krikkert/habitica
1
0
Fork 0
mirror of https://github.com/HabitRPG/habitica.git synced 2025-12-19 07:37:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

v3: limit fields of challenge tasks that can be updated

Browse Source
This commit is contained in:
Matteo Pagliazzi
2016-05-18 23:27:49 +02:00
parent 65c739f7de
commit e98930cd4a
3 changed files with 110 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
website/server/models/task.js
View File

@@ -57,7 +57,7 @@ export let TaskSchema = new Schema({
}, discriminatorOptions));
TaskSchema.plugin(baseModel, {
noSet: ['challenge', 'userId', 'completed', 'history', 'dateCompleted', 'completed'],
noSet: ['challenge', 'userId', 'completed', 'history', 'dateCompleted', '_legacyId'],
sanitizeTransform (taskObj) {
if (taskObj.type && taskObj.type !== 'reward') { // value should be settable directly only for rewards
delete taskObj.value;
@@ -69,6 +69,14 @@ TaskSchema.plugin(baseModel, {
timestamps: true,
});
// Sanitize user tasks linked to a challenge
// See http://habitica.wikia.com/wiki/Challenges#Challenge_Participant.27s_Permissions for more info
TaskSchema.statics.sanitizeUserChallengeTask = function sanitizeUserChallengeTask (taskObj) {
let initialSanitization = this.sanitize(taskObj);
return _.pick(initialSanitization, ['streak', 'checklist', 'attribute', 'reminders', 'tags', 'notes']);
};
// Sanitize checklist objects (disallowing id)
TaskSchema.statics.sanitizeChecklist = function sanitizeChecklist (checklistObj) {
delete checklistObj.id;