Don't reference undisclosed problems in clarifications before conteststart

vmcj · vmcj · commit c8c97ec84717 · 2025-10-27T13:34:53.000+01:00
diff --git a/webapp/src/Controller/API/ClarificationController.php b/webapp/src/Controller/API/ClarificationController.php
@@ -309,6 +309,14 @@ protected function getQueryBuilder(Request $request): QueryBuilder
             }
         }
 
+        // For non-API-reader users, only expose the problems after the contest has started.
+        // `WF Access Policy` allows for clarifications before the contest, but not to disclose the problem
+        // so referencing them in clarifications would violate referential integrity.
+        if (!$this->dj->checkrole('api_reader')) {
+            $queryBuilder->andWhere('c.starttime < :now OR clar.problem IS NULL')
+                ->setParameter('now', Utils::now());
+        }
+
         if ($request->query->has('problem')) {
             $queryBuilder
                 ->andWhere('clar.problem = :problem')

Original file line number	Diff line number	Diff line change
`@@ -309,6 +309,14 @@ protected function getQueryBuilder(Request $request): QueryBuilder`
`309`	`309`	`}`
`310`	`310`	`}`
`311`	`311`
	`312`	`+ // For non-API-reader users, only expose the problems after the contest has started.`
	`313`	+ // `WF Access Policy` allows for clarifications before the contest, but not to disclose the problem
	`314`	`+ // so referencing them in clarifications would violate referential integrity.`
	`315`	`+ if (!$this->dj->checkrole('api_reader')) {`
	`316`	`+ $queryBuilder->andWhere('c.starttime < :now OR clar.problem IS NULL')`
	`317`	`+ ->setParameter('now', Utils::now());`
	`318`	`+ }`
	`319`	`+`
`312`	`320`	`if ($request->query->has('problem')) {`
`313`	`321`	`$queryBuilder`
`314`	`322`	`->andWhere('clar.problem = :problem')`