Fix unauthorized viewing of non-friends' dashboards

Author: eding888

back/src/routers/taskRouter.ts

@@ -53,7 +53,7 @@ taskRouter.get('/friend/:username', async (request: AuthenticatedRequest, respon
   if (!user) {
     return response.status(400).json({ error: 'User does not exist.' });
   }
-  if (!request.user.friendsData.friends.map(friend => friend.toUpperCase() === username.toUpperCase())) {
+  if (request.user.friendsData.friends.map(friend => friend.toUpperCase() === username.toUpperCase())) {
     return response.status(401).json({ error: 'You do not have this user added.' });
   }
   const tasks: TaskInterface[] = [];

back/src/routers/userRouter.ts

@@ -26,7 +26,7 @@ userRouter.get('/friend/:username', async (request: AuthenticatedRequest, respon
   if (!user) {
     return response.status(400).json({ error: 'User does not exist.' });
   }
-  if (!request.user.friendsData.friends.map(friend => friend.toUpperCase() === username.toUpperCase())) {
+  if (request.user.friendsData.friends.map(friend => friend.toUpperCase() === username.toUpperCase())) {
     return response.status(401).json({ error: 'You do not have this user added.' });
   }
   await user.populate({

front/taskwizard-front/src/pages/VisitorDashboard.tsx

@@ -95,6 +95,9 @@ function VisitorDashboard () {
       console.log('Connected to server');
       if (username) {
         const user = await getFriendUser(username);
+        if (!user.id) {
+          navigate('/dashboard');
+        }
         socket.emit('subscribeToUser', user.id);
       }
     });