sudoxreboot/habitica
1
0
Fork 0
mirror of https://github.com/sudoxnym/habitica.git synced 2026-07-16 17:02:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

prevent buying market gear if class doesn't match (#10818)

Browse source 
* prevent buying market gear if class doesn't match

* add test
This commit is contained in:
negue 2018-11-12 21:32:54 +01:00 committed by Matteo Pagliazzi
parent be95cd967a
commit eca7382545
2 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
test/api/v3/integration/user/buy/POST-user_buy_gear.test.js
View file

@ -53,4 +53,15 @@ describe('POST /user/buy-gear/:key', () => {
message: 'You need to purchase a lower level gear before this one.',
});
});
it('returns an error if tries to buy gear from a different class', async () => {
let key = 'armor_rogue_1';
return expect(user.post(`/user/buy-gear/${key}`))
.to.eventually.be.rejected.and.eql({
code: 401,
error: 'NotAuthorized',
message: 'You can\'t buy this item.',
});
});
});

9
website/common/script/ops/buy/buyMarketGear.js
View file

@ -24,6 +24,15 @@ export class BuyMarketGearOperation extends AbstractGoldItemOperation {
return false;
}
canUserPurchase (user, item) {
super.canUserPurchase(user, item);
// check for different class gear
if (item.klass !== 'special' && item.klass !== user.stats.class) {
throw new NotAuthorized(this.i18n('cannotBuyItem'));
}
}
extractAndValidateParams (user, req) {
let key = this.key = get(req, 'params.key');
if (!key) throw new BadRequest(errorMessage('missingKeyParam'));