Use opaque_id instead of encrypted submission id in functional test suite

Author: prandla

cms/server/admin/handlers/__init__.py

@@ -212,15 +212,15 @@
 
     # Submissions
 
-    (r"/submission/([0-9]+)(?:/([0-9]+))?", SubmissionHandler),
+    (r"/submission/((?:opaque_)?[0-9]+)(?:/([0-9]+))?", SubmissionHandler),
     (r"/submission/([0-9]+)(?:/([0-9]+))?/comment", SubmissionCommentHandler),
     (r"/submission/([0-9]+)(?:/([0-9]+))?/official", SubmissionOfficialStatusHandler),
     (r"/submission_file/([0-9]+)", SubmissionFileHandler),
     (r"/submission_diff/([0-9]+)/([0-9]+)", SubmissionDiffHandler),
 
     # User tests
 
-    (r"/user_test/([0-9]+)(?:/([0-9]+))?", UserTestHandler),
+    (r"/user_test/((?:opaque_)?[0-9]+)(?:/([0-9]+))?", UserTestHandler),
     (r"/user_test_file/([0-9]+)", UserTestFileHandler),
 
     # The following prefixes are handled by WSGI middlewares:

cms/server/admin/handlers/submission.py

@@ -30,6 +30,15 @@
 import logging
 import difflib
 
+import collections
+try:
+    collections.MutableMapping
+except:
+    # Monkey-patch: Tornado 4.5.3 does not work on Python 3.11 by default
+    collections.MutableMapping = collections.abc.MutableMapping
+
+import tornado.web
+
 from cms.db import Dataset, File, Submission
 from cms.grading.languagemanager import safe_get_lang_filename
 from cmscommon.datetime import make_datetime
@@ -47,8 +56,18 @@ class SubmissionHandler(BaseHandler):
 
     """
     @require_permission(BaseHandler.AUTHENTICATED)
-    def get(self, submission_id, dataset_id=None):
-        submission = self.safe_get_item(Submission, submission_id)
+    def get(self, submission_id: str, dataset_id=None):
+        if submission_id.startswith("opaque_"):
+            oid = int(submission_id.removeprefix("opaque_"))
+            submission = (
+                self.sql_session.query(Submission)
+                .filter(Submission.opaque_id == oid)
+                .first()
+            )
+            if submission is None:
+                raise tornado.web.HTTPError(404)
+        else:
+            submission = self.safe_get_item(Submission, submission_id)
         task = submission.task
         self.contest = task.contest
 

cms/server/admin/handlers/usertest.py

@@ -20,6 +20,15 @@
 
 """
 
+import collections
+try:
+    collections.MutableMapping
+except:
+    # Monkey-patch: Tornado 4.5.3 does not work on Python 3.11 by default
+    collections.MutableMapping = collections.abc.MutableMapping
+
+import tornado.web
+
 from cms.db import Dataset, UserTestFile, UserTest
 from cms.grading.languagemanager import safe_get_lang_filename
 
@@ -29,8 +38,18 @@
 class UserTestHandler(BaseHandler):
     """Shows the details of a user test."""
     @require_permission(BaseHandler.AUTHENTICATED)
-    def get(self, user_test_id, dataset_id=None):
-        user_test = self.safe_get_item(UserTest, user_test_id)
+    def get(self, user_test_id: str, dataset_id=None):
+        if user_test_id.startswith("opaque_"):
+            oid = int(user_test_id.removeprefix("opaque_"))
+            user_test = (
+                self.sql_session.query(UserTest)
+                .filter(UserTest.opaque_id == oid)
+                .first()
+            )
+            if user_test is None:
+                raise tornado.web.HTTPError(404)
+        else:
+            user_test = self.safe_get_item(UserTest, user_test_id)
         task = user_test.task
         self.contest = task.contest
 

