Enforce job privacy

diff --git a/lib/Plack/App/Gruntmaster.pm b/lib/Plack/App/Gruntmaster.pm
index 56f0ec11c19912ec2a7f20141bb2b4f604f41a45..14e79871b5e2e8e32c9ccce9fbe79bb841b59002 100644 (file)
--- a/lib/Plack/App/Gruntmaster.pm
+++ b/lib/Plack/App/Gruntmaster.pm
@@ -157,7 +157,10 @@ sub dispatch_request{
 
                sub (/us/:user)    { response us_entry => user->name, db->user_entry($_{user}) },
                sub (/ct/:contest) { response ct_entry => contest->name, db->contest_entry($_{contest}) },
-               sub (/log/:job)    { response log_entry => "Job  $_{job}", db->job_entry($_{job}) },
+               sub (/log/:job)    {
+                       forbid job->private;
+                       response log_entry => "Job  $_{job}", db->job_entry($_{job})
+               },
                sub (/pb/:problem + ?contest~) {
                        my (undef, undef, $contest) = @_;
                        $_{contest} = $contest;
@@ -196,7 +199,7 @@ sub dispatch_request{
                        reply 'Password changed successfully';
                },
 
-               sub (/action/submit + %:problem=&:contest~&:prog_format=&:private~&:source_code~ + *:prog~) {
+               sub (/action/submit + %:problem=&:contest~&:prog_format=&:source_code~ + *:prog~) {
                        forbid !remote_user;
                        return reply 'This contest has finished' if contest && contest->is_finished;
                        return reply 'This contest has not yet started' if !admin && contest && contest->is_pending;
@@ -208,7 +211,7 @@ sub dispatch_request{
                        unlink $_{prog}->path if $_{prog};
                        db->jobs->create({
                                maybe contest => $_{contest},
-                               maybe private => $_{private},
+                               maybe private => problem->private,
                                date => time,
                                extension => FORMAT_EXTENSION->{$_{prog_format}},
                                format => $_{prog_format},