From 15c77b558f79521df155d4afe23c8449ecb96bd1 Mon Sep 17 00:00:00 2001
From: Ignacio Mazzara <nacho@decentraland.org>
Date: Wed, 4 May 2022 16:56:46 -0300
Subject: [PATCH] fix: LR-01 (#157)

* fix: LR-01

* chore: circle

* fix: package-lock
---
 .circleci/config.yml            |  2 +-
 contracts/land/LANDRegistry.sol |  2 +-
 full/LANDRegistry.sol           |  4 ++--
 package-lock.json               | 14 +++++++-------
 package.json                    |  2 +-
 test/LANDRegistry.js            |  6 ++++++
 6 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 1cee16a..17d461d 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -16,7 +16,7 @@ jobs:
             # fallback to using the latest cache if no exact match is found
             - v1-dependencies-
 
-      - run: npm install
+      - run: npm ci
 
       - save_cache:
           paths:
diff --git a/contracts/land/LANDRegistry.sol b/contracts/land/LANDRegistry.sol
index 9742c15..dfb4f60 100644
--- a/contracts/land/LANDRegistry.sol
+++ b/contracts/land/LANDRegistry.sol
@@ -123,7 +123,7 @@ contract LANDRegistry is Storage, Ownable, FullAssetRegistry, ILANDRegistry {
   }
 
   function setLatestToNow(address user) external {
-    require(msg.sender == proxyOwner || _isApprovedForAll(msg.sender, user), "Unauthorized user");
+    require(msg.sender == proxyOwner || _isApprovedForAll(user, msg.sender), "Unauthorized user");
     // solium-disable-next-line security/no-block-members
     latestPing[user] = block.timestamp;
   }
diff --git a/full/LANDRegistry.sol b/full/LANDRegistry.sol
index 1e8011a..ff050d8 100644
--- a/full/LANDRegistry.sol
+++ b/full/LANDRegistry.sol
@@ -496,7 +496,7 @@ contract ERC721Base is AssetRegistryStorage, IERC721Base, ERC165 {
    */
   function approve(address operator, uint256 assetId) external {
     address holder = _ownerOf(assetId);
-    require(msg.sender == holder || _isApprovedForAll(msg.sender, holder));
+    require(msg.sender == holder || _isApprovedForAll(holder, msg.sender));
     require(operator != holder);
 
     if (_getApprovedAddress(assetId) != operator) {
@@ -1061,7 +1061,7 @@ contract LANDRegistry is Storage, Ownable, FullAssetRegistry, ILANDRegistry {
   }
 
   function setLatestToNow(address user) external {
-    require(msg.sender == proxyOwner || _isApprovedForAll(msg.sender, user), "Unauthorized user");
+    require(msg.sender == proxyOwner || _isApprovedForAll(user, msg.sender), "Unauthorized user");
     // solium-disable-next-line security/no-block-members
     latestPing[user] = block.timestamp;
   }
diff --git a/package-lock.json b/package-lock.json
index 83a083b..29c593e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3088,9 +3088,9 @@
       "dev": true
     },
     "erc821": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/erc821/-/erc821-5.3.0.tgz",
-      "integrity": "sha512-9uwwqaV6Zqlg4H7zc5GYQ03NSTkPqGMWTLSeS55fM4ge5xFJHPFmUu0+XffTws/+8GvAhAgbEUwz+Bs5Fh1XMw==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/erc821/-/erc821-6.0.0.tgz",
+      "integrity": "sha512-Zoa66ikTgbgYXN71LXxyBm02Daq9WTujOicu7R618CeWaFQTAMViHm7MIhLPTjgi8VNQO3vTxiiol/wS0mllHw==",
       "requires": {
         "openzeppelin-solidity": "^1.12.0"
       }
@@ -10952,12 +10952,12 @@
           "requires": {
             "underscore": "1.8.3",
             "web3-core-helpers": "1.0.0-beta.34",
-            "websocket": "git://github.com/frozeman/WebSocket-Node.git#6c72925e3f8aaaea8dc8450f97627e85263999f2"
+            "websocket": "https://github.com/frozeman/WebSocket-Node.git#6c72925e3f8aaaea8dc8450f97627e85263999f2"
           },
           "dependencies": {
             "websocket": {
-              "version": "git://github.com/frozeman/WebSocket-Node.git#6c72925e3f8aaaea8dc8450f97627e85263999f2",
-              "from": "websocket@git://github.com/frozeman/WebSocket-Node.git#6c72925e3f8aaaea8dc8450f97627e85263999f2",
+              "version": "https://github.com/frozeman/WebSocket-Node.git#6c72925e3f8aaaea8dc8450f97627e85263999f2",
+              "from": "websocket@https://github.com/frozeman/WebSocket-Node.git#6c72925e3f8aaaea8dc8450f97627e85263999f2",
               "dev": true,
               "requires": {
                 "debug": "^2.2.0",
@@ -21979,4 +21979,4 @@
       }
     }
   }
-}
+}
\ No newline at end of file
diff --git a/package.json b/package.json
index 36d7fa4..6dc823e 100644
--- a/package.json
+++ b/package.json
@@ -19,7 +19,7 @@
   },
   "homepage": "https://github.com/decentraland/land#readme",
   "dependencies": {
-    "erc821": "^5.3.0",
+    "erc821": "^6.0.0",
     "openzeppelin-zos": "1.9.4",
     "zos": "1.4.0",
     "zos-lib": "1.4.0"
diff --git a/test/LANDRegistry.js b/test/LANDRegistry.js
index d07facf..69f2f1c 100644
--- a/test/LANDRegistry.js
+++ b/test/LANDRegistry.js
@@ -329,6 +329,12 @@ contract('LANDRegistry', accounts => {
         data.should.be.equal('test_data')
       })
 
+      it('reverts when trying to approve a not authorized LAND :: approvalForAll', async function() {
+        await land.setApprovalForAll(user, true, sentByOperator)
+
+        await assertRevert(land.approve(anotherUser, 1, sentByOperator))
+      })
+
       it('updates the parcel data if authorized :: approve for all', async function() {
         await land.setApprovalForAll(operator, true, sentByUser)
         const originalData = await land.landData(0, 1, sentByUser)