diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json
index 3d13152a0..aed3adc01 100644
--- a/packages/hydrooj/package.json
+++ b/packages/hydrooj/package.json
@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "2.29.8",
+    "version": "2.29.9",
     "bin": "bin/hydrooj.js",
     "main": "dist/loader.js",
     "typings": "dist/loader.d.ts",
diff --git a/packages/hydrooj/src/handler/contest.ts b/packages/hydrooj/src/handler/contest.ts
index cd35eb08d..450e605c3 100644
--- a/packages/hydrooj/src/handler/contest.ts
+++ b/packages/hydrooj/src/handler/contest.ts
@@ -382,6 +382,9 @@ export class ContestCodeHandler extends Handler {
         }
         await this.limitRate('homework_code', 3600, 60);
         const [tdoc, tsdocs] = await contest.getAndListStatus(domainId, tid);
+        if (!contest.canShowRecord.call(this, tdoc as any, true)) {
+            throw new PermissionError(PERM.PERM_VIEW_CONTEST_HIDDEN_SCOREBOARD);
+        }
         const rnames = {};
         for (const tsdoc of tsdocs) {
             for (const pid in tsdoc.detail || {}) {
diff --git a/packages/ui-default/package.json b/packages/ui-default/package.json
index 8ac05c9ce..f766aa2a0 100644
--- a/packages/ui-default/package.json
+++ b/packages/ui-default/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hydrooj/ui-default",
-  "version": "4.12.2",
+  "version": "4.12.3",
   "author": "undefined <i@undefined.moe>",
   "license": "AGPL-3.0",
   "main": "hydro.js",
diff --git a/packages/ui-default/templates/partials/contest_sidebar.html b/packages/ui-default/templates/partials/contest_sidebar.html
index 1e7702087..78aec51d7 100644
--- a/packages/ui-default/templates/partials/contest_sidebar.html
+++ b/packages/ui-default/templates/partials/contest_sidebar.html
@@ -58,9 +58,11 @@
       </a></li>
     {% endif %}
     {% if handler.user.hasPriv(PRIV.PRIV_READ_RECORD_CODE) or handler.user.hasPerm(perm.PERM_READ_RECORD_CODE) %}
-      <li class="menu__item"><a class="menu__link" href="{{ url('contest_code', tid=tdoc.docId) }}">
-        <span class="icon icon-download"></span> {{ _('Export All Code') }}
-      </a></li>
+      {% if model.contest.canShowRecord.call(handler, tdoc, true) %}
+        <li class="menu__item"><a class="menu__link" href="{{ url('contest_code', tid=tdoc.docId) }}">
+          <span class="icon icon-download"></span> {{ _('Export All Code') }}
+        </a></li>
+      {% endif %}
     {% endif %}
       <li class="menu__item"><a class="menu__link" href="{{ url('record_main', query={tid:tdoc.docId}) }}">
         <span class="icon icon-flag"></span> {{ _('All Submissions') }}