core: limit access for hidden problems' submission

packages/hydrooj/locales/ko.yaml

@@ -546,6 +546,7 @@ Rank: 순위
 ranking: 순위
 Read data of own problems: 자신의 문제 데이터 읽기
 Read data of problem: 문제 데이터 읽기
+Read record codes: 점수 읽기
 Ready (☆▽☆): 준비 완료! (☆▽☆)
 Ready: 준비됨
 Recent {0} Records: 최근 {0} 점수

packages/hydrooj/locales/zh_TW.yaml

@@ -351,9 +351,9 @@ QQ Group: QQ 群
 QQ Visibility: QQ 可見性
 Quit Scratchpad: 退出線上程式設計模式
 Rank: 排名
-Read all records: 讀取記錄
 Read data of own problems: 讀取自己題目的資料
 Read data of problem: 讀取題目資料
+Read record codes: 讀取記錄的程式碼
 Ready (☆▽☆): 馬上開始 (☆▽☆)
 Ready: 即將開始
 Recent {0} Records: 最近 {0} 條記錄

packages/hydrooj/package.json

@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "2.32.0",
+    "version": "2.32.1",
     "bin": "bin/hydrooj.js",
     "main": "src/loader",
     "module": "src/loader",

packages/hydrooj/src/handler/contest.ts

@@ -388,8 +388,8 @@ export class ContestCodeHandler extends Handler {
     async get(domainId: string, tid: ObjectID) {
         await this.limitRate('contest_code', 3600, 60);
         const [tdoc, tsdocs] = await contest.getAndListStatus(domainId, tid);
-        if (!this.user.own(tdoc) && !this.user.hasPriv(PRIV.PRIV_READ_RECORD)) {
-            this.checkPerm(PERM.PERM_READ_RECORD);
+        if (!this.user.own(tdoc) && !this.user.hasPriv(PRIV.PRIV_READ_RECORD_CODE)) {
+            this.checkPerm(PERM.PERM_READ_RECORD_CODE);
         }
         if (!contest.canShowRecord.call(this, tdoc as any, true)) {
             throw new PermissionError(PERM.PERM_VIEW_CONTEST_HIDDEN_SCOREBOARD);

packages/hydrooj/src/handler/homework.ts

@@ -393,8 +393,8 @@ class HomeworkCodeHandler extends Handler {
         const [tdoc, tsdocs] = await contest.getAndListStatus(
             domainId, tid, document.TYPE_HOMEWORK,
         );
-        if (!this.user.own(tdoc) && !this.user.hasPriv(PRIV.PRIV_READ_RECORD)) {
-            this.checkPerm(PERM.PERM_READ_RECORD);
+        if (!this.user.own(tdoc) && !this.user.hasPriv(PRIV.PRIV_READ_RECORD_CODE)) {
+            this.checkPerm(PERM.PERM_READ_RECORD_CODE);
         }
         const rnames = {};
         for (const tsdoc of tsdocs) {

