krikkert/habitica
1
0
Fork 0
mirror of https://github.com/HabitRPG/habitica.git synced 2025-12-17 22:57:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(teams): fix fix fix

Browse Source 
Removed testing banner
Fixed a JS console error when assigning a user to a previously open task
Fixed a potential abuse where user might be able to score someone else's 
task via API call
Fixed an issue where finding tasks by alias could return tasks belonging 
to other users
Fixed an issue that was appending the user's party ID to their list of 
Guilds
Fixed an issue where group tasks were not receiving the default tag 
needed for filtering them on user's personal list
This commit is contained in:
SabreCat
2022-08-22 16:16:23 -05:00
parent 35d963a397
commit 149da578fd
9 changed files with 28 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
website/common/script/ops/scoreTask.js
View File

@@ -4,6 +4,7 @@ import reduce from 'lodash/reduce';
import moment from 'moment';
import max from 'lodash/max';
import {
BadRequest,
NotAuthorized,
} from '../libs/errors';
import i18n from '../i18n';
@@ -247,6 +248,12 @@ export default function scoreTask (options = {}, req = {}, analytics) {
// If they're trying to purchase a too-expensive reward, don't allow them to do that.
if (task.value > user.stats.gp && task.type === 'reward') throw new NotAuthorized(i18n.t('messageNotEnoughGold', req.language));
// Thanks to open group tasks, userId is not guaranteed. Don't allow scoring inaccessible tasks
if (task.userId && task.userId !== user._id) {
throw new BadRequest('Cannot score task belonging to another user.');
} else if (user.guilds.indexOf(task.group.id) === -1 && user.party._id !== task.group.id) {
throw new BadRequest('Cannot score task belonging to another user.');
}
if (task.type === 'habit') {
delta += _changeTaskValue(user, task, direction, times, cron);