ui: 修复 og:url 泄漏源站ip的问题

packages/ui-default/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hydrooj/ui-default",
-  "version": "4.8.24",
+  "version": "4.8.25",
   "author": "undefined <i@undefined.moe>",
   "license": "AGPL-3.0",
   "main": "hydro.js",

packages/ui-default/pages/problem_files.page.js

@@ -198,6 +198,7 @@ const page = new NamedPage('problem_files', () => {
     let content = '';
     if (ev) {
       const link = $(ev.currentTarget).find('a').attr('href');
+      if (!link) return;
       if (filesize > 8 * 1024 * 1024) Notification.error(i18n('file too large'));
       Notification.info(i18n('Loading file...'));
       const res = await request.get(link);
@@ -217,20 +218,22 @@ const page = new NamedPage('problem_files', () => {
     await pjax.request({ push: false });
   }
 
-  $('.problem-files-testdata .col--name').on('click', (ev) => handleEdit('testdata', ev));
+  if ($('[name="remove_selected_testdata"]').length) {
-  $('.problem-files-additional_file .col--name').on('click', (ev) => handleEdit('additional_file', ev));
+    $('.problem-files-testdata .col--name').on('click', (ev) => handleEdit('testdata', ev));
-  $('.problem-files-testdata').on('dragover', (ev) => handleDragOver('testdata', ev));
+    $('.problem-files-additional_file .col--name').on('click', (ev) => handleEdit('additional_file', ev));
-  $('.problem-files-additional_file').on('dragover', (ev) => handleDragOver('additional_file', ev));
+    $('.problem-files-testdata').on('dragover', (ev) => handleDragOver('testdata', ev));
-  $('.problem-files-testdata').on('drop', (ev) => handleDrop('testdata', ev));
+    $('.problem-files-additional_file').on('dragover', (ev) => handleDragOver('additional_file', ev));
-  $('.problem-files-additional_file').on('drop', (ev) => handleDrop('additional_file', ev));
+    $('.problem-files-testdata').on('drop', (ev) => handleDrop('testdata', ev));
-  $('[name="upload_testdata"]').on('click', () => handleClickUpload('testdata'));
+    $('.problem-files-additional_file').on('drop', (ev) => handleDrop('additional_file', ev));
-  $('[name="create_testdata"]').on('click', () => handleEdit('testdata'));
+    $('[name="upload_testdata"]').on('click', () => handleClickUpload('testdata'));
+    $('[name="upload_file"]').on('click', () => handleClickUpload('additional_file'));
+    $('[name="create_testdata"]').on('click', () => handleEdit('testdata'));
+    $('[name="create_file"]').on('click', () => handleEdit('additional_file'));
+    $('[name="remove_selected_testdata"]').on('click', () => handleClickRemoveSelected('testdata'));
+    $('[name="remove_selected_file"]').on('click', () => handleClickRemoveSelected('additional_file'));
+  }
   $('[name="download_selected_testdata"]').on('click', () => handleClickDownloadSelected('testdata'));
-  $('[name="remove_selected_testdata"]').on('click', () => handleClickRemoveSelected('testdata'));
-  $('[name="upload_file"]').on('click', () => handleClickUpload('additional_file'));
-  $('[name="create_file"]').on('click', () => handleEdit('additional_file'));
   $('[name="download_selected_file"]').on('click', () => handleClickDownloadSelected('additional_file'));
-  $('[name="remove_selected_file"]').on('click', () => handleClickRemoveSelected('additional_file'));
 });
 
 export default page;

packages/ui-default/templates/layout/html5.html

@@ -23,7 +23,7 @@
   {% block ogp %}
   <meta property="og:site_name" content="{{ model.system.get('server.name') }}" />
   <meta property="og:title" content="{{ handler.renderTitle(page_name) }}" />
-  <meta property="og:url" content="{{ handler.ctx.request.href }}" />
+  <meta property="og:url" content="{{ model.system.get('server.url') }}{{ handler.ctx.request.path }}" />
   <meta property="og:image" content="{{ static_url('favicon-96x96.png') }}" />
   {% endblock %}
   {% if not isIE(handler.request.headers['user-agent']) %}
@@ -40,13 +40,12 @@
   {% endif %}
 </head>
 <body>
-  {{ handler.request.headers.hmr|default('')|safe }}
   {% block body %}{% endblock %}
   {% if not isIE(handler.request.headers['user-agent']) %}
   <script>
     var UiContext = {{ UiContext|json|safe }};
     var UserContext = {{ UserContext|json|safe }};
-    </script>
+  </script>
   <script type="text/javascript" src="{{ ('/locale/{0}.js'.format(handler.translate('__id'))) }}"></script>
   <script type="text/javascript" src="/ui-constants.js"></script>
   <script type="module" src="{{ static_url('hydro.js') }}"></script>

packages/ui-default/templates/problem_files.html

@@ -14,11 +14,13 @@
       </div>
       {{ noscript_note.render() }}
       {% include "partials/problem_files-testdata.html" %}
-      {% if handler.user.own(pdoc, perm.PERM_EDIT_PROBLEM_SELF) or handler.user.hasPerm(perm.PERM_EDIT_PROBLEM) %}
+      {% if handler.user.own(pdoc) or handler.user.hasPerm(perm.PERM_READ_PROBLEM_DATA) or handler.user.hasPriv(PRIV.PRIV_READ_PROBLEM_DATA) %}
         {% if testdata.length %}
           <div class="section__body">
             <button class="rounded button" name="download_selected_testdata">{{ _('Download Selected') }}</button>
-            <button class="rounded button" name="remove_selected_testdata">{{ _('Remove Selected') }}</button>
+            {% if handler.user.own(pdoc, perm.PERM_EDIT_PROBLEM_SELF) or handler.user.hasPerm(perm.PERM_EDIT_PROBLEM) %}
+              <button class="rounded button" name="remove_selected_testdata">{{ _('Remove Selected') }}</button>
+            {% endif %}
           </div>
         {% endif %}
       {% endif %}