fix: LR-01 (#157)

* fix: LR-01

* chore: circle

* fix: package-lock

.circleci/config.yml

@@ -16,7 +16,7 @@ jobs:
             # fallback to using the latest cache if no exact match is found
             - v1-dependencies-
 
-      - run: npm install
+      - run: npm ci
 
       - save_cache:
           paths:

contracts/land/LANDRegistry.sol

@@ -123,7 +123,7 @@ contract LANDRegistry is Storage, Ownable, FullAssetRegistry, ILANDRegistry {
   }
 
   function setLatestToNow(address user) external {
-    require(msg.sender == proxyOwner || _isApprovedForAll(msg.sender, user), "Unauthorized user");
+    require(msg.sender == proxyOwner || _isApprovedForAll(user, msg.sender), "Unauthorized user");
     // solium-disable-next-line security/no-block-members
     latestPing[user] = block.timestamp;
   }

full/LANDRegistry.sol

@@ -496,7 +496,7 @@ contract ERC721Base is AssetRegistryStorage, IERC721Base, ERC165 {
    */
   function approve(address operator, uint256 assetId) external {
     address holder = _ownerOf(assetId);
-    require(msg.sender == holder || _isApprovedForAll(msg.sender, holder));
+    require(msg.sender == holder || _isApprovedForAll(holder, msg.sender));
     require(operator != holder);
 
     if (_getApprovedAddress(assetId) != operator) {
@@ -1061,7 +1061,7 @@ contract LANDRegistry is Storage, Ownable, FullAssetRegistry, ILANDRegistry {
   }
 
   function setLatestToNow(address user) external {
-    require(msg.sender == proxyOwner || _isApprovedForAll(msg.sender, user), "Unauthorized user");
+    require(msg.sender == proxyOwner || _isApprovedForAll(user, msg.sender), "Unauthorized user");
     // solium-disable-next-line security/no-block-members
     latestPing[user] = block.timestamp;
   }

package.json

@@ -19,7 +19,7 @@
   },
   "homepage": "https://github.com/decentraland/land#readme",
   "dependencies": {
-    "erc821": "^5.3.0",
+    "erc821": "^6.0.0",
     "openzeppelin-zos": "1.9.4",
     "zos": "1.4.0",
     "zos-lib": "1.4.0"

test/LANDRegistry.js

@@ -329,6 +329,12 @@ contract('LANDRegistry', accounts => {
         data.should.be.equal('test_data')
       })
 
+      it('reverts when trying to approve a not authorized LAND :: approvalForAll', async function() {
+        await land.setApprovalForAll(user, true, sentByOperator)
+
+        await assertRevert(land.approve(anotherUser, 1, sentByOperator))
+      })
+
       it('updates the parcel data if authorized :: approve for all', async function() {
         await land.setApprovalForAll(operator, true, sentByUser)
         const originalData = await land.landData(0, 1, sentByUser)