From 6b7925b227736b50ff6d15bba8529c114f7579c1 Mon Sep 17 00:00:00 2001 From: Greg Laabs Date: Mon, 26 May 2014 09:28:23 -0700 Subject: [PATCH 1/2] API rejects spell cast if not enough mana MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix #3493 “API does not validate if user has enough mana” --- src/controllers/user.js | 1 + 1 file changed, 1 insertion(+) diff --git a/src/controllers/user.js b/src/controllers/user.js index 06d51d6554..4731a106c7 100644 --- a/src/controllers/user.js +++ b/src/controllers/user.js @@ -302,6 +302,7 @@ api.cast = function(req, res, next) { var klass = shared.content.spells.special[req.params.spell] ? 'special' : user.stats.class var spell = shared.content.spells[klass][req.params.spell]; if (!spell) return res.json(404, {err: 'Spell "' + req.params.spell + '" not found.'}); + if (spell.mana > user.stats.mp) return res.json(400, {err: 'Not enough mana to cast spell'}); var done = function(){ var err = arguments[0]; From 1bcc31683b200bd65e6bfe25152bebc7d0015db5 Mon Sep 17 00:00:00 2001 From: Greg Laabs Date: Mon, 26 May 2014 13:15:55 -0700 Subject: [PATCH 2/2] Update spell cast test to ensure user has mana --- test/api.mocha.js | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/test/api.mocha.js b/test/api.mocha.js index fc98b60f8a..2a1475b055 100644 --- a/test/api.mocha.js +++ b/test/api.mocha.js @@ -428,11 +428,14 @@ describe('API', function () { // level up user so str is > 0 request.put(baseURL+'/user').send({'stats.lvl':5}).end(function(res){ - request.post(baseURL+'/user/class/cast/valorousPresence?targetType=party').end(function(res){ - request.get(baseURL+'/members/'+member._id).end(function(res){ - expect(res.body.stats.buffs.str).to.be.above(0); - expect(diff(res.body,member).length).to.be(1); - done(); + // Refill mana so user can cast + request.put(baseURL+'/user').send({'stats.mp':100}).end(function(res){ + request.post(baseURL+'/user/class/cast/valorousPresence?targetType=party').end(function(res){ + request.get(baseURL+'/members/'+member._id).end(function(res){ + expect(res.body.stats.buffs.str).to.be.above(0); + expect(diff(res.body,member).length).to.be(1); + done(); + }) }) }) })