From 96492e5a0e80f1bf588ab8d93f5397b7d7f2ee6c Mon Sep 17 00:00:00 2001
From: Sabe Jones <sabrecat@gmail.com>
Date: Wed, 10 Mar 2021 15:36:17 -0600
Subject: [PATCH 1/2] fix(api): correct world, cap level

---
 website/client/src/components/settings/restoreModal.vue | 2 ++
 website/server/controllers/api-v3/world.js              | 2 +-
 website/server/libs/user/index.js                       | 4 +++-
 website/server/models/user/schema.js                    | 7 ++++++-
 4 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/website/client/src/components/settings/restoreModal.vue b/website/client/src/components/settings/restoreModal.vue
index 2d5dc83be9..4df846839b 100644
--- a/website/client/src/components/settings/restoreModal.vue
+++ b/website/client/src/components/settings/restoreModal.vue
@@ -151,6 +151,8 @@ export default {
         return;
       }
 
+      if (this.restoreValues.stats.lvl > 999) this.restoreValues.stats.lvl = 999;
+
       const userChangedLevel = this.restoreValues.stats.lvl !== this.user.stats.lvl;
       const userDidNotChangeExp = this.restoreValues.stats.exp === this.user.stats.exp;
       if (userChangedLevel && userDidNotChangeExp) this.restoreValues.stats.exp = 0;
diff --git a/website/server/controllers/api-v3/world.js b/website/server/controllers/api-v3/world.js
index c0ea223bad..e136105857 100644
--- a/website/server/controllers/api-v3/world.js
+++ b/website/server/controllers/api-v3/world.js
@@ -29,7 +29,7 @@ api.getWorldState = {
     const worldState = {};
 
     worldState.worldBoss = await getWorldBoss();
-    worldState.npcImageSuffix = 'spring';
+    worldState.npcImageSuffix = '';
 
     worldState.currentEvent = getCurrentEvent();
 
diff --git a/website/server/libs/user/index.js b/website/server/libs/user/index.js
index 7ab2e44ef3..4774f4d4ff 100644
--- a/website/server/libs/user/index.js
+++ b/website/server/libs/user/index.js
@@ -166,7 +166,9 @@ export async function update (req, res, { isV3 = false }) {
         user.flags.lastNewStuffRead = lastNewsPost._id;
       }
     } else if (acceptablePUTPaths[key]) {
-      _.set(user, key, val);
+      let adjustedVal = val;
+      if (key === 'stats.lvl' && val > 999) adjustedVal = 999;
+      _.set(user, key, adjustedVal);
     } else {
       throw new NotAuthorized(res.t('messageUserOperationProtected', { operation: key }));
     }
diff --git a/website/server/models/user/schema.js b/website/server/models/user/schema.js
index 6cae485112..a99f5a93fe 100644
--- a/website/server/models/user/schema.js
+++ b/website/server/models/user/schema.js
@@ -592,7 +592,12 @@ export default new Schema({
     mp: { $type: Number, default: 10 },
     exp: { $type: Number, default: 0 },
     gp: { $type: Number, default: 0 },
-    lvl: { $type: Number, default: 1, min: 1 },
+    lvl: {
+      $type: Number,
+      default: 1,
+      min: 1,
+      max: 999,
+    },
 
     // Class System
     class: {

From d7aa4486762ada63144c41720a8204ed13d45285 Mon Sep 17 00:00:00 2001
From: Sabe Jones <sabrecat@gmail.com>
Date: Wed, 10 Mar 2021 15:36:46 -0600
Subject: [PATCH 2/2] 4.184.1

---
 package-lock.json | 2 +-
 package.json      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 117847e5ba..295bf6370e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "habitica",
-  "version": "4.184.0",
+  "version": "4.184.1",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
diff --git a/package.json b/package.json
index 52c7db8a5e..4c476d5d9b 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "habitica",
   "description": "A habit tracker app which treats your goals like a Role Playing Game.",
-  "version": "4.184.0",
+  "version": "4.184.1",
   "main": "./website/server/index.js",
   "dependencies": {
     "@babel/core": "^7.12.10",