aljaz/CTFd
1
0
Fork 0
mirror of https://github.com/aljazceru/CTFd.git synced 2025-12-17 22:14:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix freeze time regressions (#989)

Browse Source 
* Fix freeze time regressions in 2.x
* Make `/api/v1/[users,teams]/[me,id]/[solves,fails,awards]` endpoints load as admin to load all rows and bypass freeze
    * Closes #988
* Make `/api/v1/challenges/[id]/solves` respect freeze time. `/api/v1/challenges/[id]/solves?preview=true` is exposed for admins to see solves as a user would. 
    * Closes #986
This commit is contained in:
Kevin Chung
2019-05-11 00:18:56 -04:00
committed by GitHub
parent b7a19f74ff
commit 3d23ece370
8 changed files with 321 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
CTFd/api/v1/users.py
View File

@@ -200,6 +200,7 @@ class UserSolves(Resource):
if not authed():
abort(403)
user = get_current_user()
solves = user.get_solves(admin=True)
else:
if accounts_visible() is False or scores_visible() is False:
abort(404)
@@ -207,12 +208,7 @@ class UserSolves(Resource):
if (user.banned or user.hidden) and is_admin() is False:
abort(404)
solves = user.get_solves(
admin=is_admin()
)
for solve in solves:
setattr(solve, 'value', 100)
solves = user.get_solves(admin=is_admin())
view = 'user' if not is_admin() else 'admin'
response = SubmissionSchema(view=view, many=True).dump(solves)
@@ -237,6 +233,7 @@ class UserFails(Resource):
if not authed():
abort(403)
user = get_current_user()
fails = user.get_fails(admin=True)
else:
if accounts_visible() is False or scores_visible() is False:
abort(404)
@@ -244,10 +241,7 @@ class UserFails(Resource):
if (user.banned or user.hidden) and is_admin() is False:
abort(404)
fails = user.get_fails(
admin=is_admin()
)
fails = user.get_fails(admin=is_admin())
view = 'user' if not is_admin() else 'admin'
response = SubmissionSchema(view=view, many=True).dump(fails)
@@ -280,6 +274,7 @@ class UserAwards(Resource):
if not authed():
abort(403)
user = get_current_user()
awards = user.get_awards(admin=True)
else:
if accounts_visible() is False or scores_visible() is False:
abort(404)
@@ -287,10 +282,7 @@ class UserAwards(Resource):
if (user.banned or user.hidden) and is_admin() is False:
abort(404)
awards = user.get_awards(
admin=is_admin()
)
awards = user.get_awards(admin=is_admin())
view = 'user' if not is_admin() else 'admin'
response = AwardSchema(view=view, many=True).dump(awards)