Fix: minor (#99)

* fix: the text offset issue that causes ghosting when displaying PDF file on mobile device
Also fix [CVE-2024-4367](https://www.mozilla.org/en-US/security/advisories/mfsa2024-21/#CVE-2024-4367) by upgrading pdfjs version

* fix: use state instead of score to choose the color

* impr: make the table horizontally scrollable on mobile devices

* fix: markdown code block escape failed

* impr: distinguish between the two types of rechallenge

* refactor: use a simple method to parse the limit config

src/handlers/acct.py

@@ -44,21 +44,26 @@ async def get(self, acct_id):
         ac_pro_cnt = 0
         for pro in prolist:
             pro_id = pro['pro_id']
-            tmp = {'pro_id': pro_id, 'score': -1}
+            tmp = {'pro_id': pro_id, 'score': -1, 'state': None}
             if pro_id in ratemap:
                 tmp['score'] = ratemap[pro_id]['rate']
+                tmp['state'] = ratemap[pro_id]['state']
                 ac_pro_cnt += ratemap[pro_id]['state'] == ChalConst.STATE_AC
 
             prolist2.append(tmp)
 
+        def chunk_list(la, size):
+            for i in range(0, len(la), size):
+                yield la[i: i + size]
+
         rate_data['rate'] = math.floor(rate_data['rate'])
         rate_data['ac_pro_cnt'] = ac_pro_cnt
 
         # force https, add by xiplus, 2018/8/24
         acct.photo = re.sub(r'^http://', 'https://', acct.photo)
         acct.cover = re.sub(r'^http://', 'https://', acct.cover)
 
-        await self.render('acct/profile', acct=acct, rate=rate_data, prolist=prolist2)
+        await self.render('acct/profile', acct=acct, rate=rate_data, prolist=chunk_list(prolist2, 10))
 
 
 class AcctConfigHandler(RequestHandler):
@@ -127,6 +132,7 @@ async def post(self):
 
 class AcctProClassHandler(RequestHandler):
     @reqenv
+    @require_permission([UserConst.ACCTTYPE_USER, UserConst.ACCTTYPE_KERNEL])
     async def get(self, acct_id):
         acct_id = int(acct_id)
         try:
@@ -152,6 +158,7 @@ async def get(self, acct_id):
             await self.render('acct/proclass-update', proclass_id=proclass_id, proclass=proclass)
 
     @reqenv
+    @require_permission([UserConst.ACCTTYPE_USER, UserConst.ACCTTYPE_KERNEL])
     async def post(self, acct_id):
         reqtype = self.get_argument('reqtype')
         acct_id = int(acct_id)

src/handlers/base.py

@@ -15,7 +15,8 @@
 import utils.htmlgen
 
 TEMPLATE_NAMESPACE = {
-    'set_page_title': utils.htmlgen.set_page_title
+    'set_page_title': utils.htmlgen.set_page_title,
+    'markdown_escape': utils.htmlgen.markdown_escape,
 }
 
 class RequestHandler(tornado.web.RequestHandler):

src/handlers/manage/pro.py

@@ -890,54 +890,34 @@ async def post(self, page=None):
                     self.error(err)
                     return
 
-                ALLOW_COMPILERS = ChalConst.ALLOW_COMPILERS
+                ALLOW_COMPILERS = set(list(ChalConst.ALLOW_COMPILERS) + ['default'])
                 if pro['testm_conf']['is_makefile']:
-                    ALLOW_COMPILERS = ['gcc', 'g++', 'clang', 'clang++', 'default']
+                    ALLOW_COMPILERS = {'gcc', 'g++', 'clang', 'clang++', 'default'}
 
-                def _check(comp_type, limit):
-                    if comp_type not in ALLOW_COMPILERS and comp_type != "default":
-                        return False
-
-                    if 'timelimit' not in limit:
-                        return False
+                new_limits = {}
+                for comp_type, limit in limits.items():
+                    if comp_type not in ALLOW_COMPILERS:
+                        continue
                     try:
-                        int(limit['timelimit'])
-                    except ValueError:
-                        return False
-
-                    if 'memlimit' not in limit:
-                        return False
+                        limit['timelimit'] = max(int(limit['timelimit']), 0)
+                        limit['memlimit'] = max(int(limit['memlimit']) * 1024, 0)
+                    except (ValueError, KeyError):
+                        continue
 
