From 57167211da74cc7faf636c25b954c102ea973363 Mon Sep 17 00:00:00 2001
From: Nicky Gerritsen <github@accounts.nickygerritsen.nl>
Date: Sat, 27 Sep 2025 12:11:29 +0200
Subject: [PATCH] Do not expose submission data for hidden teams on public
 scoreboard

---
 webapp/src/Controller/PublicController.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/webapp/src/Controller/PublicController.php b/webapp/src/Controller/PublicController.php
index 80a92f28a0..27b3308b75 100644
--- a/webapp/src/Controller/PublicController.php
+++ b/webapp/src/Controller/PublicController.php
@@ -330,11 +330,15 @@ public function submissionsDataAction(Request $request, ?string $teamId, ?string
         }
 
         $scoreboard = $this->scoreboardService->getScoreboard($contest);
+        $teamIds = array_map(fn(Team $team) => $team->getTeamid(), $scoreboard->getTeamsInDescendingOrder());
 
         /** @var Submission[] $submissions */
         $submissions = $this->submissionService->getSubmissionList(
             [$contest->getCid() => $contest],
-            restrictions: new SubmissionRestriction(valid: true),
+            restrictions: new SubmissionRestriction(
+                teamIds: $teamIds,
+                valid: true,
+            ),
             paginated: false
         )[0];