sudoxreboot/habitica
1
0
Fork 0
mirror of https://github.com/sudoxnym/habitica.git synced 2026-08-04 01:29:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(groups): use proper mongo queries to handle guild/party access in

Browse source 
groups.get, fixes #2664
This commit is contained in:
Tyler Renelle 2014-02-20 10:48:06 -08:00
parent 4f426b9d24
commit aa9059cb2d
1 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/controllers/groups.js
View file

@ -119,17 +119,21 @@ api.list = function(req, res) {
* Get group
* TODO: implement requesting fields ?fields=chat,members
*/
api.get = function(req, res) {
api.get = function(req, res, next) {
var user = res.locals.user;
var gid = req.params.gid;
var q = (gid == 'party') ? Group.findOne({type: 'party', members: {'$in': [user._id]}}) : Group.findById(gid);
var q = (gid == 'party')
? Group.findOne({type: 'party', members: {'$in': [user._id]}})
: Group.findOne({$or:[
{_id:gid, privacy:'public'},
// if the group is private, only return if they have access
{_id:gid, members: {$in:[user._id]}, type:'guild', privacy:'private'}
]});
populateQuery(gid, q);
q.exec(function(err, group){
if (group && ((group.type == 'guild' && group.privacy == 'private') || (group.type == 'party'))) {
if(!_.find(group.members, {_id: user._id}))
return res.json(401, {err: "You don't have access to this group"});
}
if (err) return next(err);
if (!group) return res.json(404,{err: "Group not found or you don't have access."});
res.json(group);
});
};