,7 +9221,7 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
       }
       switch (type) {
         case 'daily':
-          ((_ref2 = task.history) != null ? _ref2 : task.history = []).push({
+          (task.history != null ? task.history : task.history = []).push({
             date: +(new Date),
             value: task.value
           });
@@ -9258,7 +9243,7 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
         return paths["tasks." + task.id + ".value"] = true;
       }
     });
-    ((_ref2 = (_base = ((_ref3 = user.history) != null ? _ref3 : user.history = {})).todos) != null ? _ref2 : _base.todos = []).push({
+    ((_base = (user.history != null ? user.history : user.history = {})).todos != null ? (_base = (user.history != null ? user.history : user.history = {})).todos : _base.todos = []).push({
       date: now,
       value: todoTally
     });
@@ -9268,7 +9253,7 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
       lvl++;
       expTally += obj.tnl(lvl);
     }
-    ((_ref4 = (_base1 = user.history).exp) != null ? _ref4 : _base1.exp = []).push({
+    ((_base1 = user.history).exp != null ? (_base1 = user.history).exp : _base1.exp = []).push({
       date: now,
       value: expTally
     });
@@ -9287,14 +9272,12 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
 
   preenHistory = function(history) {
     var newHistory, preen, thisMonth;
-
     history = _.filter(history, function(h) {
       return !!h;
     });
     newHistory = [];
     preen = function(amount, groupBy) {
       var groups;
-
       groups = _.chain(history).groupBy(function(h) {
         return moment(h.date).format(groupBy);
       }).sortBy(function(h, k) {
@@ -9327,7 +9310,6 @@ var global=typeof self !== "undefined" ? self : typeof window !== "undefined" ?
     }
     _.each(user.habits.concat(user.dailys), function(task) {
       var _ref1;
-
       if (((_ref1 = task.history) != null ? _ref1.length : void 0) > minHistLen) {
         task.history = preenHistory(task.history);
       }
@@ -9367,8 +9349,7 @@ var process=require("__browserify_process");(function() {
 
   sanitizeOptions = function(o) {
     var dayStart, now, timezoneOffset, _ref;
-
-    dayStart = o.dayStart && (0 <= (_ref = +o.dayStart) && _ref <= 24) ? +o.dayStart : 0;
+    dayStart = !_.isNaN(+o.dayStart) && (0 <= (_ref = +o.dayStart) && _ref <= 24) ? +o.dayStart : 0;
     timezoneOffset = o.timezoneOffset ? +o.timezoneOffset : +moment().zone();
     now = o.now ? moment(o.now).zone(timezoneOffset) : moment(+(new Date)).zone(timezoneOffset);
     return {
@@ -9380,7 +9361,6 @@ var process=require("__browserify_process");(function() {
 
   startOfWeek = function(options) {
     var o;
-
     if (options == null) {
       options = {};
     }
@@ -9390,12 +9370,11 @@ var process=require("__browserify_process");(function() {
 
   startOfDay = function(options) {
     var o;
-
     if (options == null) {
       options = {};
     }
     o = sanitizeOptions(options);
-    return moment(o.now).startOf('day').add('h', options.dayStart);
+    return moment(o.now).startOf('day').add('h', o.dayStart);
   };
 
   dayMapping = {
@@ -9415,7 +9394,6 @@ var process=require("__browserify_process");(function() {
 
   daysSince = function(yesterday, options) {
     var o;
-
     if (options == null) {
       options = {};
     }
@@ -9432,7 +9410,6 @@ var process=require("__browserify_process");(function() {
 
   shouldDo = function(day, repeat, options) {
     var o, selected, yesterday;
-
     if (options == null) {
       options = {};
     }
@@ -9457,7 +9434,6 @@ var process=require("__browserify_process");(function() {
   uuid = function() {
     return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, function(c) {
       var r, v;
-
       r = Math.random() * 16 | 0;
       v = (c === "x" ? r : r & 0x3 | 0x8);
       return v.toString(16);
@@ -9477,8 +9453,7 @@ var process=require("__browserify_process");(function() {
     _: _,
     uuid: uuid,
     taskDefaults: function(task, filters) {
-      var defaults, self, _ref, _ref1, _ref2;
-
+      var defaults, self, _ref, _ref1;
       if (filters == null) {
         filters = {};
       }
@@ -9528,14 +9503,13 @@ var process=require("__browserify_process");(function() {
         });
       }
       task._id = task.id;
-      if ((_ref2 = task.value) == null) {
+      if (task.value == null) {
         task.value = task.type === 'reward' ? 10 : 0;
       }
       return task;
     },
     newUser: function() {
       var defaultTags, defaultTasks, guid, newUser, repeat, tag, task, userSchema, _i, _j, _len, _len1;
-
       userSchema = {
         stats: {
           gp: 0,
@@ -9691,19 +9665,16 @@ var process=require("__browserify_process");(function() {
 
