From 261220fdd5b18b42a148dd0431a44a2290c37954 Mon Sep 17 00:00:00 2001
From: Stefan Zermatten <stefanzermatten@gmail.com>
Date: Tue, 13 Nov 2018 10:39:14 +0200
Subject: [PATCH] Fixes #155, buffs can now only be applied if you have write
 access

refactored applying buffs to be a method, not a client side operation. You can now only applied if you have write access to the receiving character.
---
 app/Model/Character/Buffs.js                  | 34 ++++++++++++++
 .../buffs/customBuffView/customBuffView.js    | 44 +------------------
 2 files changed, 35 insertions(+), 43 deletions(-)

diff --git a/app/Model/Character/Buffs.js b/app/Model/Character/Buffs.js
index e6e00710..c73c88eb 100644
--- a/app/Model/Character/Buffs.js
+++ b/app/Model/Character/Buffs.js
@@ -65,3 +65,37 @@ makeParent(Buffs, ["name", "enabled"]); //parents of effects, attacks, proficien
 
 Buffs.allow(CHARACTER_SUBSCHEMA_ALLOW);
 Buffs.deny(CHARACTER_SUBSCHEMA_DENY);
+
+Meteor.methods({
+	applyBuff: function(buffId, targetId){
+		if (!Meteor.call("canWriteCharacter", targetId)){
+			throw new Meteor.Error(
+				"Access denied",
+				"You do not have permission to buff this character"
+			);
+		}
+		let buff = CustomBuffs.findOne(buffId);
+		if (!buff) return;
+
+		var parentCol = Meteor.isClient ?
+			window[buff.parent.collection] : global[buff.parent.collection]
+		var parent = parentCol.findOne(buff.parent.id);
+
+		//insert new buff
+		newBuffId = Buffs.insert({
+			charId: targetId,
+			name: buff.name,
+			description: buff.description,
+			lifeTime: {total: buff.lifeTime.total},
+			type: "custom",
+
+			appliedBy: buff.charId,
+			appliedByDetails: {
+				name: parent && parent.name || "",
+				collection: buff.parent.collection,
+			},
+		});
+
+		Meteor.call("cloneChildren", buffId, {id: newBuffId, collection: "Buffs"})
+	}
+})
diff --git a/app/client/views/character/buffs/customBuffView/customBuffView.js b/app/client/views/character/buffs/customBuffView/customBuffView.js
index fdc30712..fb06bc41 100644
--- a/app/client/views/character/buffs/customBuffView/customBuffView.js
+++ b/app/client/views/character/buffs/customBuffView/customBuffView.js
@@ -1,47 +1,5 @@
 const applyBuff = function(targetId, buff) {
-	var parent = global[buff.parent.collection].findOne(buff.parent.id);
-
-	//insert new buff
-	newBuffId = Buffs.insert({
-		charId: targetId,
-		name: buff.name,
-		description: buff.description,
-		lifeTime: {total: buff.lifeTime.total},
-		type: "custom",
-
-		appliedBy: buff.charId,
-		appliedByDetails: {
-			name: parent.name,
-			collection: buff.parent.collection,
-		},
-	});
-
-	//insert children
-	Attacks.find({"parent.id": buff._id}).forEach(function(doc){
-		temp = _.clone(doc);
-		temp.parent.id = newBuffId;
-		temp.parent.collection = "Buffs";
-		delete temp._id;
-
-		Attacks.insert(temp);
-	});
-	Effects.find({"parent.id": buff._id}).forEach(function(doc){
-		temp = _.clone(doc);
-		temp.parent.id = newBuffId;
-		temp.parent.collection = "Buffs";
-		delete temp._id;
-
-		Effects.insert(temp);
-	});
-	Proficiencies.find({"parent.id": buff._id}).forEach(function(doc){
-		temp = _.clone(doc);
-		temp.parent.id = newBuffId;
-		temp.parent.collection = "Buffs";
-		delete temp._id;
-
-		Proficiencies.insert(temp);
-	});
-
+	Meteor.call("applyBuff", buff._id, targetId)
 	let target;
 	if (targetId == buff.charId) {
 		target = "self";