From 211dfe9ebf1c6618ce5396b0338de4f9b580715e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=B4=9B=E6=A8=B1=20Luoingly?= <luoingly@outlook.com>
Date: Mon, 30 Sep 2024 15:07:46 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=20Session=20=E4=BB=A5?=
 =?UTF-8?q?=E5=8F=8A=E7=94=A8=E6=88=B7=E6=9D=83=E9=99=90=E7=9B=B8=E5=85=B3?=
 =?UTF-8?q?=E9=97=AE=E9=A2=98=20[Patch=20f33d87]=20(#78)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: Python 3 的评测支持

* feat: 弃用无状态 Token

* fix: 修复用户编辑相关问题

* fix: 失效时主动清除 Session
---
 controllers/session.js    |  2 +-
 controllers/user.js       |  4 +++-
 services/node-0/judger.js |  2 +-
 utils/middlewares.js      | 13 ++++++++++++-
 4 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/controllers/session.js b/controllers/session.js
index e85b85f..2c2afe4 100644
--- a/controllers/session.js
+++ b/controllers/session.js
@@ -18,7 +18,7 @@ const login = async (ctx) => {
     ctx.throw(400, 'Wrong password')
   }
 
-  ctx.session.profile = only(user, 'uid nick privilege')
+  ctx.session.profile = only(user, 'uid nick privilege pwd')
   ctx.session.profile.verifyContest = []
   ctx.body = {
     profile: ctx.session.profile,
diff --git a/controllers/user.js b/controllers/user.js
index 09b2ff2..b8986b7 100644
--- a/controllers/user.js
+++ b/controllers/user.js
@@ -115,7 +115,9 @@ const update = async (ctx) => {
       user[field] = opt[field]
     }
   })
-  if (!isUndefined(opt.privilege)) {
+  if (!isUndefined(opt.privilege) && opt.privilege !== user.privilege) {
+    if (!isRoot(ctx.session.profile))
+      ctx.throw(400, 'You do not have permission to change the privilege!')
     user.privilege = Number.parseInt(opt.privilege)
   }
   if (opt.newPwd) {
diff --git a/services/node-0/judger.js b/services/node-0/judger.js
index c27c599..c9b58f8 100644
--- a/services/node-0/judger.js
+++ b/services/node-0/judger.js
@@ -24,7 +24,7 @@ const logger = require('../../utils/logger')
 const config = require('../../config')
 const redis = require('../../config/redis')
 
-const extensions = [ '', 'c', 'cpp', 'java' ]
+const extensions = ['', 'c', 'cpp', 'java', 'py']
 
 // 转化代码
 // 因为判题端各数字表示的含义与 OJ 默认的不同，因此需要做一次转化
diff --git a/utils/middlewares.js b/utils/middlewares.js
index 2aad347..83c4139 100644
--- a/utils/middlewares.js
+++ b/utils/middlewares.js
@@ -1,8 +1,19 @@
 const { RateLimit } = require('koa2-ratelimit')
 const { isAdmin, isRoot } = require('./helper')
+const User = require('../models/User')
 
 const login = async (ctx, next) => {
-  if (!ctx.session || ctx.session.profile == null) { ctx.throw(401, 'Login required') }
+  if (!ctx.session || ctx.session.profile == null) {
+    delete ctx.session.profile
+    ctx.throw(401, 'Login required')
+  }
+  const user = await User.findOne({ uid: ctx.session.profile.uid }).exec()
+  if (user == null || user.pwd !== ctx.session.profile.pwd) {
+    delete ctx.session.profile
+    ctx.throw(401, 'Login required')
+  }
+  if (user.privilege !== ctx.session.profile.privilege)
+    ctx.session.profile.privilege = user.privilege
   await next()
 }