packages/hydrooj/src/handler/record.ts

@@ -97,21 +97,23 @@ class RecordDetailHandler extends Handler {
         if (!rdoc) throw new RecordNotFoundError(rid);
         if (rdoc.contest) {
             const tdoc = await contest.get(domainId, rdoc.contest.tid, rdoc.contest.type);
-            if (
-                (rdoc.uid !== this.user._id && !contest.canShowRecord.call(this, tdoc, true))
-                || (rdoc.uid === this.user._id && !contest.canShowSelfRecord.call(this, tdoc, true))
-            ) {
-                throw new PermissionError(rid);
-            }
+            let canView = this.user.own(tdoc);
+            canView ||= contest.canShowRecord.call(this, tdoc);
+            canView ||= contest.canShowSelfRecord.call(this, tdoc, true) && rdoc.uid === this.user._id;
+            if (!canView) throw new PermissionError(rid);
         }
-        if (rdoc.uid !== this.user._id && !this.user.hasPriv(PRIV.PRIV_READ_RECORD)) {
-            this.checkPerm(PERM.PERM_READ_RECORD);
+        if (rdoc.uid !== this.user._id && !this.user.hasPriv(PRIV.PRIV_READ_RECORD_CODE)) {
+            if (!this.user.hasPerm(PERM.PERM_READ_RECORD_CODE)) {
+                rdoc.code = null;
+                rdoc.compilerTexts = [];
+            }
         }
         // eslint-disable-next-line prefer-const
         let [pdoc, udoc] = await Promise.all([
             problem.get(rdoc.pdomain, rdoc.pid),
             user.getById(domainId, rdoc.uid),
         ]);
+        if (!rdoc.contest && pdoc.hidden && this.user._id !== rdoc.uid) throw new PermissionError(PERM.PERM_READ_RECORD_CODE);
         if (
             !pdoc
             || !this.user.hasPerm(PERM.PERM_VIEW_PROBLEM)
@@ -119,15 +121,7 @@ class RecordDetailHandler extends Handler {
         ) {
             pdoc = { ...problem.default, docId: pdoc?.docId || 0, pid: '*' };
         }
-        this.response.body = {
-            path: [
-                ['Hydro', 'homepage'],
-                ['record_detail', null],
-            ],
-            udoc,
-            rdoc,
-            pdoc,
-        };
+        this.response.body = { udoc, rdoc, pdoc };
         if (rdoc.contest) {
             this.response.body.tdoc = await contest.get(domainId, rdoc.contest.tid, rdoc.contest.type);
         }
@@ -159,7 +153,7 @@ class RecordDetailHandler extends Handler {
             };
             const [latest] = await Promise.all([
                 record.update(domainId, rid, $set),
-                bus.emit('record/change', rdoc, $set),
+                TaskModel.deleteMany({ rid: rdoc._id }),
             ]);
             await postJudge(latest);
         }
@@ -168,7 +162,7 @@ class RecordDetailHandler extends Handler {
 }
 
 class RecordMainConnectionHandler extends ConnectionHandler {
-    dispose: bus.Disposable;
+    cleanup: bus.Disposable;
     tid: string;
     uid: number;
     pdomain: string;
@@ -210,19 +204,14 @@ class RecordMainConnectionHandler extends ConnectionHandler {
             } else throw new ProblemNotFoundError(domainId, pid);
         }
         if (status) this.status = status;
-        this.dispose = bus.on('record/change', this.onRecordChange.bind(this));
+        this.cleanup = bus.on('record/change', this.onRecordChange.bind(this));
     }
 
-    async message(msg) {
-        if (msg.rids instanceof Array) {
-            const rids = msg.rids.map((id: string) => new ObjectID(id));
-            const rdocs = await record.getMulti(this.domainId, { _id: { $in: rids } }).toArray();
-            for (const rdoc of rdocs) this.onRecordChange(rdoc);
-        }
-    }
-
-    async cleanup() {
-        if (this.dispose) this.dispose();
+    async message(msg: { rids: string[] }) {
+        if (!(msg.rids instanceof Array)) return;
+        const rids = msg.rids.map((id) => new ObjectID(id));
+        const rdocs = await record.getMulti(this.domainId, { _id: { $in: rids } }).project(buildProjection(record.PROJECTION_LIST)).toArray();
+        for (const rdoc of rdocs) this.onRecordChange(rdoc);
     }
 
     async onRecordChange(rdoc: RecordDoc) {
@@ -253,7 +242,7 @@ class RecordMainConnectionHandler extends ConnectionHandler {
 }
 
 class RecordDetailConnectionHandler extends ConnectionHandler {
-    dispose: bus.Disposable;
+    cleanup: bus.Disposable;
     rid: string;
 
