feat: 대회 내 질문 커뮤니티 추가 및 권한/버그 수정 - #753
Conversation
# Conflicts: # backend/account/decorators.py # backend/community/tests.py # backend/community/views/oj.py # frontend/src/pages/oj/views/contest/children/ContestCommunity.vue
taekoong
added
frontend-client
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 53a7f0a750
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| try: | ||
| # Always reload with visible=True so preloaded contests cannot bypass soft-delete visibility. | ||
| self.contest = Contest.objects.select_related("created_by").get(id=contest_id, visible=True) |
There was a problem hiding this comment.
When an endpoint has already derived self.contest from a post or comment, this reload still uses a caller-supplied contest_id from the request first. A user can therefore request a participant-visible post in a password-protected or otherwise inaccessible contest while supplying the ID of a contest they can access; the decorator validates the unrelated contest, and can_view_post then permits the actual post. Re-query the preloaded contest with visible=True, or reject a supplied ID that does not match it.
Useful? React with 👍 / 👎.
wlsgur11
left a comment
wlsgur11
left a comment
There was a problem hiding this comment.
- 숨긴 대회 글 훔쳐보기가 가능한가요?
- 글 볼 때 대회 보는 권한을 얻을 때 주소에 적힌 대회 번호로 확인하는지, 그 글이 실제로 속한 대회로 확인하는지 궁금합니다. 전자라면 내가 볼 수 있는 대회 번호를 넣고 숨긴 대회 글 번호 요청하면 뚫릴 것 같아욥
- 대회 번호 자리에 텍스트 넣으면 500예상
- 예외처리 부탁쓰 ㅋ
Changelog
→ 항상 visible=True 조건으로 재조회하도록 변경 (soft-delete/비공개 처리된 대회를 우회 접근하는 경로 차단)
→ 서버에 is_mine 파라미터를 보내 서버 사이드에서 필터링하도록 변경 (페이지네이션과 무관하게 정확한 결과 반환)
Testing
develop 머지 후 충돌 4개 파일(account/decorators.py, community/tests.py, community/views/oj.py, ContestCommunity.vue) 모두 본 브랜치 버전으로 해결, Python 문법 체크(py_compile) 통과 확인
Ops Impact
N/A
Version Compatibility
N/A