Weishen/Hydro
2
0 Fork 0
mirror of https://gitcode.com/gh_mirrors/hy/Hydro.git synced 2026-10-20 01:38:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

core: limit access for hidden problems' submission

Browse Source
This commit is contained in:
undefined committed 2021-08-07 03:41:25 +08:00
1 parent 77fc46c069
commit 738d622225
14 files changed
+52 -53
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

packages/hydrooj/src/handler/record.ts
+32 -39
View File
@@ -97,21 +97,23 @@ class RecordDetailHandler extends Handler {
if (!rdoc) throw new RecordNotFoundError(rid);
if (rdoc.contest) {
const tdoc = await contest.get(domainId, rdoc.contest.tid, rdoc.contest.type);
if (
(rdoc.uid !== this.user._id && !contest.canShowRecord.call(this, tdoc, true))
|| (rdoc.uid === this.user._id && !contest.canShowSelfRecord.call(this, tdoc, true))
) {
throw new PermissionError(rid);
}
let canView = this.user.own(tdoc);
canView ||= contest.canShowRecord.call(this, tdoc);
canView ||= contest.canShowSelfRecord.call(this, tdoc, true) && rdoc.uid === this.user._id;
if (!canView) throw new PermissionError(rid);
}
if (rdoc.uid !== this.user._id && !this.user.hasPriv(PRIV.PRIV_READ_RECORD)) {
this.checkPerm(PERM.PERM_READ_RECORD);
if (rdoc.uid !== this.user._id && !this.user.hasPriv(PRIV.PRIV_READ_RECORD_CODE)) {
if (!this.user.hasPerm(PERM.PERM_READ_RECORD_CODE)) {
rdoc.code = null;
rdoc.compilerTexts = [];
}
}
// eslint-disable-next-line prefer-const
let [pdoc, udoc] = await Promise.all([
problem.get(rdoc.pdomain, rdoc.pid),
user.getById(domainId, rdoc.uid),
]);
if (!rdoc.contest && pdoc.hidden && this.user._id !== rdoc.uid) throw new PermissionError(PERM.PERM_READ_RECORD_CODE);
if (
!pdoc
|| !this.user.hasPerm(PERM.PERM_VIEW_PROBLEM)
@@ -119,15 +121,7 @@ class RecordDetailHandler extends Handler {
) {
pdoc = { ...problem.default, docId: pdoc?.docId || 0, pid: '*' };
}
this.response.body = {
path: [
['Hydro', 'homepage'],
['record_detail', null],
],
udoc,
rdoc,
pdoc,
};
this.response.body = { udoc, rdoc, pdoc };
if (rdoc.contest) {
this.response.body.tdoc = await contest.get(domainId, rdoc.contest.tid, rdoc.contest.type);
}
@@ -159,7 +153,7 @@ class RecordDetailHandler extends Handler {
};
const [latest] = await Promise.all([
record.update(domainId, rid, $set),
bus.emit('record/change', rdoc, $set),
TaskModel.deleteMany({ rid: rdoc._id }),
]);
await postJudge(latest);
}
@@ -168,7 +162,7 @@ class RecordDetailHandler extends Handler {
}
class RecordMainConnectionHandler extends ConnectionHandler {
dispose: bus.Disposable;
cleanup: bus.Disposable;
tid: string;
uid: number;
pdomain: string;
@@ -210,19 +204,14 @@ class RecordMainConnectionHandler extends ConnectionHandler {
} else throw new ProblemNotFoundError(domainId, pid);
}
if (status) this.status = status;
this.dispose = bus.on('record/change', this.onRecordChange.bind(this));
this.cleanup = bus.on('record/change', this.onRecordChange.bind(this));
}
async message(msg) {
if (msg.rids instanceof Array) {
const rids = msg.rids.map((id: string) => new ObjectID(id));
const rdocs = await record.getMulti(this.domainId, { _id: { $in: rids } }).toArray();
for (const rdoc of rdocs) this.onRecordChange(rdoc);
}
}
async cleanup() {
if (this.dispose) this.dispose();
async message(msg: { rids: string[] }) {
if (!(msg.rids instanceof Array)) return;
const rids = msg.rids.map((id) => new ObjectID(id));
const rdocs = await record.getMulti(this.domainId, { _id: { $in: rids } }).project(buildProjection(record.PROJECTION_LIST)).toArray();
for (const rdoc of rdocs) this.onRecordChange(rdoc);
}
async onRecordChange(rdoc: RecordDoc) {
@@ -253,7 +242,7 @@ class RecordMainConnectionHandler extends ConnectionHandler {
}
class RecordDetailConnectionHandler extends ConnectionHandler {
dispose: bus.Disposable;
cleanup: bus.Disposable;
rid: string;
@param('rid', Types.ObjectID)
@@ -261,13 +250,21 @@ class RecordDetailConnectionHandler extends ConnectionHandler {
const rdoc = await record.get(domainId, rid);
if (rdoc.contest && rdoc.input === undefined) {
const tdoc = await contest.get(domainId, rdoc.contest.tid, -1);
if (!contest.canShowRecord.call(this, tdoc)) throw new PermissionError(PERM.PERM_VIEW_CONTEST_HIDDEN_SCOREBOARD);
let canView = this.user.own(tdoc);
canView ||= contest.canShowRecord.call(this, tdoc);
canView ||= this.user._id === rdoc.uid && contest.canShowSelfRecord.call(this, tdoc);
if (!canView) throw new PermissionError(PERM.PERM_VIEW_CONTEST_HIDDEN_SCOREBOARD);
}
if (rdoc.uid !== this.user._id && !this.user.hasPriv(PRIV.PRIV_READ_RECORD)) {
this.checkPerm(PERM.PERM_READ_RECORD);
if (rdoc.uid !== this.user._id && !this.user.hasPriv(PRIV.PRIV_READ_RECORD_CODE)) {
if (!this.user.hasPerm(PERM.PERM_READ_RECORD_CODE)) {
rdoc.code = null;
rdoc.compilerTexts = [];
}
}
const pdoc = await problem.get(rdoc.pdomain, rdoc.pid);
if (!rdoc.contest && pdoc.hidden && this.user._id !== rdoc.uid) throw new PermissionError(PERM.PERM_READ_RECORD_CODE);
this.rid = rid.toString();
this.dispose = bus.on('record/change', this.onRecordChange.bind(this));
this.cleanup = bus.on('record/change', this.onRecordChange.bind(this));
this.onRecordChange(rdoc);
}
@@ -281,10 +278,6 @@ class RecordDetailConnectionHandler extends ConnectionHandler {
summary_html: await this.renderHTML('record_detail_summary.html', { rdoc }),
});
}
async cleanup() {
if (this.dispose) this.dispose();
}
}
export async function apply() {