tictactoe: Enforce only legal moves with regard to team membership

[lmno-server] / lmno.js

diff --git a/lmno.js b/lmno.js
index 5d4ca3e7b554025a2b367cf8aca6dae71945ec1b..18e60efd947349be35218a643ac6ba7a9756971d 100644 (file)
--- a/lmno.js
+++ b/lmno.js
@@ -309,8 +309,15 @@ for (let key in engines) {
     router.post('/move', (request, response) => {
       const game = request.game;
       const move = request.body.move;
+      const player = game.players[request.session.id];
 
-      const result = game.add_move(move);
+      /* Reject move if there is no player for this session. */
+      if (! player) {
+        response.json({legal: false, message: "No valid player from session"});
+        return;
+      }
+
+      const result = game.add_move(player, move);
 
       /* Feed move response back to the client. */
       response.json(result);