diff --git a/test/api/groups.coffee b/test/api/groups.coffee index 6c2d922476..43f9768d9c 100644 --- a/test/api/groups.coffee +++ b/test/api/groups.coffee @@ -151,7 +151,7 @@ describe "Guilds", -> done() context "removing users groups", -> - it "allows guild leaders to remove a member", (done) -> + it "allows guild leaders to remove a member (but not themselves)", (done) -> guildToRemoveMember = undefined members = undefined userToRemove = undefined @@ -181,6 +181,11 @@ describe "Guilds", -> .set("X-API-Key", userToRemove.apiToken) .end (res) -> cb() + (cb) -> + request.post(baseURL + "/groups/" + guildToRemoveMember._id + "/removeMember?uuid=" + guildToRemoveMember.leader) + .send().end (res) -> + expectCode res, 401 + cb() (cb) -> request.post(baseURL + "/groups/" + guildToRemoveMember._id + "/removeMember?uuid=" + userToRemove._id) diff --git a/website/src/controllers/groups.js b/website/src/controllers/groups.js index 00985aff5b..3373e76588 100644 --- a/website/src/controllers/groups.js +++ b/website/src/controllers/groups.js @@ -739,6 +739,10 @@ api.removeMember = function(req, res, next){ return res.json(401, {err: "Only group leader can remove a member!"}); } + if(user._id === uuid){ + return res.json(401, {err: "You cannot remove yourself!"}); + } + if(_.contains(group.members, uuid)){ var update = {$pull:{members:uuid}}; if(group.quest && group.quest.members){