diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json index 28f70ec4e..8b6820c50 100644 --- a/packages/hydrooj/package.json +++ b/packages/hydrooj/package.json @@ -1,6 +1,6 @@ { "name": "hydrooj", - "version": "3.3.7", + "version": "3.3.8", "bin": "bin/hydrooj.js", "main": "src/loader", "module": "src/loader", diff --git a/packages/hydrooj/src/handler/domain.ts b/packages/hydrooj/src/handler/domain.ts index 8e7ab1f06..5cd7df092 100644 --- a/packages/hydrooj/src/handler/domain.ts +++ b/packages/hydrooj/src/handler/domain.ts @@ -99,10 +99,11 @@ class DomainEditHandler extends ManageHandler { this.response.redirect = this.url('domain_dashboard'); } - async postDelete({ password }) { + async postDelete({ domainId, password }) { this.user.checkPassword(password); - if (this.domain.owner === this.user._id) throw new ForbiddenError('You are not the owner of this domain.'); - await domain.del(this.domainId); + if (domainId === 'system') throw new ForbiddenError('You are not allowed to delete system domain'); + if (this.domain.owner !== this.user._id) throw new ForbiddenError('You are not the owner of this domain.'); + await domain.del(domainId); this.response.redirect = this.url('home_domain', { domainId: 'system' }); } }