From 7129639bbfdac559dc3253593114f61ce9ea4200 Mon Sep 17 00:00:00 2001
From: SabreCat <sabe@habitica.com>
Date: Thu, 25 Aug 2022 09:24:08 -0500
Subject: [PATCH] fix(misc): correct one groups issue and two others

---
 website/client/src/store/getters/tasks.js | 3 ++-
 website/server/libs/spells.js             | 1 +
 website/server/libs/user/index.js         | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/website/client/src/store/getters/tasks.js b/website/client/src/store/getters/tasks.js
index fbee4bd06e..859201de84 100644
--- a/website/client/src/store/getters/tasks.js
+++ b/website/client/src/store/getters/tasks.js
@@ -84,7 +84,8 @@ export function canEdit (store) {
     const user = store.state.user.data;
     const userId = user.id || user._id;
 
-    const isUserAdmin = user.permissions && user.permissions.challengeAdmin;
+    const isUserAdmin = user.permissions
+      && (user.permissions.challengeAdmin || user.permissions.fullAccess);
     const isUserGroupLeader = group && (group.leader
       && group.leader._id === userId);
     const isUserGroupManager = group && (group.managers
diff --git a/website/server/libs/spells.js b/website/server/libs/spells.js
index 6132ec5f26..4a132f290b 100644
--- a/website/server/libs/spells.js
+++ b/website/server/libs/spells.js
@@ -21,6 +21,7 @@ async function castTaskSpell (res, req, targetId, user, spell, quantity = 1) {
   if (!targetId) throw new BadRequest(res.t('targetIdUUID'));
 
   const task = await Tasks.Task.findOne({
+    userId: user._id,
     _id: targetId,
   }).exec();
   if (!task) throw new NotFound(res.t('messageTaskNotFound'));
diff --git a/website/server/libs/user/index.js b/website/server/libs/user/index.js
index 8e19db0ea8..35068ad3f9 100644
--- a/website/server/libs/user/index.js
+++ b/website/server/libs/user/index.js
@@ -138,7 +138,7 @@ export async function update (req, res, { isV3 = false }) {
     if (!Array.isArray(groupsToMirror)) {
       throw new BadRequest('Groups to copy tasks from must be an array.');
     }
-    const memberGroups = user.guilds;
+    const memberGroups = _.clone(user.guilds);
     if (user.party._id) memberGroups.push(user.party._id);
     for (const targetGroup of groupsToMirror) {
       if (memberGroups.indexOf(targetGroup) === -1) {