core: better user_file permission control

packages/hydrooj/package.json

@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "3.3.18",
+    "version": "3.3.19",
     "bin": "bin/hydrooj.js",
     "main": "src/loader",
     "module": "src/loader",

packages/hydrooj/src/handler/misc.ts

@@ -28,6 +28,7 @@ class SwitchLanguageHandler extends Handler {
 export class FilesHandler extends Handler {
     @param('pjax', Types.Boolean)
     async get(domainId: string, pjax = false) {
+        if (!this.user._files?.length) this.checkPriv(PRIV.PRIV_CREATE_FILE);
         const files = sortFiles(this.user._files);
         if (pjax) {
             this.response.body = {
@@ -44,6 +45,7 @@ export class FilesHandler extends Handler {
 
     @post('filename', Types.Name, true)
     async postUploadFile(domainId: string, filename: string) {
+        this.checkPriv(PRIV.PRIV_CREATE_FILE);
         if ((this.user._files?.length || 0) >= system.get('limit.user_files')) {
             throw new ForbiddenError('File limit exceeded.');
         }
@@ -87,6 +89,8 @@ export class FSDownloadHandler extends Handler {
     @param('filename', Types.Name)
     @param('noDisposition', Types.Boolean)
     async get(domainId: string, uid: number, filename: string, noDisposition = false) {
+        const targetUser = await user.getById('system', uid);
+        if (!targetUser.hasPriv(PRIV.PRIV_CREATE_FILE)) throw new ForbiddenError('Access denied');
         this.response.addHeader('Cache-Control', 'public');
         const target = `user/${uid}/${filename}`;
         const file = await storage.getMeta(target);
@@ -110,7 +114,7 @@ export class SwitchAccountHandler extends Handler {
 
 export async function apply() {
     Route('switch_language', '/language/:lang', SwitchLanguageHandler);
-    Route('home_files', '/file', FilesHandler, PRIV.PRIV_CREATE_FILE);
+    Route('home_files', '/file', FilesHandler);
     Route('fs_download', '/file/:uid/:filename', FSDownloadHandler);
     Route('switch_account', '/account', SwitchAccountHandler, PRIV.PRIV_EDIT_SYSTEM);
 }

packages/hydrooj/src/handler/problem.ts

@@ -11,8 +11,8 @@ import {
     ValidationError,
 } from '../error';
 import {
-    ProblemConfig, ProblemDoc, ProblemStatusDoc,
-    Tdoc, User,
+    ProblemDoc, ProblemStatusDoc, Tdoc,
+    User,
 } from '../interface';
 import paginate from '../lib/paginate';
 import { isPid, parsePid as convertPid } from '../lib/validator';