     dotSet: function(path, val, obj) {
       var arr, err;
-
       if (~path.indexOf('undefined')) {
         return;
       }
       try {
         arr = path.split('.');
         return _.reduce(arr, function(curr, next, index) {
-          var _ref;
-
           if ((arr.length - 1) === index) {
             curr[next] = val;
           }
-          return (_ref = curr[next]) != null ? _ref : curr[next] = {};
+          return curr[next] != null ? curr[next] : curr[next] = {};
         }, obj);
       } catch (_error) {
         err = _error;
@@ -9717,7 +9688,6 @@ var process=require("__browserify_process");(function() {
     },
     dotGet: function(path, obj) {
       var err;
-
       if (~path.indexOf('undefined')) {
         return void 0;
       }
@@ -9747,7 +9717,6 @@ var process=require("__browserify_process");(function() {
 
     randomVal: function(obj) {
       var count, key, result, val;
-
       result = void 0;
       count = 0;
       for (key in obj) {
@@ -9774,7 +9743,6 @@ var process=require("__browserify_process");(function() {
 
     username: function(auth, override) {
       var fb, _ref;
-
       if (override) {
         return override;
       }
@@ -9799,7 +9767,6 @@ var process=require("__browserify_process");(function() {
 
     encodeiCalLink: function(uid, apiToken) {
       var loc, _ref;
-
       loc = (typeof window !== "undefined" && window !== null ? window.location.host : void 0) || (typeof process !== "undefined" && process !== null ? (_ref = process.env) != null ? _ref.BASE_URL : void 0 : void 0) || '';
       return encodeURIComponent("http://" + loc + "/v1/users/" + uid + "/calendar.ics?apiToken=" + apiToken);
     },
@@ -9832,7 +9799,6 @@ var process=require("__browserify_process");(function() {
 
     taskClasses: function(task, filters, dayStart, lastCron, showCompleted, main) {
       var classes, completed, enabled, filter, repeat, type, value, _ref;
-
       if (filters == null) {
         filters = [];
       }
@@ -9926,7 +9892,6 @@ var process=require("__browserify_process");(function() {
 
