diff --git a/.gitignore b/.gitignore
--- a/.gitignore
+++ b/.gitignore
@@ -27,3 +27,7 @@
 #ignore .orig and .swp
 *.orig
 *.swp
+
+#ignore rvm setting file
+.ruby-gemset
+.ruby-version
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -6,6 +6,12 @@
   SINGLE_USER_MODE_CONF_KEY = 'system.single_user_mode'
   MULTIPLE_IP_LOGIN_CONF_KEY = 'right.multiple_ip_login'
 
+  #report and redirect for unauthorized activities
+  def unauthorized_redirect
+    flash[:notice] = 'You are not authorized to view the page you requested'
+    redirect_to :controller => 'main', :action => 'login'
+  end
+
   # Returns the current logged-in user (if any).
   def current_user
     return nil unless session[:user_id]
@@ -16,8 +22,7 @@
     return false unless authenticate
     user = User.find(session[:user_id], :include => ['roles'])
     unless user.admin?
-      flash[:notice] = 'You are not authorized to view the page you requested'
-      redirect_to :controller => 'main', :action => 'login' unless user.admin?
+      unauthorized_redirect
       return false
     end
     return true
@@ -27,8 +32,7 @@
     return false unless authenticate
     user = User.find(session[:user_id])
     unless user.roles.detect { |role| allowed_roles.member?(role.name) }
-      flash[:notice] = 'You are not authorized to view the page you requested'
-      redirect_to :controller => 'main', :action => 'login'
+      unauthorized_redirect
       return false
     end
   end
diff --git a/app/controllers/graders_controller.rb b/app/controllers/graders_controller.rb
--- a/app/controllers/graders_controller.rb
+++ b/app/controllers/graders_controller.rb
@@ -2,13 +2,20 @@
 
   before_filter :admin_authorization, except: [ :submission ]
   before_filter(only: [:submission]) {
+    #check if authenticated
     return false unless authenticate
 
-    if GraderConfiguration["right.user_view_submission"]
-      return true;
+    #admin always has privileged
+    if @current_user.admin?
+      return true
     end
 
-    admin_authorization
+    if GraderConfiguration["right.user_view_submission"] and Submission.find(params[:id]).problem.available?
+      return true
+    else
+      unauthorized_redirect
+      return false
+    end
   }
 
   verify :method => :post, :only => ['clear_all', 
diff --git a/app/controllers/report_controller.rb b/app/controllers/report_controller.rb
--- a/app/controllers/report_controller.rb
+++ b/app/controllers/report_controller.rb
@@ -12,6 +12,45 @@
     admin_authorization
   }
 
+  def show_max_score
+  end
+
+  def get_max_score
+    #process list of problems
+
+    #process submission range
+    if params[:commit] == 'download csv'
+      @problems = Problem.all
+    else
+      @problems = Problem.find_available_problems
+    end
+    @users = User.find(:all, :include => [:contests, :contest_stat])
+    @scorearray = Array.new
+    #set up range from param
+    since_id = params.fetch(:since_id, 0).to_i
+    until_id = params.fetch(:until_id, 0).to_i
+    @users.each do |u|
+      ustat = Array.new
+      ustat[0] = u
+      @problems.each do |p|
+        max_points = 0
+        Submission.find_in_range_by_user_and_problem(u.id,p.id,since_id,until_id).each do |sub|
+          max_points = sub.points if sub and sub.points and (sub.points > max_points)
+        end
+        ustat << [(max_points.to_f*100/p.full_score).round, (max_points>=p.full_score)]
+      end
+      @scorearray << ustat
+    end
+
+    if params[:commit] == 'download csv' then
+      csv = gen_csv_from_scorearray(@scorearray,@problems)
+      send_data csv, filename: 'max_score.csv'
+    else
+      render template: 'user_admin/user_stat'
+    end
+
+  end
+
   def score
     if params[:commit] == 'download csv'
       @problems = Problem.all
diff --git a/app/views/report/max_score.html.haml b/app/views/report/max_score.html.haml
new file mode 100644
--- /dev/null
+++ b/app/views/report/max_score.html.haml
@@ -0,0 +1,43 @@
+%h1 Maximum score
+
+= form_tag report_max_score_path
+.row
+  .col-md-4
+    .panel.panel-primary
+      .panel-heading
+        Problems
+      .panel-body
+        = label_tag :problems, "Problems"
+        = select 'problems', 'problem_id', [[(t 'main.specified_in_header'),'-1']] + Problem.all.collect {|p| ["[#{p.name}] #{p.full_name}", p.id]}, {:selected => '-1'}, { class: 'select2 form-control' }
+  .col-md-4
+    .panel.panel-primary
+      .panel-heading
+        Submission range
+      .panel-body
+        .form-group
+          = label_tag :from, "From"
+          = text_field_tag 'from_id', nil, class: "form-control"
+        .form-group
+          = label_tag :from, "To"
+          = text_field_tag 'to_id', nil, class: "form-control"
+  .col-md-4
+    .panel.panel-primary
+      .panel-heading
+        Users
+      .panel-body
+        .radio
+          %label
+            = radio_button_tag 'users', 'all', true
+            All users
+        .radio
+          %label
+            = radio_button_tag 'users', 'enabled'
+            Only enabled users
+.row
+  .col-md-12
+    = button_tag 'Show', class: "btn btn-primary btn-large"
+    = button_tag 'Download CSV', class: "btn btn-primary btn-large"
+  /.col-md-4.col-md-offset-1
+  /  = button_tag 'Show', class: "btn btn-primary btn-block"
+  /.col-md-4.col-md-offset-2
+  /  = button_tag 'Download CSV', class: "btn btn-primary btn-block"
diff --git a/config/routes.rb b/config/routes.rb
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -51,9 +51,11 @@
   #report
   get 'report/problem_hof(/:id)', to: 'report#problem_hof', as: 'report_problem_hof'
   get "report/login"
+  get 'report/max_score', to: 'report#max_score', as: 'report_max_score'
 
   #grader
   get 'graders/list', to: 'graders#list', as: 'grader_list'
+  
 
   match 'heartbeat/:id/edit' => 'heartbeat#edit'