ui: 修复 og:url 泄漏源站ip的问题

packages/ui-default/templates/layout/html5.html

@@ -23,7 +23,7 @@
   {% block ogp %}
   <meta property="og:site_name" content="{{ model.system.get('server.name') }}" />
   <meta property="og:title" content="{{ handler.renderTitle(page_name) }}" />
-  <meta property="og:url" content="{{ handler.ctx.request.href }}" />
+  <meta property="og:url" content="{{ model.system.get('server.url') }}{{ handler.ctx.request.path }}" />
   <meta property="og:image" content="{{ static_url('favicon-96x96.png') }}" />
   {% endblock %}
   {% if not isIE(handler.request.headers['user-agent']) %}
@@ -40,13 +40,12 @@
   {% endif %}
 </head>
 <body>
-  {{ handler.request.headers.hmr|default('')|safe }}
   {% block body %}{% endblock %}
   {% if not isIE(handler.request.headers['user-agent']) %}
   <script>
     var UiContext = {{ UiContext|json|safe }};
     var UserContext = {{ UserContext|json|safe }};
-    </script>
+  </script>
   <script type="text/javascript" src="{{ ('/locale/{0}.js'.format(handler.translate('__id'))) }}"></script>
   <script type="text/javascript" src="/ui-constants.js"></script>
   <script type="module" src="{{ static_url('hydro.js') }}"></script>

packages/ui-default/templates/problem_files.html

@@ -14,11 +14,13 @@
       </div>
       {{ noscript_note.render() }}
       {% include "partials/problem_files-testdata.html" %}
-      {% if handler.user.own(pdoc, perm.PERM_EDIT_PROBLEM_SELF) or handler.user.hasPerm(perm.PERM_EDIT_PROBLEM) %}
+      {% if handler.user.own(pdoc) or handler.user.hasPerm(perm.PERM_READ_PROBLEM_DATA) or handler.user.hasPriv(PRIV.PRIV_READ_PROBLEM_DATA) %}
         {% if testdata.length %}
           <div class="section__body">
             <button class="rounded button" name="download_selected_testdata">{{ _('Download Selected') }}</button>
-            <button class="rounded button" name="remove_selected_testdata">{{ _('Remove Selected') }}</button>
+            {% if handler.user.own(pdoc, perm.PERM_EDIT_PROBLEM_SELF) or handler.user.hasPerm(perm.PERM_EDIT_PROBLEM) %}
+              <button class="rounded button" name="remove_selected_testdata">{{ _('Remove Selected') }}</button>
+            {% endif %}
           </div>
         {% endif %}
       {% endif %}