     appliedTags: function(userTags, taskTags) {
       var arr;
-
       arr = [];
       _.each(userTags, function(t) {
         if (t == null) {
@@ -9947,7 +9912,6 @@ var process=require("__browserify_process");(function() {
     },
     totalStr: function(level, weapon) {
       var str;
-
       if (weapon == null) {
         weapon = 0;
       }
@@ -9959,7 +9923,6 @@ var process=require("__browserify_process");(function() {
     },
     totalDef: function(level, armor, head, shield) {
       var totalDef;
-
       if (armor == null) {
         armor = 0;
       }
@@ -9980,7 +9943,6 @@ var process=require("__browserify_process");(function() {
     },
     itemStat: function(type, item) {
       var i;
-
       if (item == null) {
         item = 0;
       }
@@ -9993,7 +9955,6 @@ var process=require("__browserify_process");(function() {
     },
     countPets: function(originalCount, pets) {
       var count, pet;
-
       count = originalCount != null ? originalCount : _.size(pets);
       for (pet in items.items.specialPets) {
         if (pets[pet]) {
@@ -10015,7 +9976,6 @@ var process=require("__browserify_process");(function() {
     hydrate: function(spec) {
       var hydrated, keys,
         _this = this;
-
       if (_.isObject(spec) && !_.isArray(spec)) {
         hydrated = {};
         keys = _.keys(spec).concat(_.keys(spec.__proto__));
@@ -10112,7 +10072,6 @@ try {
         value: 150,
         canOwn: (function(u) {
           var _ref;
-
           return +((_ref = u.backer) != null ? _ref.tier : void 0) >= 70;
         })
       }, {
@@ -10124,7 +10083,6 @@ try {
         value: 170,
         canOwn: (function(u) {
           var _ref;
-
           return +((_ref = u.contributor) != null ? _ref.level : void 0) >= 4;
         })
       }
@@ -10181,7 +10139,6 @@ try {
         value: 150,
         canOwn: (function(u) {
           var _ref;
-
           return +((_ref = u.backer) != null ? _ref.tier : void 0) >= 45;
         })
       }, {
@@ -10193,7 +10150,6 @@ try {
         value: 170,
         canOwn: (function(u) {
           var _ref;
-
           return +((_ref = u.contributor) != null ? _ref.level : void 0) >= 2;
         })
       }
@@ -10250,7 +10206,6 @@ try {
         value: 100,
         canOwn: (function(u) {
           var _ref;
-
           return +((_ref = u.backer) != null ? _ref.tier : void 0) >= 45;
         })
       }, {
@@ -10262,7 +10217,6 @@ try {
         value: 120,
         canOwn: (function(u) {
           var _ref;
-
           return +((_ref = u.contributor) != null ? _ref.level : void 0) >= 3;
         })
       }
@@ -10319,7 +10273,6 @@ try {
         value: 120,
         canOwn: (function(u) {
           var _ref;
-
           return +((_ref = u.backer) != null ? _ref.tier : void 0) >= 45;
         })
       }, {
@@ -10331,7 +10284,6 @@ try {
         value: 150,
         canOwn: (function(u) {
           var _ref;
-
           return +((_ref = u.contributor) != null ? _ref.level : void 0) >= 5;
         })
       }
@@ -10530,7 +10482,6 @@ try {
 
   module.exports.buyItem = function(user, type) {
     var nextItem;
-
     nextItem = type === 'potion' ? items.potion : _.find(items[type].slice(~~user.items[type] + 1), (function(i) {
       return i.canOwn(user);
     }));
@@ -10559,11 +10510,9 @@ try {
 
   module.exports.updateStore = function(user) {
     var changes;
-
     changes = {};
     _.each(['weapon', 'armor', 'shield', 'head'], function(type) {
       var curr, _ref;
-
       curr = ((_ref = user.items) != null ? _ref[type] : void 0) || 0;
       return changes[type] = _.find(items[type].slice(curr + 1), (function(item) {
         return item.canOwn(user);
@@ -10583,7 +10532,6 @@ try {
 
   module.exports.getItem = function(type, index) {
     var i;
-
     if (index == null) {
       index = 0;
     }
@@ -10599,7 +10547,6 @@ try {
 
   module.exports.equipped = function(type, item, pref, backer, contributor) {
     var lastStandardItem, _ref;
-
     if (item == null) {
       item = 0;
     }
diff --git a/script/helpers.coffee b/script/helpers.coffee
index 12c50f5e15..db86af1293 100644
--- a/script/helpers.coffee
+++ b/script/helpers.coffee
@@ -8,7 +8,7 @@ items = require('./items.coffee')
   {now} is also passed in for various purposes, one example being the test scripts scripts testing different "now" times
 ###
 sanitizeOptions = (o) ->
-  dayStart = if (o.dayStart and 0 <= +o.dayStart <= 24) then +o.dayStart else 0
+  dayStart = if (!_.isNaN(+o.dayStart) and 0 <= +o.dayStart <= 24) then +o.dayStart else 0
   timezoneOffset = if o.timezoneOffset then +(o.timezoneOffset) else +moment().zone()
   now = if o.now then moment(o.now).zone(timezoneOffset) else moment(+new Date).zone(timezoneOffset)
   # return a new object, we don't want to add "now" to user object
@@ -20,7 +20,7 @@ startOfWeek = (options={}) ->
 
 startOfDay = (options={}) ->
   o = sanitizeOptions(options)
-  moment(o.now).startOf('day').add('h', options.dayStart)
+  moment(o.now).startOf('day').add('h', o.dayStart)
 
 dayMapping = {0:'su',1:'m',2:'t',3:'w',4:'th',5:'f',6:'s'}