Skip to content

Commit d54c96e

Browse files
committed
Prevent clarifications before the contest without explicit time
In the Jury UI we can warn with a flash message, for API we can't easily prevent automated tools from unintentionally disclosing the information. We provide both relevant times, either contest start or now to keep this easy to copy/paste. The format is already in the timezone of the contest to make sure validation passes. In theory this can still give problems in case you submit a clarification and afterwards the contest starts later, it's up to the contest admin to change the database in such cases as we don't have a reltime for clarifications.
1 parent 0071234 commit d54c96e

File tree

1 file changed

+12
-0
lines changed

1 file changed

+12
-0
lines changed

webapp/src/Controller/API/ClarificationController.php

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
use App\Entity\ContestProblem;
99
use App\Entity\Team;
1010
use App\Utils\Utils;
11+
use DateTime;
1112
use Doctrine\ORM\NonUniqueResultException;
1213
use Doctrine\ORM\QueryBuilder;
1314
use Exception;
@@ -208,6 +209,17 @@ public function addAction(
208209
} else {
209210
throw new BadRequestHttpException('A team can not assign time.');
210211
}
212+
} elseif ($this->isGranted('ROLE_API_WRITER') && $contest->getStartTime() > $time) {
213+
$startTime = $contest->getStarttimeString();
214+
$startTimeTimeZone = DateTime::createFromFormat('Y-m-d h:i:s e', $startTime)->getTimezone();
215+
$now = DateTime::createFromFormat('U.u', (string) $time);
216+
$now->setTimezone($startTimeTimeZone); // We can't the timezone in createFromFormat as it always picks UTC.
217+
throw new BadRequestHttpException(
218+
"Sending a clarification before the contest can disclose restricted information, "
219+
. "provide an explicit time when this clarification should be visible. "
220+
. "For the start of this contest: " . $contest->getStarttimeString() . ", "
221+
. "for the current time: " . $now->format('Y-m-d H:i:s e') . "."
222+
);
211223
}
212224

213225
$clarification->setSubmittime($time);

0 commit comments

Comments
 (0)