From 50b8343ad98b742b88e483849c3011f6cdc3c791 Mon Sep 17 00:00:00 2001
From: undefined <i@undefined.moe>
Date: Mon, 3 May 2021 19:12:22 +0800
Subject: [PATCH] core: reject access to /user/0

---
 packages/hydrooj/package.json        | 2 +-
 packages/hydrooj/src/handler/user.ts | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json
index 9bb952e95..984ca4d12 100644
--- a/packages/hydrooj/package.json
+++ b/packages/hydrooj/package.json
@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "2.24.2",
+    "version": "2.24.3",
     "bin": "bin/hydrooj.js",
     "main": "dist/loader.js",
     "typings": "dist/loader.d.ts",
diff --git a/packages/hydrooj/src/handler/user.ts b/packages/hydrooj/src/handler/user.ts
index be59efe11..5752c0c35 100644
--- a/packages/hydrooj/src/handler/user.ts
+++ b/packages/hydrooj/src/handler/user.ts
@@ -2,7 +2,7 @@ import moment from 'moment-timezone';
 import {
     UserAlreadyExistError, InvalidTokenError, VerifyPasswordError,
     UserNotFoundError, SystemError, BlacklistedError,
-    UserFacingError, LoginError,
+    UserFacingError, LoginError, NotFoundError,
 } from '../error';
 import { User } from '../interface';
 import {
@@ -178,6 +178,7 @@ class UserLostPassWithCodeHandler extends Handler {
 class UserDetailHandler extends Handler {
     @param('uid', Types.Int)
     async get(domainId: string, uid: number) {
+        if (uid === 0) throw new NotFoundError(this.request.path);
         const isSelfProfile = this.user._id === uid;
         const udoc = await user.getById(domainId, uid);
         if (!udoc) throw new UserNotFoundError(uid);