From 8e24c7d7f1f1e67d435b0aa6e6645d51a2e4dd3a Mon Sep 17 00:00:00 2001
From: Pisces000221 <1786762946@qq.com>
Date: Sat, 4 Nov 2017 12:13:10 +0800
Subject: [PATCH] Fix subs of hidden contests accessible via URL

---
 modules/submission.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/submission.js b/modules/submission.js
index 2fe1aaa..51d4655 100644
--- a/modules/submission.js
+++ b/modules/submission.js
@@ -54,7 +54,7 @@ app.get('/submissions', async (req, res) => {
       const contestId = Number(req.query.contest);
       const contest = await Contest.fromID(contestId);
       contest.ended = contest.isEnded();
-      if (contest.ended || // If the contest is ended
+      if ((contest.ended && contest.is_public) || // If the contest is ended and is not hidden
         (curUser && await contest.isSupervisior(curUser)) // Or if the user have the permission to check
       ) {
         where.type = { $eq: 1 };