From 3e6eaf6f2fa63fad71164f5de4fe49c9d3edb548 Mon Sep 17 00:00:00 2001
From: Tyler Renelle <tylerrenelle@gmail.com>
Date: Mon, 4 Nov 2013 12:19:40 -0800
Subject: [PATCH] sanitize challenge update

---
 src/controllers/challenges.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/controllers/challenges.js b/src/controllers/challenges.js
index d722890a84..233a9a543b 100644
--- a/src/controllers/challenges.js
+++ b/src/controllers/challenges.js
@@ -156,8 +156,8 @@ api.update = function(req, res){
       // Update the challenge, since syncing will need the updated challenge. But store `before` we're going to do some
       // before-save / after-save comparison to determine if we need to sync to users
       before = _before;
-      delete req.body._id;
-      Challenge.findByIdAndUpdate(cid, {$set:req.body}, cb); //FIXME sanitize
+      var attrs = _.pick(req.body, 'name shortName description habits dailys todos rewards date'.split(' '));
+      Challenge.findByIdAndUpdate(cid, {$set:attrs}, cb);
     },
     function(saved, cb) {
       // after saving, we're done as far as the client's concerned. We kick of syncing (heavy task) in the background