From a02776506f400c3554c01ce14a672cde801ba322 Mon Sep 17 00:00:00 2001 From: Tyler Renelle Date: Fri, 25 Jan 2013 14:59:32 -0500 Subject: [PATCH] restrict client balance edit permissions --- src/server/store.coffee | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/server/store.coffee b/src/server/store.coffee index 69d8567e70..4063c4bfaa 100644 --- a/src/server/store.coffee +++ b/src/server/store.coffee @@ -4,11 +4,11 @@ Setup read / write access ### module.exports = (store) -> - store.writeAccess "*", "users.*.balance", -> # captures, value, next -> + store.writeAccess "*", "users.*.balance", (id, newBalance, next) -> return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37 - next = arguments[arguments.length - 1] + purchasingSomethingOnClient = newBalance < this.session.req._racerModel.get("users.#{id}.balance") isServer = not @req.socket - next(isServer) + next(purchasingSomethingOnClient or isServer) store.writeAccess "*", "users.*.flags.ads", -> # captures, value, next -> return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37