From 454afbcb08ddf4075341c0e97d2f1c048a0e2719 Mon Sep 17 00:00:00 2001
From: undefined <masnn0@outlook.com>
Date: Sat, 6 Mar 2021 15:44:41 +0800
Subject: [PATCH] =?UTF-8?q?core:=20=E4=BF=AE=E6=AD=A3problem=5Fsend?=
 =?UTF-8?q?=E9=89=B4=E6=9D=83?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 packages/hydrooj/package.json          | 2 +-
 packages/hydrooj/src/handler/remote.ts | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json
index d7f68cb65..d12e732c9 100644
--- a/packages/hydrooj/package.json
+++ b/packages/hydrooj/package.json
@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "2.19.5",
+    "version": "2.19.6",
     "bin": "bin/hydrooj.js",
     "main": "dist/loader.js",
     "typings": "dist/loader.d.ts",
diff --git a/packages/hydrooj/src/handler/remote.ts b/packages/hydrooj/src/handler/remote.ts
index a05c7e328..ad7976c96 100644
--- a/packages/hydrooj/src/handler/remote.ts
+++ b/packages/hydrooj/src/handler/remote.ts
@@ -18,12 +18,14 @@ const logger = new Logger('remote');
 
 export class ProblemSendHandler extends Handler {
     async get() {
+        this.checkPerm(PERM.PERM_VIEW_PROBLEM);
         this.response.template = 'problem_send.html';
     }
 
     @post('target', Types.String)
     @post('pids', Types.Array)
     async postSend(domainId: string, target: any, _pids: (number | string)[]) {
+        this.checkPerm(PERM.PERM_VIEW_PROBLEM);
         target = target.split('@');
         const getHidden = this.user.hasPerm(PERM.PERM_VIEW_PROBLEM_HIDDEN);
         const getData = this.user.hasPerm(PERM.PERM_READ_PROBLEM_DATA);
@@ -64,7 +66,7 @@ export class ProblemSendHandler extends Handler {
         const pdocs = await problem.getMulti(domainId, { docId: { $in: pids } }, problem.PROJECTION_PUBLIC).toArray();
         const data = await token.get(tokenId, token.TYPE_EXPORT);
         if (!data) throw new InvalidTokenError(tokenId);
-        for (const pid of pids) if (!data.pids.includes(pid)) throw new InvalidTokenError(tokenId);
+        if (pids.filter((pid) => !data.pids.includes(pid)).length) throw new InvalidTokenError(tokenId);
         const links = [];
         for (const pdoc of pdocs) {
             const files = await storage.list(`problem/${domainId}/${pdoc.docId}/`, true);
@@ -152,7 +154,7 @@ export class ProblemReceiveHandler extends Handler {
 export async function apply() {
     ProblemAdd('problem_receive', {}, 'copy', 'Import From Hydro');
     Route('problem_receive', '/problem/receive', ProblemReceiveHandler);
-    Route('problem_send', '/problem/send', ProblemSendHandler, PERM.PERM_VIEW_PROBLEM);
+    Route('problem_send', '/problem/send', ProblemSendHandler);
 }
 
 global.Hydro.handler.remote = apply;