From 6b7925b227736b50ff6d15bba8529c114f7579c1 Mon Sep 17 00:00:00 2001
From: Greg Laabs <OverloadUT@gmail.com>
Date: Mon, 26 May 2014 09:28:23 -0700
Subject: [PATCH] API rejects spell cast if not enough mana
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix #3493 “API does not validate if user has enough mana”
---
 src/controllers/user.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/controllers/user.js b/src/controllers/user.js
index 06d51d6554..4731a106c7 100644
--- a/src/controllers/user.js
+++ b/src/controllers/user.js
@@ -302,6 +302,7 @@ api.cast = function(req, res, next) {
   var klass = shared.content.spells.special[req.params.spell] ? 'special' : user.stats.class
   var spell = shared.content.spells[klass][req.params.spell];
   if (!spell) return res.json(404, {err: 'Spell "' + req.params.spell + '" not found.'});
+  if (spell.mana > user.stats.mp) return res.json(400, {err: 'Not enough mana to cast spell'});
 
   var done = function(){
     var err = arguments[0];