sudoxreboot/habitica
1
0
Fork 0
mirror of https://github.com/sudoxnym/habitica.git synced 2026-04-14 19:56:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

added validation for blocked users when inviting to groups by username (#14316)

Browse source
This commit is contained in:
Adam Fitzgibbon 2022-12-15 12:47:54 -08:00 committed by GitHub
parent 41cd99c920
commit 42e0bad4ac
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
test/api/v3/integration/groups/POST-groups_invite.test.js
View file

@ -48,6 +48,19 @@ describe('Post /groups/:groupId/invite', () => {
});
});
it('returns error when recipient has blocked the senders', async () => {
const inviterNoBlocks = await inviter.update({ 'inbox.blocks': [] });
const userWithBlockedInviter = await generateUser({ 'inbox.blocks': [inviter._id] });
await expect(inviterNoBlocks.post(`/groups/${group._id}/invite`, {
usernames: [userWithBlockedInviter.auth.local.lowerCaseUsername],
}))
.to.eventually.be.rejected.and.eql({
code: 401,
error: 'NotAuthorized',
message: t('notAuthorizedToSendMessageToThisUser'),
});
});
it('invites a user to a group by username', async () => {
const userToInvite = await generateUser();

7
website/server/libs/invites/index.js
View file

@ -207,6 +207,13 @@ async function inviteByUserName (username, group, inviter, req, res) {
throw new BadRequest(res.t('cannotInviteSelfToGroup'));
}
const objections = inviter.getObjectionsToInteraction('group-invitation', userToInvite);
if (objections.length > 0) {
throw new NotAuthorized(res.t(
objections[0],
{ userId: userToInvite._id, username: userToInvite.profile.name },
));
}
return addInvitationToUser(userToInvite, group, inviter, res);
}