From 8144e85c145feb75e80cb279a9eb83397ee90a47 Mon Sep 17 00:00:00 2001
From: undefined <i@undefined.moe>
Date: Wed, 12 Jan 2022 10:58:20 +0800
Subject: [PATCH] core: do not allow deleting system domain

---
 packages/hydrooj/package.json          | 2 +-
 packages/hydrooj/src/handler/domain.ts | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json
index 28f70ec4e..8b6820c50 100644
--- a/packages/hydrooj/package.json
+++ b/packages/hydrooj/package.json
@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "3.3.7",
+    "version": "3.3.8",
     "bin": "bin/hydrooj.js",
     "main": "src/loader",
     "module": "src/loader",
diff --git a/packages/hydrooj/src/handler/domain.ts b/packages/hydrooj/src/handler/domain.ts
index 8e7ab1f06..5cd7df092 100644
--- a/packages/hydrooj/src/handler/domain.ts
+++ b/packages/hydrooj/src/handler/domain.ts
@@ -99,10 +99,11 @@ class DomainEditHandler extends ManageHandler {
         this.response.redirect = this.url('domain_dashboard');
     }
 
-    async postDelete({ password }) {
+    async postDelete({ domainId, password }) {
         this.user.checkPassword(password);
-        if (this.domain.owner === this.user._id) throw new ForbiddenError('You are not the owner of this domain.');
-        await domain.del(this.domainId);
+        if (domainId === 'system') throw new ForbiddenError('You are not allowed to delete system domain');
+        if (this.domain.owner !== this.user._id) throw new ForbiddenError('You are not the owner of this domain.');
+        await domain.del(domainId);
         this.response.redirect = this.url('home_domain', { domainId: 'system' });
     }
 }