cms/server/contest/handlers/tasksubmission.py

@@ -55,7 +55,6 @@
     UnacceptableSubmission, accept_submission
 from cms.server.contest.tokening import \
     UnacceptableToken, TokenAlreadyPlayed, accept_token, tokens_available
-from cmscommon.crypto import encrypt_number
 from cmscommon.mimetypes import get_type_for_file_name
 from .contest import ContestHandler, FileHandler, api_login_required
 from ..phase_management import actual_phase_required
@@ -109,11 +108,9 @@ def post(self, task_name):
             self.notify_success(N_("Submission received"),
                                 N_("Your submission has been received "
                                    "and is currently being evaluated."))
-            # The argument (encrypted submission id) is not used by CWS
-            # (nor it discloses information to the user), but it is
-            # useful for automatic testing to obtain the submission id).
-            query_args["submission_id"] = \
-                encrypt_number(submission.id, config.web_server.secret_key)
+            # The argument is not used by CWS, but it is useful for automatic
+            # testing to obtain the submission id.
+            query_args["submission_id"] = submission.opaque_id
 
         self.redirect(self.contest_url("tasks", task.name, "submissions",
                                        **query_args))

cms/server/contest/handlers/taskusertest.py

@@ -46,7 +46,6 @@
 from cms.server import multi_contest
 from cms.server.contest.submission import get_submission_count, \
     TestingNotAllowed, UnacceptableUserTest, accept_user_test
-from cmscommon.crypto import encrypt_number
 from cmscommon.mimetypes import get_type_for_file_name
 from .contest import ContestHandler, FileHandler, api_login_required
 from ..phase_management import actual_phase_required
@@ -152,11 +151,9 @@ def post(self, task_name):
             self.notify_success(N_("Test received"),
                                 N_("Your test has been received "
                                    "and is currently being executed."))
-            # The argument (encrypted user test id) is not used by CWS
-            # (nor it discloses information to the user), but it is
-            # useful for automatic testing to obtain the user test id).
-            query_args["user_test_id"] = \
-                encrypt_number(user_test.id, config.web_server.secret_key)
+            # The argument is not used by CWS, but it is useful for automatic
+            # testing to obtain the user test id.
+            query_args["user_test_id"] = user_test.opaque_id
 
         self.redirect(self.contest_url("testing", task_name=task.name,
                                        **query_args))

cmstestsuite/web/AWSRequests.py

@@ -48,7 +48,7 @@ class AWSSubmissionViewRequest(GenericRequest):
     def __init__(self, browser, submission_id, base_url=None):
         GenericRequest.__init__(self, browser, base_url)
         self.submission_id = submission_id
-        self.url = "%s/submission/%s" % (self.base_url, submission_id)
+        self.url = "%s/submission/opaque_%s" % (self.base_url, submission_id)
 
     def describe(self):
         return "check submission %s" % self.submission_id
@@ -105,7 +105,7 @@ class AWSUserTestViewRequest(GenericRequest):
     def __init__(self, browser, user_test_id, base_url=None):
         GenericRequest.__init__(self, browser, base_url)
         self.user_test_id = user_test_id
-        self.url = "%s/user_test/%s" % (self.base_url, user_test_id)
+        self.url = "%s/user_test/opaque_%s" % (self.base_url, user_test_id)
 
     def describe(self):
         return "check user_test %s" % self.user_test_id

cmstestsuite/web/CWSRequests.py

@@ -28,9 +28,7 @@
 import tempfile
 from urllib.parse import parse_qs, urlsplit
 
-from cms import config
 from cms.grading.languagemanager import filename_to_language
-from cmscommon.crypto import decrypt_number
 from cmstestsuite.web import GenericRequest, LoginRequest
 
 
@@ -160,13 +158,7 @@ def get_submission_id(self):
             logger.warning("Redirected to an unexpected page: `%s'",
                            self.redirected_to)
             return None
-        try:
-            submission_id = decrypt_number(query["submission_id"][0],
-                                           config.web_server.secret_key)
-        except Exception:
-            logger.warning("Unable to decrypt submission id from page: `%s'",
-                           self.redirected_to)
-            return None
+        submission_id = int(query["submission_id"][0])
         return submission_id
 
 
@@ -227,13 +219,7 @@ def get_user_test_id(self):
             logger.warning("Redirected to an unexpected page: `%s'",
                            self.redirected_to)
             return None
-        try:
-            user_test_id = decrypt_number(query["user_test_id"][0],
-                                          config.web_server.secret_key)
-        except Exception:
-            logger.warning("Unable to decrypt user test id from page: `%s'",
-                           self.redirected_to)
-            return None
+        user_test_id = int(query["user_test_id"][0])
         return user_test_id