diff --git a/spec/ParseUser.spec.js b/spec/ParseUser.spec.js index a36b3cdcba..35e3a6e4dc 100644 --- a/spec/ParseUser.spec.js +++ b/spec/ParseUser.spec.js @@ -122,6 +122,40 @@ describe('Parse.User testing', () => { }); }); + it("become on non existing user", (done) => { + var user = null; + var sessionToken = null; + var userPointer = null; + + Parse.Promise.as().then(function() { + return Parse.User.signUp("9090", "-----"); + + }).then(function(newUser) { + equal(Parse.User.current(), newUser); + + user = newUser; + userPointer = user.toPointer(); + sessionToken = newUser.getSessionToken(); + ok(sessionToken); + + var u = Parse.Object.fromJSON(userPointer); + return u.destroy({useMasterKey:true}); + + }).then(function() { + return Parse.User.become(sessionToken); + }).then((user) => { + ok(false, "Shouldn't have been able to log in with non existing user."); + }, function(error) { + ok(error); + return Parse.Promise.as(); + }).then(function() { + done(); + }, function(error) { + ok(false, error); + done(); + }); + }); + it("become", (done) => { var user = null; var sessionToken = null; diff --git a/src/Routers/UsersRouter.js b/src/Routers/UsersRouter.js index 4cba3edb0d..991221147a 100644 --- a/src/Routers/UsersRouter.js +++ b/src/Routers/UsersRouter.js @@ -47,9 +47,10 @@ export class UsersRouter extends ClassesRouter { { _session_token: sessionToken }, { include: 'user' }) .then((response) => { + if (!response.results || response.results.length == 0 || - !response.results[0].user) { + !response.results[0].user || ( response.results[0].user.__type && response.results[0].user.__type === 'Pointer' ) ) { throw new Parse.Error(Parse.Error.INVALID_SESSION_TOKEN, 'invalid session token'); } else { let user = response.results[0].user;