From effc7da31283a120514292bd1d78472e77f837b1 Mon Sep 17 00:00:00 2001
From: Hao Liu <2490665576@qq.com>
Date: Tue, 18 Nov 2025 12:07:51 +0800
Subject: [PATCH] core: check perm for solution voting (#1089)

---
 packages/hydrooj/src/handler/problem.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/packages/hydrooj/src/handler/problem.ts b/packages/hydrooj/src/handler/problem.ts
index bc1e79c6b..c4eff8bb5 100644
--- a/packages/hydrooj/src/handler/problem.ts
+++ b/packages/hydrooj/src/handler/problem.ts
@@ -922,12 +922,14 @@ export class ProblemSolutionHandler extends ProblemDetailHandler {
 
     @param('psid', Types.ObjectId)
     async postUpvote(domainId: string, psid: ObjectId) {
+        this.checkPerm(PERM.PERM_VOTE_PROBLEM_SOLUTION);
         const psdoc = await solution.vote(domainId, psid, this.user._id, 1);
         this.back({ vote: psdoc.vote, user_vote: 1 });
     }
 
     @param('psid', Types.ObjectId)
     async postDownvote(domainId: string, psid: ObjectId) {
+        this.checkPerm(PERM.PERM_VOTE_PROBLEM_SOLUTION);
         const psdoc = await solution.vote(domainId, psid, this.user._id, -1);
         this.back({ vote: psdoc.vote, user_vote: -1 });
     }