krikkert/habitica
1
0
Fork 0
mirror of https://github.com/HabitRPG/habitica.git synced 2025-12-16 22:27:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(group-plans): shared completion, URL exploit

Browse Source
This commit is contained in:
SabreCat
2022-06-08 16:46:22 -05:00
parent 87944c45c3
commit 0b1907fe07
4 changed files with 35 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
website/server/libs/tasks/index.js
View File

@@ -245,6 +245,11 @@ function canNotEditTasks (group, user, assignedUserId) {
return isNotGroupLeader && !isManager && !userIsAssigningToSelf;
}
function groupSubscriptionNotFound (group) {
return !group || !group.purchased || !group.purchased.plan || !group.purchased.plan.customerId
|| (group.purchased.plan.dateTerminated && group.purchased.plan.dateTerminated < new Date());
}
async function getGroupFromTaskAndUser (task, user) {
if (task.group.id && !task.userId) {
const fields = requiredGroupFields.concat(' managers');
@@ -550,5 +555,6 @@ export {
canNotEditTasks,
getGroupFromTaskAndUser,
getChallengeFromTask,
groupSubscriptionNotFound,
verifyTaskModification,
};