krikkert/habitica
1
0
Fork 0
mirror of https://github.com/HabitRPG/habitica.git synced 2025-12-18 15:17:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix access control when getting tasks for a challenge

Browse Source
This commit is contained in:
Matteo Pagliazzi
2016-02-02 11:56:06 +01:00
parent 9854d1cf34
commit 4aa6545c79
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
website/src/controllers/api-v3/tasks.js
View File

@@ -194,7 +194,7 @@ api.getChallengeTasks = {
let user = res.locals.user; let user = res.locals.user;
let challengeId = req.params.challengeId; let challengeId = req.params.challengeId;
let challenge = await Challenge.findOne({_id: challengeId}).select('leader').exec(); let challenge = await Challenge.findOne({_id: challengeId}).select('groupId leader').exec();
if (!challenge) throw new NotFound(res.t('challengeNotFound')); if (!challenge) throw new NotFound(res.t('challengeNotFound'));
let group = await Group.getGroup({user, groupId: challenge.groupId, fields: '_id type privacy', optionalMembership: true}); let group = await Group.getGroup({user, groupId: challenge.groupId, fields: '_id type privacy', optionalMembership: true});
if (!group || !challenge.canView(user, group)) throw new NotFound(res.t('challengeNotFound')); if (!group || !challenge.canView(user, group)) throw new NotFound(res.t('challengeNotFound'));