From 69977830375b2718225d043c5a1288c8fa68165a Mon Sep 17 00:00:00 2001
From: Phillip Thelen <viirus@pherth.net>
Date: Sun, 14 Jun 2015 15:59:43 +0200
Subject: [PATCH] Check that iOS IAP is of correct type

---
 website/src/controllers/payments/iap.js | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/website/src/controllers/payments/iap.js b/website/src/controllers/payments/iap.js
index 29b03fedfb..531ce10bec 100644
--- a/website/src/controllers/payments/iap.js
+++ b/website/src/controllers/payments/iap.js
@@ -114,15 +114,29 @@ exports.iosVerify = function(req, res, next) {
       }
 
       if (iap.isValidated(appleRes)) {
+        var purchaseDataList = iap.getPurchaseData(appleRes);
+        if (purchaseDataList.length > 0) {
+          if (purchaseDataList[0].productId === "com.habitrpg.ios.Habitica.20gems") {
+            payments.buyGems({user:user, paymentMethod:'IAP AppleStore'});
+            var resObj = {
+              ok: true,
+              data: appleRes
+            };
+            // yay good!
+            res.json(resObj);
+            return;
+          }
+        }
         var resObj = {
-          ok: true,
-          data: appleRes
+          ok: false,
+          data: {
+            code: INVALID_PAYLOAD,
+            message: "Incorrect receipt"
+          }
         };
 
-        payments.buyGems({user:user, paymentMethod:'IAP AppleStore'});
-            
-        // yay good!
         res.json(resObj);
+        return;
       }
     });
   });