xuyue/OnlineJudge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #203 from QingdaoU/fix_contest_submission

Browse Source 
fix a vulnerability in contest submission
This commit is contained in:
李扬
2019-01-05 14:05:44 +08:00
committed by GitHub
parent f2f6b48d69 3406791d2a
commit 91363e7444
1 changed files with 19 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
submission/views/oj.py
View File

@@ -1,15 +1,15 @@
import ipaddress
from account.decorators import login_required, check_contest_permission
from contest.models import ContestStatus, ContestRuleType
from judge.tasks import judge_task
from options.options import SysOptions
# from judge.dispatcher import JudgeDispatcher
from problem.models import Problem, ProblemRuleType
from contest.models import Contest, ContestStatus, ContestRuleType
from options.options import SysOptions
from utils.api import APIView, validate_serializer
from utils.throttling import TokenBucket
from utils.captcha import Captcha
from utils.cache import cache
from utils.captcha import Captcha
from utils.throttling import TokenBucket
from ..models import Submission
from ..serializers import (CreateSubmissionSerializer, SubmissionModelSerializer,
ShareSubmissionSerializer)
@@ -34,26 +34,27 @@ class SubmissionAPI(APIView):
# if not can_consume:
# return "Captcha is required"
@check_contest_permission(check_type="problems")
def check_contest_permission(self, request):
contest = self.contest
if contest.status == ContestStatus.CONTEST_ENDED:
return self.error("The contest have ended")
if not request.user.is_contest_admin(contest):
user_ip = ipaddress.ip_address(request.session.get("ip"))
if contest.allowed_ip_ranges:
if not any(user_ip in ipaddress.ip_network(cidr, strict=False) for cidr in contest.allowed_ip_ranges):
return self.error("Your IP is not allowed in this contest")
@validate_serializer(CreateSubmissionSerializer)
@login_required
def post(self, request):
data = request.data
hide_id = False
if data.get("contest_id"):
try:
contest = Contest.objects.get(id=data["contest_id"], visible=True)
except Contest.DoesNotExist:
return self.error("Contest doesn't exist.")
if contest.status == ContestStatus.CONTEST_ENDED:
return self.error("The contest have ended")
if not request.user.is_contest_admin(contest):
if contest.status == ContestStatus.CONTEST_NOT_START:
return self.error("Contest have not started")
user_ip = ipaddress.ip_address(request.session.get("ip"))
if contest.allowed_ip_ranges:
if not any(user_ip in ipaddress.ip_network(cidr, strict=False) for cidr in contest.allowed_ip_ranges):
return self.error("Your IP is not allowed in this contest")
error = self.check_contest_permission(request)
if error:
return error
contest = self.contest
if not contest.problem_details_permission(request.user):
hide_id = True