From a03b1fc6cb6b37907e12e03541ddaa9621e2638c Mon Sep 17 00:00:00 2001
From: Alys <Alys@users.noreply.github.com>
Date: Thu, 16 Jun 2016 09:36:58 +1000
Subject: [PATCH] prevents damage to quest participants with false or null
 values - partial fix for #7653 (#7665)

---
 test/api/v3/unit/models/group.test.js | 32 +++++++++++++++++++++++++++
 website/server/models/group.js        |  2 +-
 2 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/test/api/v3/unit/models/group.test.js b/test/api/v3/unit/models/group.test.js
index 2502ee96c0..e3754ef2df 100644
--- a/test/api/v3/unit/models/group.test.js
+++ b/test/api/v3/unit/models/group.test.js
@@ -211,6 +211,38 @@ describe('Group Model', () => {
           expect(updatedUndecidedMember.stats.hp).to.eql(50);
         });
 
+        it('applies damage only to participating members of party even under buggy conditions', async () => {
+          // stops unfair damage from mbugs like https://github.com/HabitRPG/habitrpg/issues/7653
+          party.quest.members = {
+            [questLeader._id]: true,
+            [participatingMember._id]: true,
+            [nonParticipatingMember._id]: false,
+            [undecidedMember._id]: null,
+          };
+          await party.save();
+
+          await Group.processQuestProgress(participatingMember, progress);
+
+          party = await Group.findOne({_id: party._id});
+
+          let [
+            updatedLeader,
+            updatedParticipatingMember,
+            updatedNonParticipatingMember,
+            updatedUndecidedMember,
+          ] = await Promise.all([
+            User.findById(questLeader._id),
+            User.findById(participatingMember._id),
+            User.findById(nonParticipatingMember._id),
+            User.findById(undecidedMember._id),
+          ]);
+
+          expect(updatedLeader.stats.hp).to.eql(42.5);
+          expect(updatedParticipatingMember.stats.hp).to.eql(42.5);
+          expect(updatedNonParticipatingMember.stats.hp).to.eql(50);
+          expect(updatedUndecidedMember.stats.hp).to.eql(50);
+        });
+
         it('sends message about victory', async () => {
           progress.up = 999;
 
diff --git a/website/server/models/group.js b/website/server/models/group.js
index e60abd6780..820041cc68 100644
--- a/website/server/models/group.js
+++ b/website/server/models/group.js
@@ -522,7 +522,7 @@ schema.methods._processBossQuest = async function processBossQuest (options) {
 
   // Everyone takes damage
   await User.update({
-    _id: {$in: _.keys(group.quest.members)},
+    _id: {$in: _.keys(_.pick(group.quest.members, _.identity))},
   }, {
     $inc: {'stats.hp': down},
   }, {multi: true}).exec();