From e8f4a94abbb2fd1614749c52011011adfb01bd33 Mon Sep 17 00:00:00 2001
From: Tyler Renelle <tylerrenelle@gmail.com>
Date: Thu, 8 Aug 2013 13:59:08 -0400
Subject: [PATCH] make sure user owns the taskb efore scoring

---
 src/server/apiv2.coffee | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/server/apiv2.coffee b/src/server/apiv2.coffee
index 04ba3558da..d131c309e2 100644
--- a/src/server/apiv2.coffee
+++ b/src/server/apiv2.coffee
@@ -63,6 +63,7 @@ router.post '/', api.auth, (req, res, next) ->
 
       switch action.op
         when "score"
+          return done() unless user.get "tasks.#{task.id}"
           sendScore = -> api.score(model, user, task.id, action.dir, done)
           if task.type in ["daily","todo"]
             # switch completed state. Since checkbox is not binded to model unlike when you click through Derby website.