-                    try:
-                        int(limit['memlimit'])
-                    except ValueError:
-                        return False
+                    new_limits[comp_type] = limit
 
-                    return True
-
-                limits = { comp_type:limit for comp_type, limit in limits.items() if _check(comp_type, limit) }
-                if 'default' not in limits:
+                if 'default' not in new_limits:
                     self.error('Eparam')
                     return
 
-                for _, limit in limits.items():
-                    limit['timelimit'] = int(limit['timelimit'])
-                    limit['memlimit'] = int(limit['memlimit']) * 1024
-
-                    if limit['timelimit'] < 0:
-                        limit['timelimit'] = 0
-
-                    if limit['memlimit'] < 0:
-                        limit['memlimit'] = 0
-
-                pro['testm_conf']['limit'] = limits
+                pro['testm_conf']['limit'] = new_limits
                 await ProService.inst.update_test_config(pro_id, pro['testm_conf'])
 
                 await LogService.inst.add_log(
                     f"{self.acct.name} has sent a request to update the problem #{pro_id}",
                     'manage.pro.update.limit',
                     {
-                        'limits': limits
+                        'limits': new_limits
                     }
                 )
 
@@ -999,11 +979,14 @@ def _check(comp_type, limit):
                 self.error(err)
                 return
 
+            log_type = ""
             async with self.db.acquire() as con:
                 if is_all_chal:
                     sql = ""
+                    log_type = "manage.chal.rechalall"
                 else:
                     sql = '''AND "challenge_state"."chal_id" IS NULL'''
+                    log_type = "manage.chal.rechal"
                 result = await con.fetch(
                     f'''
                         SELECT "challenge"."chal_id", "challenge"."compiler_type" FROM "challenge"
@@ -1015,7 +998,7 @@ def _check(comp_type, limit):
                 )
             await LogService.inst.add_log(
                 f"{self.acct.name} made a request to rejudge the problem #{pro_id} with {len(result)} chals",
-                'manage.chal.rechal',
+                log_type,
             )
 
             # TODO: send notify to user

src/services/pro.py

@@ -339,19 +339,37 @@ async def unpack_pro(self, pro_id, pack_type, pack_token):
 
             check_type = self._get_check_type(conf["check"])
 
-            ALLOW_COMPILERS = list(ChalConst.ALLOW_COMPILERS) + ['default']
+            ALLOW_COMPILERS = set(list(ChalConst.ALLOW_COMPILERS) + ['default'])
             if is_makefile:
-                ALLOW_COMPILERS = ['default', 'gcc', 'g++', 'clang', 'clang++']
+                ALLOW_COMPILERS = {'default', 'gcc', 'g++', 'clang', 'clang++'}
 
             if "limit" in conf:
-                limit = {lang: lim for lang, lim in conf["limit"].items() if lang in ALLOW_COMPILERS}
+                limits = {}
+                for comp_type, limit in conf["limit"].items():
+                    if comp_type not in ALLOW_COMPILERS:
+                        continue
+
+                    try:
+                        limit['timelimit'] = max(int(limit['timelimit']), 0)
+                        limit['memlimit'] = max(int(limit['memlimit']) * 1024, 0)
+                    except (ValueError, KeyError):
+                        continue
+
+                    limits[comp_type] = limit
+
+                if 'default' not in limits:
+                    return "Econf", None
+
             elif 'timelimit' in conf and 'memlimit' in conf:
-                limit = {
-                    'default': {
-                        'timelimit': conf["timelimit"],
-                        'memlimit': conf["memlimit"] * 1024
+                try:
+                    limits = {
+                        'default': {
+                            'timelimit': int(conf["timelimit"]),
+                            'memlimit': int(conf["memlimit"]) * 1024
+                        }
                     }
-                }
+                except ValueError:
+                    return "Econf", None
             else:
                 return "Econf", None
 
