Remove user script

judge/admin/profile.py

@@ -71,7 +71,6 @@ class ProfileAdmin(VersionAdmin):
         "is_banned_problem_voting",
         "notes",
         "is_totp_enabled",
-        "user_script",
         "current_contest",
     )
     readonly_fields = ("user",)
@@ -160,15 +159,6 @@ class ProfileAdmin(VersionAdmin):
 
     recalculate_points.short_description = _("Recalculate scores")
 
-    def get_form(self, request, obj=None, **kwargs):
-        form = super(ProfileAdmin, self).get_form(request, obj, **kwargs)
-        if "user_script" in form.base_fields:
-            # form.base_fields['user_script'] does not exist when the user has only view permission on the model.
-            form.base_fields["user_script"].widget = AceWidget(
-                "javascript", request.profile.ace_theme
-            )
-        return form
-
 
 class UserAdmin(OldUserAdmin):
     # Customize the fieldsets for adding and editing users

judge/fixtures/demo.json

@@ -19,7 +19,6 @@
             "rating": null,
             "timezone": "America/Toronto",
             "user": 1,
-            "user_script": ""
         },
         "model": "judge.profile",
         "pk": 1

judge/forms.py

@@ -78,12 +78,10 @@ class ProfileForm(ModelForm):
             "timezone",
             "language",
             "ace_theme",
-            "user_script",
             "profile_image",
             "css_background",
         ]
         widgets = {
-            "user_script": AceWidget(theme="github"),
             "timezone": Select2Widget(attrs={"style": "width:200px"}),
             "language": Select2Widget(attrs={"style": "width:200px"}),
             "ace_theme": Select2Widget(attrs={"style": "width:200px"}),

judge/migrations/0178_remove_user_script.py

@@ -0,0 +1,17 @@
+# Generated by Django 3.2.18 on 2024-01-14 01:04
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("judge", "0177_test_formatter"),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name="profile",
+            name="user_script",
+        ),
+    ]

judge/models/profile.py

@@ -207,13 +207,6 @@ class Profile(models.Model):
         default=False,
     )
     rating = models.IntegerField(null=True, default=None, db_index=True)
-    user_script = models.TextField(
-        verbose_name=_("user script"),
-        default="",
-        blank=True,
-        max_length=65536,
-        help_text=_("User-defined JavaScript for site customization."),
-    )
     current_contest = models.OneToOneField(
         "ContestParticipation",
         verbose_name=_("current contest"),

judge/user_log.py

@@ -24,6 +24,5 @@ class LogUserAccessMiddleware(object):
                 updates["ip"] = request.META.get(settings.META_REMOTE_ADDRESS_KEY)
             Profile.objects.filter(user_id=request.user.pk).update(**updates)
             cache.set(f"user_log_update_{request.user.id}", True, 120)
-            print("UPDATE", updates)
 
         return response

templates/base.html

@@ -374,11 +374,6 @@
         {{ misc_config.analytics|safe }}
       {% endif %}
 
-      {# Don't run userscript since it may be malicious #}
-      {% if request.user.is_authenticated and request.profile.user_script and not request.user.is_impersonate %}
-        <script type="text/javascript">{{ request.profile.user_script|safe }}</script>
-      {% endif %}
-
       <div id="extra_js">
         {% block extra_js %}{% endblock %}
       </div>

templates/user/edit-profile.html

@@ -57,13 +57,6 @@
 {% block js_media %}
   {% include "timezone/media-js.html" %}
   {{ form.media.js }}
-  <script type="text/javascript">
-    $(function () {
-      $('#ace_user_script').on('ace_load', function (e, editor) {
-        editor.getSession().setMode("ace/mode/javascript");
-      });
-    });
-  </script>
   <script type="text/javascript">
     $(function () {
       $('#disable-2fa-button').click(function () {
@@ -177,10 +170,6 @@
       {{ form.css_background }}
       <div><i>{{form.css_background.help_text}}</i></div>
       <br><br>
-      <div class="block-header">{{ _('User-script') }}:</div>
-      {{ form.user_script }}
-      <hr>
-
       <input type="submit" style="float:right" value="{{ _('Update profile') }}">
     </form>
   </div>