Skip to content

Commit

Permalink
Unconditionally deny access when a comment's related object doesn't e…
Browse files Browse the repository at this point in the history
…xist
  • Loading branch information
Ninjaclasher authored and Xyene committed Jun 4, 2020
1 parent c6e7a38 commit 31215fe
Showing 1 changed file with 11 additions and 8 deletions.
19 changes: 11 additions & 8 deletions judge/models/comment.py
Original file line number Diff line number Diff line change
Expand Up @@ -149,14 +149,17 @@ def page_title(self):
return self.get_page_title(self.page)

def is_accessible_by(self, user):
if self.page.startswith('p:') or self.page.startswith('s:'):
return Problem.objects.get(code=self.page[2:]).is_accessible_by(user)
elif self.page.startswith('c:'):
return Contest.objects.get(key=self.page[2:]).is_accessible_by(user)
elif self.page.startswith('b:'):
return BlogPost.objects.get(id=self.page[2:]).can_see(user)
else:
return True
try:
if self.page.startswith('p:') or self.page.startswith('s:'):
return Problem.objects.get(code=self.page[2:]).is_accessible_by(user)
elif self.page.startswith('c:'):
return Contest.objects.get(key=self.page[2:]).is_accessible_by(user)
elif self.page.startswith('b:'):
return BlogPost.objects.get(id=self.page[2:]).can_see(user)
else:
return True
except ObjectDoesNotExist:
return False

def get_absolute_url(self):
return '%s#comment-%d' % (self.link, self.id)
Expand Down

0 comments on commit 31215fe

Please sign in to comment.