@@ -363,7 +381,7 @@ async def unpack_pro(self, pro_id, pack_type, pack_token):
                 await con.execute('DELETE FROM "test_config" WHERE "pro_id" = $1;', int(pro_id))
                 await con.execute(
                     'UPDATE "problem" SET is_makefile = $1, check_type = $2, chalmeta = $3, "limit" = $4 WHERE pro_id = $5',
-                    is_makefile, check_type, json.dumps(chalmeta), json.dumps(limit), pro_id
+                    is_makefile, check_type, json.dumps(chalmeta), json.dumps(limits), pro_id
                 )
 
                 insert_sql = []

src/static/index.js

@@ -368,5 +368,11 @@ var index = new function() {
         }
 	    return new WebSocket(ws_link);
     };
+
+    that.unescape_html = function(html) {
+        const parser = new DOMParser();
+        const doc = parser.parseFromString(text, 'text/html');
+        return doc.documentElement.textContent;
+    };
 };
 

src/static/templ/acct/proclass-update.html

@@ -2,7 +2,7 @@
     function init() {
         let j_form = $("#form");
         let re = /[^0-9,\ ]/;
-        j_form.find("#desc").val(`{% raw proclass['desc'].replace('`', '\\`').replace('\\', '\\\\') %}`);
+        j_form.find("#desc").val(index.unescape_html(`{{ markdown_escape(proclass['desc']) }}`));
 
         let desc_textarea = document.getElementById('desc');
         let desc_preview = document.getElementById('descPreviewDialog');

src/static/templ/acct/profile.html

@@ -1,3 +1,4 @@
+{% from services.chal import ChalConst %}
 <style>
     #cover {
         height: 512px;
@@ -124,32 +125,24 @@ <h3>基本情報</h3>
     <div class="col-lg-9">
         <table class="table" style="font-size: 130%;" border="1px" bordercolor="gray">
             <tbody>
-                {% set count = 0 %}
-                {% for pro in prolist%}
-                    {% if count == 10 %}
-                    </tr>
-                    {% set count = 0 %}
-                    {% end %}
-                    {% if count == 0 %}
+                {% for chunk in prolist %}
                     <tr>
+                    {% for cnt, pro in enumerate(chunk, start=1) %}
+                        {% if pro['state'] is None %}
+                            <td class="_state"><a class="_state-4" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
+                        {% elif pro['state'] == ChalConst.STATE_AC %}
+                            <td class="_state"><a class="_state-1" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
+                        {% elif pro['state'] in [ChalConst.STATE_PC, ChalConst.STATE_WA] and pro['score'] > 0 %}
+                            <td class="_state"><a class="_state-2" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
+                        {% else %}
+                            <td class="_state"><a class="_state-3" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
+                        {% end %}
                     {% end %}
-                    {% if pro['score'] == 100 %}
-                    <td class="_state"><a class="_state-1" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
-                    {% elif pro['score'] == -1 %}
-                    <td class="_state"><a class="_state-4" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
-                    {% elif pro['score'] >= 50 %}
-                    <td class="_state"><a class="_state-2" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
-                    {% else %}
-                    <td class="_state"><a class="_state-3" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
+                    </tr>
+                    {% while cnt != 10 %}
+                        <td></td>
+                        {% set cnt = cnt + 1 %}
                     {% end %}
-                {% set count = count + 1 %}
-                {% end %}
-                {%if count != 10%}
-                {% while count != 10 %}
-                    <td></td>
-                    {% set count = count + 1 %}
-                {% end %}
-                </tr>
                 {% end %}
 	        </tbody>
        </table>

src/static/templ/bulletin.html

@@ -1,9 +1,9 @@
 <script>
     function init() {
-        let desc_tex = `{% raw bulletin['content'].replace('\\', '\\\\').replace('`', '\\`') %}`
+        let desc_tex = `{{ markdown_escape(bulletin['content']) }}`;
 
         let descEle = document.getElementById('content');
-        descEle.innerHTML = DOMPurify.sanitize(marked.parse(desc_tex));
+        descEle.innerHTML = DOMPurify.sanitize(marked.parse(index.unescape_html(desc_tex)));
         MathJax.Hub.Queue(["Typeset",MathJax.Hub, descEle]);
     }
 </script>

src/static/templ/challist.html

@@ -209,6 +209,7 @@
     </div>
 
     <div class="col-lg-10 col-12">
+        <div class="table-responsive">
         <table id="challist" class="table table-striped table-hover table-sm table-responsive-sm col mx-lg-3">
             <thead>
                 <tr>
@@ -249,6 +250,7 @@
             {% end %}
             </tbody>
         </table>
+        </div>
 
