feathers-plus / authentication-local-management

Adds sign up verification, forgotten password reset, and other capabilities to local feathers-authentication
MIT License
14 stars 2 forks source link

Inaccurate 'Can only affect your own account' error #9

Closed NickBolles closed 5 years ago

NickBolles commented 5 years ago

Steps to reproduce

I verified that password change is sending the correct user, auth token and such down to the server. Then on this line

the authUser Id and the user1 (from the db) id are identical, but using === directly on them still returns false.

Changing this line to stringify the ids fixes the issue

  if (options.ownAcctOnly && authUser && (`${getId(authUser)}` !== `${getId(user1)}`)) {

It might also make sense to do this in the get-id helper?

eddyystop commented 5 years ago

Thanks for the catch!

Did you use Mongoose or MongoDB? The keys would be ObjectIDs in that case.

getId now does a .toString() on the key.

Please remember this repo has not yet been released. Beaking changes are likely and I push changes to master directly so there are no PRs to look at.