core: problem hackable check (#427)

packages/hydrooj/package.json

@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "3.17.1",
+    "version": "3.17.2",
     "bin": "bin/hydrooj.js",
     "main": "src/loader",
     "module": "src/loader",

packages/hydrooj/src/handler/problem.ts

@@ -550,6 +550,7 @@ export class ProblemHackHandler extends ProblemDetailHandler {
     @param('rid', Types.ObjectID)
     @param('tid', Types.ObjectID, true)
     async prepare(domainId: string, rid: ObjectID, tid?: ObjectID) {
+        if (typeof this.pdoc.config !== 'object' || !this.pdoc.config.hackable) throw new ForbiddenError('This problem is not hackable.');
         this.rdoc = await record.get(domainId, rid);
         if (!this.rdoc || this.rdoc.pid !== this.pdoc.docId
             || this.rdoc.contest?.toString() !== tid?.toString()) throw new RecordNotFoundError(domainId, rid);