sudoxreboot/habitica
1
0
Fork 0
mirror of https://github.com/sudoxnym/habitica.git synced 2026-07-08 05:25:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Check if items are owned before equipping

Browse source 
This checks if the user actually owns the pet, mount or gear they are trying to equip. This also prevents users from setting things that do not exist. (before users could set the value for pets and mounts to any string. Not sure if this leaves possiblilities for xss attacks. but this fix also prevents that).
This commit is contained in:
Phillip Thelen 2014-06-27 14:36:25 +02:00
parent 01769e3dea
commit c190d49b4f
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
script/index.coffee
View file

@ -642,11 +642,14 @@ api.wrap = (user, main=true) ->
[type, key] = [req.params.type || 'equipped', req.params.key]
switch type
when 'mount'
return cb?({code:404,message:":You do not own this mount."}) unless user.items.mounts[key]
user.items.currentMount = if user.items.currentMount is key then '' else key
when 'pet'
return cb?({code:404,message:":You do not own this pet."}) unless user.items.pets[key]
user.items.currentPet = if user.items.currentPet is key then '' else key
when 'costume','equipped'
item = content.gear.flat[key]
return cb?({code:404,message:":You do not own this gear."}) unless user.items.gear.owned[key]
if user.items.gear[type][item.type] is key
user.items.gear[type][item.type] = "#{item.type}_base_0"
message = i18n.t('messageUnEquipped', {itemText: item.text(req.language)}, req.language)