ui: checkPriv for setTheme

packages/ui-default/handler.ts

@@ -6,7 +6,7 @@ import { join } from 'path';
 import { ObjectID } from 'mongodb';
 import * as bus from 'hydrooj/src/service/bus';
 import { Route, Handler } from 'hydrooj/src/service/server';
-import { PERM } from 'hydrooj/src/model/builtin';
+import { PERM, PRIV } from 'hydrooj/src/model/builtin';
 import markdown from './backendlib/markdown';
 
 const {
@@ -88,6 +88,7 @@ class SetThemeHandler extends Handler {
   noCheckPermView = true;
 
   async get({ theme }) {
+    this.checkPriv(PRIV.PRIV_USER_PROFILE);
     await user.setById(this.user._id, { theme });
     this.back();
   }

packages/ui-default/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hydrooj/ui-default",
-  "version": "4.34.11",
+  "version": "4.34.12",
   "author": "undefined <i@undefined.moe>",
   "license": "AGPL-3.0",
   "main": "hydro.js",