     @param('rid', Types.ObjectID)
@@ -261,13 +250,21 @@ class RecordDetailConnectionHandler extends ConnectionHandler {
         const rdoc = await record.get(domainId, rid);
         if (rdoc.contest && rdoc.input === undefined) {
             const tdoc = await contest.get(domainId, rdoc.contest.tid, -1);
-            if (!contest.canShowRecord.call(this, tdoc)) throw new PermissionError(PERM.PERM_VIEW_CONTEST_HIDDEN_SCOREBOARD);
+            let canView = this.user.own(tdoc);
+            canView ||= contest.canShowRecord.call(this, tdoc);
+            canView ||= this.user._id === rdoc.uid && contest.canShowSelfRecord.call(this, tdoc);
+            if (!canView) throw new PermissionError(PERM.PERM_VIEW_CONTEST_HIDDEN_SCOREBOARD);
         }
-        if (rdoc.uid !== this.user._id && !this.user.hasPriv(PRIV.PRIV_READ_RECORD)) {
-            this.checkPerm(PERM.PERM_READ_RECORD);
+        if (rdoc.uid !== this.user._id && !this.user.hasPriv(PRIV.PRIV_READ_RECORD_CODE)) {
+            if (!this.user.hasPerm(PERM.PERM_READ_RECORD_CODE)) {
+                rdoc.code = null;
+                rdoc.compilerTexts = [];
+            }
         }
+        const pdoc = await problem.get(rdoc.pdomain, rdoc.pid);
+        if (!rdoc.contest && pdoc.hidden && this.user._id !== rdoc.uid) throw new PermissionError(PERM.PERM_READ_RECORD_CODE);
         this.rid = rid.toString();
-        this.dispose = bus.on('record/change', this.onRecordChange.bind(this));
+        this.cleanup = bus.on('record/change', this.onRecordChange.bind(this));
         this.onRecordChange(rdoc);
     }
 
@@ -281,10 +278,6 @@ class RecordDetailConnectionHandler extends ConnectionHandler {
             summary_html: await this.renderHTML('record_detail_summary.html', { rdoc }),
         });
     }
-
-    async cleanup() {
-        if (this.dispose) this.dispose();
-    }
 }
 
 export async function apply() {

packages/hydrooj/src/model/builtin.ts

@@ -30,7 +30,7 @@ export const PERM = {
     PERM_VIEW_PROBLEM_HIDDEN: 1n << 8n,
     PERM_SUBMIT_PROBLEM: 1n << 9n,
     PERM_READ_PROBLEM_DATA: 1n << 10n,
-    PERM_READ_RECORD: 1n << 12n,
+    PERM_READ_RECORD_CODE: 1n << 12n,
     PERM_REJUDGE_PROBLEM: 1n << 13n,
     PERM_REJUDGE: 1n << 14n,
 
@@ -113,7 +113,7 @@ export const PERMS = [
     Permission('perm_problem', PERM.PERM_VIEW_PROBLEM_HIDDEN, 'View hidden problems'),
     Permission('perm_problem', PERM.PERM_SUBMIT_PROBLEM, 'Submit problem'),
     Permission('perm_problem', PERM.PERM_READ_PROBLEM_DATA, 'Read data of problem'),
-    Permission('perm_record', PERM.PERM_READ_RECORD, 'Read all records'),
+    Permission('perm_record', PERM.PERM_READ_RECORD_CODE, 'Read record codes'),
     Permission('perm_record', PERM.PERM_REJUDGE_PROBLEM, 'Rejudge problems'),
     Permission('perm_record', PERM.PERM_REJUDGE, 'Rejudge records'),
     Permission('perm_problem_solution', PERM.PERM_VIEW_PROBLEM_SOLUTION, 'View problem solutions'),
@@ -232,7 +232,7 @@ export const PRIV = {
     PRIV_USER_PROFILE: 1 << 2,
     PRIV_REGISTER_USER: 1 << 3,
     PRIV_READ_PROBLEM_DATA: 1 << 4,
-    PRIV_READ_RECORD: 1 << 7,
+    PRIV_READ_RECORD_CODE: 1 << 7,
     PRIV_VIEW_HIDDEN_RECORD: 1 << 8,
     PRIV_JUDGE: 1 << 9, // (renamed)
     PRIV_CREATE_DOMAIN: 1 << 10,

packages/hydrooj/src/model/task.ts

@@ -114,6 +114,10 @@ class TaskModel {
         return coll.deleteOne({ _id });
     }
 
+    static deleteMany(query: FilterQuery<Task>) {
+        return coll.deleteMany(query);
+    }
+
     static getFirst = getFirst;
 
     static async getDelay(query?: FilterQuery<Task>): Promise<[number, Date]> {