backend: check the team has access to the exercice/flag before doing the action

libfic/flag_key.go

@@ -266,3 +266,13 @@ func (k FlagKey) Check(v interface{}) int {
 func (k FlagKey) FoundBy(t Team) {
 	DBExec("INSERT INTO flag_found (id_flag, id_team, time) VALUES (?, ?, ?)", k.Id, t.Id, time.Now())
 }
+
+// GetExercice returns the parent Exercice where this flag can be found.
+func (k FlagKey) GetExercice() (Exercice, error) {
+	var eid int64
+	if err := DBQueryRow("SELECT id_exercice FROM exercice_flags WHERE id_flag = ?", k.Id).Scan(&eid); err != nil {
+		return Exercice{}, err
+	}
+
+	return GetExercice(eid)
+}