From c3190551ddc4d3fbed82993c9419871dd3db9c7f Mon Sep 17 00:00:00 2001
From: undefined <i@undefined.moe>
Date: Sat, 7 Aug 2021 03:50:39 +0800
Subject: [PATCH] core: update limits

---
 packages/hydrooj/package.json          | 2 +-
 packages/hydrooj/src/handler/record.ts | 9 ++++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json
index 7f4b93ba5..cd724ada1 100644
--- a/packages/hydrooj/package.json
+++ b/packages/hydrooj/package.json
@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "2.32.1",
+    "version": "2.32.2",
     "bin": "bin/hydrooj.js",
     "main": "src/loader",
     "module": "src/loader",
diff --git a/packages/hydrooj/src/handler/record.ts b/packages/hydrooj/src/handler/record.ts
index cd7a24364..efdf8a0a0 100644
--- a/packages/hydrooj/src/handler/record.ts
+++ b/packages/hydrooj/src/handler/record.ts
@@ -113,13 +113,12 @@ class RecordDetailHandler extends Handler {
             problem.get(rdoc.pdomain, rdoc.pid),
             user.getById(domainId, rdoc.uid),
         ]);
-        if (!rdoc.contest && pdoc.hidden && this.user._id !== rdoc.uid) throw new PermissionError(PERM.PERM_READ_RECORD_CODE);
         if (
             !pdoc
             || !this.user.hasPerm(PERM.PERM_VIEW_PROBLEM)
             || (!rdoc.contest && pdoc.hidden && !this.user.own(pdoc) && !this.user.hasPerm(PERM.PERM_VIEW_PROBLEM_HIDDEN))
         ) {
-            pdoc = { ...problem.default, docId: pdoc?.docId || 0, pid: '*' };
+            throw new PermissionError(PERM.PERM_READ_RECORD_CODE);
         }
         this.response.body = { udoc, rdoc, pdoc };
         if (rdoc.contest) {
@@ -262,7 +261,11 @@ class RecordDetailConnectionHandler extends ConnectionHandler {
             }
         }
         const pdoc = await problem.get(rdoc.pdomain, rdoc.pid);
-        if (!rdoc.contest && pdoc.hidden && this.user._id !== rdoc.uid) throw new PermissionError(PERM.PERM_READ_RECORD_CODE);
+        let canView = this.user.own(pdoc);
+        canView ||= !pdoc.hidden && this.user.hasPerm(PERM.PERM_VIEW_PROBLEM);
+        canView ||= this.user.hasPerm(PERM.PERM_VIEW_PROBLEM_HIDDEN);
+        canView ||= !!rdoc.contest || this.user._id === rdoc.uid;
+        if (!canView) throw new PermissionError(PERM.PERM_READ_RECORD_CODE);
         this.rid = rid.toString();
         this.cleanup = bus.on('record/change', this.onRecordChange.bind(this));
         this.onRecordChange(rdoc);