sudoxreboot/habitica-self-host
1
0
Fork 0
mirror of https://github.com/sudoxnym/habitica-self-host.git synced 2026-07-22 05:44:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(challenge): don't pierce privacy on GET/:id

Browse source
This commit is contained in:
SabreCat 2023-08-15 15:21:28 -05:00
parent 8f64afe9df
commit 1ea954ab10
2 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
website/server/controllers/api-v3/challenges.js
View file

@ -575,7 +575,7 @@ api.getChallenge = {
// Fetching basic group data
const group = await Group.getGroup({
user, groupId: challenge.group, fields: `${basicGroupFields} purchased`, optionalMembership: true,
user, groupId: challenge.group, fields: `${basicGroupFields} purchased`,
});
if (!group && !challenge.canView(user, group)) throw new NotFound(res.t('challengeNotFound'));
const chalRes = challenge.toJSON();

1
website/server/models/challenge.js
View file

@ -93,6 +93,7 @@ schema.methods.canModify = function canModifyChallenge (user) {
schema.methods.canJoin = function canJoinChallenge (user, group) {
// for when leader has left private group that contains the challenge
if (this.isLeader(user)) return true;
if (!group) return false;
if (group.type === 'guild' && group.privacy === 'public') {
return group._id === TAVERN_ID;
}