baoshuo/S2OJ
baoshuo/S2OJ
1
1
Fork 0
mirror of https://github.com/renbaoshuo/S2OJ.git synced 2024-09-19 01:25:18 +00:00
Code Issues Actions Packages Releases Activity

fix: return 403 if problem is used in a registered running contest
All checks were successful
continuous-integration/drone/push Build is passing
Details

Browse Source
This commit is contained in:
Baoshuo Ren 2022-10-03 08:49:23 +08:00
parent a917881042
commit 90b3675bd5
Signed by: baoshuo
GPG Key ID: 00CB9680AB29F51A
4 changed files with 27 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
web/app/controllers/problem_solutions.php
View File

@ -10,11 +10,15 @@
become404Page();
}
if (!isProblemVisibleToUser($problem, $myUser)) {
become404Page();
}
$problem_extra_config = getProblemExtraConfig($problem);
$solution_viewable = hasViewSolutionPermission($problem_extra_config['view_solution_type'], $myUser, $problem);
$solution_submittable = hasViewSolutionPermission($problem_extra_config['submit_solution_type'], $myUser, $problem);
if (!$solution_viewable) {
if (!$solution_viewable || isRegisteredRunningContestProblem($myUser, $problem)) {
become403Page();
}

4
web/app/controllers/problem_statistics.php
View File

@ -21,6 +21,10 @@
if (!isNormalUser($myUser)) {
become403Page();
}
if (isRegisteredRunningContestProblem($myUser, $problem)) {
become403Page();
}
}
function scoreDistributionData() {

3
web/app/controllers/submission.php
View File

@ -29,7 +29,8 @@
become403Page();
}
}
if (!isSubmissionVisibleToUser($submission, $problem, $myUser)) {
if (!isSubmissionVisibleToUser($submission, $problem, $myUser) || isRegisteredRunningContestProblem($myUser, $problem)) {
become403Page();
}

16
web/app/libs/uoj-query-lib.php
View File

@ -245,6 +245,22 @@ function isHackFullVisibleToUser($hack, $contest, $problem, $user) {
}
}
function isRegisteredRunningContestProblem($user, $problem) {
$result = DB::query("select contest_id from contests_problems where problem_id = {$problem['id']}");
while (list($contest_id) = DB::fetch($result, MYSQLI_NUM)) {
$contest = queryContest($contest_id);
genMoreContestInfo($contest);
if (CONTEST_NOT_STARTED < $contest['cur_progress'] && $contest['cur_progress'] <= CONTEST_IN_PROGRESS
&& hasRegistered($user, $contest)
&& !hasContestPermission($user, $contest)
&& queryContestProblemRank($contest, $problem)) {
return true;
}
}
return false;
}
function deleteBlog($id) {
if (!validateUInt($id)) {
return;