         {% from tornado.escape import url_escape %}
 

src/static/templ/contests/info.html

@@ -2,15 +2,15 @@
 <script>
     function init() {
         {% if not contest.is_start() %}
-            let desc_tex = `{% raw contest.desc_before_contest.replace('\\', '\\\\').replace('`', '\\`') %}`;
+            let desc_tex = `{{ markdown_escape(contest.desc_before_contest) }}`;
         {% elif contest.is_running() %}
-            let desc_tex = `{% raw contest.desc_during_contest.replace('\\', '\\\\').replace('`', '\\`') %}`;
+            let desc_tex = `{{ markdown_escape(contest.desc_during_contest) }}`;
         {% elif contest.is_end() %}
-            let desc_tex = `{% raw contest.desc_after_contest.replace('\\', '\\\\').replace('`', '\\`') %}`;
+            let desc_tex = `{{ markdown_escape(contest.desc_after_contest) }}`;
         {% end %}
 
         let descEle = document.getElementById('desc');
-        descEle.innerHTML = DOMPurify.sanitize(marked.parse(desc_tex));
+        descEle.innerHTML = DOMPurify.sanitize(marked.parse(index.unescape_html(desc_tex)));
         MathJax.Hub.Queue(["Typeset",MathJax.Hub, descEle]);
     }
 </script>

src/static/templ/contests/manage/desc-edit.html

@@ -7,9 +7,9 @@
         let desc_preview = document.getElementById('descPreviewDialog');
         let desc_preview_modal = new bootstrap.Modal(desc_preview);
 
-        let desc_before_contest = `{% raw contest.desc_before_contest.replace('\\', '\\\\').replace('`', '\\`') %}`;
-        let desc_during_contest = `{% raw contest.desc_during_contest.replace('\\', '\\\\').replace('`', '\\`') %}`;
-        let desc_after_contest = `{% raw contest.desc_after_contest.replace('\\', '\\\\').replace('`', '\\`') %}`;
+        let desc_before_contest = index.unescape_html(`{{ markdown_escape(contest.desc_before_contest) }}`);
+        let desc_during_contest = index.unescape_html(`{{ markdown_escape(contest.desc_during_contest) }}`);
+        let desc_after_contest = index.unescape_html(`{{ markdown_escape(contest.desc_after_contest) }}`);
 
         let cur_desc_type = 'before';
         const is_unsaved = () => {
@@ -128,4 +128,4 @@ <h2>Preview Markdown Render</h2>
 </div>
 
 
-{% end %}
+{% end %}

src/static/templ/index.html

@@ -20,7 +20,7 @@
     crossorigin="anonymous" referrerpolicy="no-referrer"></script>
   <script src="/oj/index.js"></script>
   <script src="/oj/pack.js"></script>
-  <script src="/oj/third/pdf.min.js" defer=""></script>
+  <script type="module"> import pdfjsDist from 'https://cdn.jsdelivr.net/npm/[email protected]/+esm' </script>
   <script src="/oj/third/mathjax/MathJax.js?config=TeX-AMS-MML_HTMLorMML" async></script>
   <script type="text/x-mathjax-config">
     MathJax.Hub.Config({

src/static/templ/log.html

@@ -9,4 +9,4 @@
 <p>{{ log['message'] }}</p>
 
 <label for="" class="form-control">Params</label>
-<p style="white-space: pre-wrap;">{% raw log['params'] %}</p>
+<p style="white-space: pre-wrap;">{{ json.dumps(log['params'], indent=4) }}</p>

src/static/templ/manage/bulletin/update.html

@@ -5,7 +5,7 @@
     function init() {
         // TODO: 有更改尚未儲存跳個通知出來
         let j_form = $("#form");
-        j_form.find("#content").val(`{% raw bulletin['content'].replace('`', '\\`').replace('\\', '\\\\') %}`);
+        j_form.find("#content").val(index.unescape_html(`{{ markdown_escape(bulletin['content']) }}`));
 
         let content_textarea = document.getElementById('content');
         let desc_preview = document.getElementById('descPreviewDialog');

src/static/templ/manage/proclass/update.html

@@ -6,7 +6,7 @@
         let j_form = $("#form");
         let re = /[^0-9,\ ]/;
 
-        j_form.find("#desc").val(`{% raw proclass['desc'].replace('`', '\\`').replace('\\', '\\\\') %}`);
+        j_form.find("#desc").val(index.unescape_html(`{{ markdown_escape(proclass['desc']) }}`));
 
         let desc_textarea = document.getElementById('desc');
         let desc_preview = document.getElementById('descPreviewDialog');