krikkert/habitica
1
0
Fork 0
mirror of https://github.com/HabitRPG/habitica.git synced 2025-12-17 22:57:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(challenge): don't pierce privacy on GET/:id

Browse Source
This commit is contained in:
SabreCat
2023-08-15 15:21:28 -05:00
parent 8f64afe9df
commit 1ea954ab10
2 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
website/server/controllers/api-v3/challenges.js
View File

@@ -575,7 +575,7 @@ api.getChallenge = {
// Fetching basic group data
const group = await Group.getGroup({
user, groupId: challenge.group, fields: `${basicGroupFields} purchased`, optionalMembership: true,
user, groupId: challenge.group, fields: `${basicGroupFields} purchased`,
});
if (!group && !challenge.canView(user, group)) throw new NotFound(res.t('challengeNotFound'));
const chalRes = challenge.toJSON();