Oprava kontroly práv ke zpracování skenů

mo/web/org_contest.py

@@ -1718,6 +1718,9 @@ def org_contest_scans(ct_id: int, site_id: Optional[int] = None):
     round, contest, site = ctx.round, ctx.contest, ctx.site
     assert contest
 
+    if not ctx.rights.can_upload_feedback():
+        raise werkzeug.exceptions.Forbidden()
+
     sess = db.get_session()
 
     class PSF(ProcessScansForm):
@@ -1778,10 +1781,13 @@ class ScanProcessForm(FlaskForm):
 @app.route('/org/contest/c/<int:ct_id>/scans/<int:job_id>', methods=('GET', 'POST'))
 @app.route('/org/contest/c/<int:ct_id>/site/<int:site_id>/scans/<int:job_id>', methods=('GET', 'POST'))
 def org_contest_scans_process(ct_id: int, job_id: int, site_id: Optional[int] = None):
-    ctx = get_context(ct_id=ct_id, site_id=site_id, right_needed=Right.upload_solutions)
+    ctx = get_context(ct_id=ct_id, site_id=site_id)
     contest = ctx.contest
     assert contest
 
+    if not ctx.rights.can_upload_feedback():
+        raise werkzeug.exceptions.Forbidden()
+
     sess = db.get_session()
 
     # Získáme job a zkontrolujeme, že je to správný job a máme na něj práva