core: limit export contest code

packages/hydrooj/package.json

@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "2.29.8",
+    "version": "2.29.9",
     "bin": "bin/hydrooj.js",
     "main": "dist/loader.js",
     "typings": "dist/loader.d.ts",

packages/hydrooj/src/handler/contest.ts

@@ -382,6 +382,9 @@ export class ContestCodeHandler extends Handler {
         }
         await this.limitRate('homework_code', 3600, 60);
         const [tdoc, tsdocs] = await contest.getAndListStatus(domainId, tid);
+        if (!contest.canShowRecord.call(this, tdoc as any, true)) {
+            throw new PermissionError(PERM.PERM_VIEW_CONTEST_HIDDEN_SCOREBOARD);
+        }
         const rnames = {};
         for (const tsdoc of tsdocs) {
             for (const pid in tsdoc.detail || {}) {