From: Marius Gavrilescu <marius@ieval.ro>
Date: Sat, 20 Dec 2014 14:43:19 +0000 (+0200)
Subject: Enforce job privacy
X-Git-Url: http://git.ieval.ro/?a=commitdiff_plain;h=28e89d6c6215c1eee381a31e409cf50deaacf883;p=plack-app-gruntmaster.git

Enforce job privacy
---

diff --git a/lib/Plack/App/Gruntmaster.pm b/lib/Plack/App/Gruntmaster.pm
index 56f0ec1..14e7987 100644
--- a/lib/Plack/App/Gruntmaster.pm
+++ b/lib/Plack/App/Gruntmaster.pm
@@ -157,7 +157,10 @@ sub dispatch_request{
 
 		sub (/us/:user)    { response us_entry => user->name, db->user_entry($_{user}) },
 		sub (/ct/:contest) { response ct_entry => contest->name, db->contest_entry($_{contest}) },
-		sub (/log/:job)    { response log_entry => "Job  $_{job}", db->job_entry($_{job}) },
+		sub (/log/:job)    {
+			forbid job->private;
+			response log_entry => "Job  $_{job}", db->job_entry($_{job})
+		},
 		sub (/pb/:problem + ?contest~) {
 			my (undef, undef, $contest) = @_;
 			$_{contest} = $contest;
@@ -196,7 +199,7 @@ sub dispatch_request{
 			reply 'Password changed successfully';
 		},
 
-		sub (/action/submit + %:problem=&:contest~&:prog_format=&:private~&:source_code~ + *:prog~) {
+		sub (/action/submit + %:problem=&:contest~&:prog_format=&:source_code~ + *:prog~) {
 			forbid !remote_user;
 			return reply 'This contest has finished' if contest && contest->is_finished;
 			return reply 'This contest has not yet started' if !admin && contest && contest->is_pending;
@@ -208,7 +211,7 @@ sub dispatch_request{
 			unlink $_{prog}->path if $_{prog};
 			db->jobs->create({
 				maybe contest => $_{contest},
-				maybe private => $_{private},
+				maybe private => problem->private,
 				date => time,
 				extension => FORMAT_EXTENSION->{$_{prog_format}},
 				format => $_{prog_format},