team code can be used even when you're logged in [#15746035]

nko2 · Jul 14, 2011 · 0f5b918 · 0f5b918
1 parent 238cfff
commit 0f5b918
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 8 deletions.
diff --git a/controllers/teams.coffee b/controllers/teams.coffee
@@ -45,7 +45,7 @@ app.all '/teams/:id/invite/:inviteId', (req, res, next) ->
   Team.findById req.param('id'), (err, team) ->
     app.te err
     return next() unless team
-    return next '401' unless team.includes(req.user || req.session.team)
+    return next '401' unless team.includes(req.user, req.session.team)
     team.invites.id(req.param('inviteId')).send(true)
     res.redirect "/teams/#{team.id}"
 
@@ -54,7 +54,7 @@ app.get '/teams/:id/edit', (req, res, next) ->
   Team.findById req.param('id'), (err, team) ->
     app.te err
     return next() unless team
-    return next '401' unless team.includes(req.user || req.session.team)
+    return next '401' unless team.includes(req.user, req.session.team)
     team.people (err, people) ->
       app.te err
       res.render2 'teams/edit', team: team, people: people
@@ -66,7 +66,7 @@ app.put '/teams/:id', (req, res, next) ->
   Team.findById req.param('id'), (err, team) ->
     app.te err
     return next() unless team
-    return next '401' unless team.includes(req.user || req.session.team)
+    return next '401' unless team.includes(req.user, req.session.team)
     _.extend team, req.body
     team.save (err) ->
       if err

diff --git a/models/team.coffee b/models/team.coffee
@@ -22,9 +22,8 @@ TeamSchema = module.exports = new mongoose.Schema
     default: -> rbytes.randomBytes(12).toString('base64')
 TeamSchema.plugin require('mongoose-types').useTimestamps
 
-TeamSchema.method 'includes', (person) ->
-  console.log person
-  @code == person or _.any(@people_ids, (id) -> id.equals(person.id)) if person
+TeamSchema.method 'includes', (person, code) ->
+  @code == code or _.any @people_ids, (id) -> id.equals(person?.id)
 
 TeamSchema.method 'people', (callback) ->
   Person.find _id: { '$in': @people_ids }, callback

diff --git a/views/teams/show.jade b/views/teams/show.jade
@@ -1,6 +1,6 @@
 h1
   = team.name
-  - if (team.includes(user || code))
+  - if (team.includes(user, code))
     | 
     a.button( href: '/teams/' + team.id + '/edit' ) Manage
 
@@ -14,7 +14,7 @@ h1
 
 - if (team.invites.length)
   h2 Invites (#{team.invites.length} pending)
-  - if (team.includes(user || code))
+  - if (team.includes(user, code))
     ul.invites
       - each invite in team.invites
         li