make sure user owns the taskb efore scoring

2013-08-08 13:59:08 -04:00
parent af8b764a68
commit e8f4a94abb
1 changed files with 1 additions and 0 deletions
@@ -63,6 +63,7 @@ router.post '/', api.auth, (req, res, next) ->

      switch action.op
        when "score"
+          return done() unless user.get "tasks.#{task.id}"
          sendScore = -> api.score(model, user, task.id, action.dir, done)
          if task.type in ["daily","todo"]
            # switch completed state. Since checkbox is not binded to model unlike when you click through Derby website.