From a7fb5a7d9e330d019262db9e9ea2b01c3fc9e805 Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Tue, 10 Jul 2018 13:47:26 +0200
Subject: [PATCH] Only show submission form if authorized

---
 src/Handler/Submission.hs   | 5 ++++-
 templates/submission.hamlet | 7 ++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/Handler/Submission.hs b/src/Handler/Submission.hs
index 130bfaa73..1f0d3c5a4 100644
--- a/src/Handler/Submission.hs
+++ b/src/Handler/Submission.hs
@@ -246,6 +246,8 @@ submissionHelper tid csh shn (SubmissionMode mcid) = do
     Nothing  -> return ()
 
   actionUrl <- Data.Maybe.fromJust <$> getCurrentRoute
+  maySubmit <- (== Authorized) <$> isAuthorized actionUrl True
+
   -- Maybe construct a table to display uploaded archive files
   let colonnadeFiles :: _ -> Colonnade Sortable _ (DBCell (WidgetT UniWorX IO) ())
       colonnadeFiles cid = mconcat
@@ -355,7 +357,8 @@ getSubArchiveR tid csh shn cID@CryptoID{..} (ZIPArchiveName sfType) = do
 
       fileSource' = do
         fileSource .| Conduit.map entityVal
-        maybe (return ()) (yieldM . ratingFile cID) rating
+        when (sfType == SubmissionCorrected) $
+          maybe (return ()) (yieldM . ratingFile cID) rating
 
       zipComment = Text.encodeUtf8 . pack $ CI.foldedCase ciphertext
 
diff --git a/templates/submission.hamlet b/templates/submission.hamlet
index 1672ee052..e2c77382d 100644
--- a/templates/submission.hamlet
+++ b/templates/submission.hamlet
@@ -12,6 +12,7 @@ $maybe cID <- mcid
       <h3>_{MsgSubmissionFiles}
       ^{fileTable}
 
-<section>
-  <form .form-horizontal method=post action=@{actionUrl} enctype=#{formEnctype}>
-   ^{formWidget}
+$if maySubmit
+  <section>
+    <form .form-horizontal method=post action=@{actionUrl} enctype=#{formEnctype}>
+      ^{formWidget}