merge setkey hotfix into production

mozilla · Aug 22, 2011 · 95e9fc5 · 95e9fc5
2 parents 1ea7084 + 133868a
commit 95e9fc5
Showing 1 changed file with 10 additions and 2 deletions.
diff --git a/browserid/lib/wsapi.js b/browserid/lib/wsapi.js
@@ -201,8 +201,16 @@ function setup(app) {
   });
 
   app.post('/wsapi/set_key', checkAuthed, checkParams(["email", "pubkey"]), function (req, resp) {
-    db.addKeyToEmail(req.session.authenticatedUser, req.body.email, req.body.pubkey, function (rv) {
-      resp.json(rv);
+    db.emailsBelongToSameAccount(req.session.authenticatedUser, req.body.email, function(sameAccount) {
+      // not same account? big fat error
+      if (!sameAccount) {
+        httputils.badRequest(resp, "that email does not belong to you");
+      } else {
+        // same account, we add the key
+        db.addKeyToEmail(req.session.authenticatedUser, req.body.email, req.body.pubkey, function (rv) {
+          resp.json(rv);
+        });
+      }
     });
   });