sudoxreboot/habitica
1
0
Fork 0
mirror of https://github.com/sudoxnym/habitica.git synced 2026-07-14 07:52:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch '3onyc-fix-hash-leak' into develop

Browse source
This commit is contained in:
Blade Barringer 2015-08-22 17:54:42 -05:00
commit a4627be3ea
2 changed files with 28 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
test/api/get_user.coffee Normal file
View file

@ -0,0 +1,25 @@
'use strict'
require('../../website/src/server')
describe 'User', ->
before (done) ->
registerNewUser done, true
describe 'GET /user', ->
it 'removes password from user object', (done) ->
request.get(baseURL + '/user')
.end (err, res) ->
expectCode res, 200
localAuth = res.body.auth.local
expect(localAuth.hashed_password).to.not.exist
expect(localAuth.salt).to.not.exist
done()
it 'removes apiToken from user object', (done) ->
request.get(baseURL + '/user')
.end (err, res) ->
expectCode res, 200
expect(res.body.apiToken).to.not.exist
done()

6
website/src/controllers/user.js
View file

@ -204,9 +204,9 @@ api.getUser = function(req, res, next) {
user.stats.maxHealth = shared.maxHealth;
user.stats.maxMP = res.locals.user._statsComputed.maxMP;
delete user.apiToken;
if (user.auth) {
delete user.auth.hashed_password;
delete user.auth.salt;
if (user.auth && user.auth.local) {
delete user.auth.local.hashed_password;
delete user.auth.local.salt;
}
return res.json(200, user);
};