diff --git a/CTFd/admin/teams.py b/CTFd/admin/teams.py index a35dedf0..60b4b1b9 100644 --- a/CTFd/admin/teams.py +++ b/CTFd/admin/teams.py @@ -64,13 +64,16 @@ def admin_create_team(): elif Teams.query.filter(Teams.name == name).first(): errors.append('That name is taken') + if utils.check_email_format(name) is True: + errors.append('Team name cannot be an email address') + if not email: errors.append('The team requires an email') elif Teams.query.filter(Teams.email == email).first(): errors.append('That email is taken') if email: - valid_email = re.match(r"(^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$)", email) + valid_email = utils.check_email_format(email) if not valid_email: errors.append("That email address is invalid") @@ -144,7 +147,7 @@ def admin_team(teamid): errors = [] if email: - valid_email = re.match(r"(^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$)", email) + valid_email = utils.check_email_format(email) if not valid_email: errors.append("That email address is invalid") @@ -152,6 +155,9 @@ def admin_team(teamid): if name_used and int(name_used.id) != int(teamid): errors.append('That name is taken') + if utils.check_email_format(name) is True: + errors.append('Team name cannot be an email address') + email_used = Teams.query.filter(Teams.email == email).first() if email_used and int(email_used.id) != int(teamid): errors.append('That email is taken') diff --git a/CTFd/auth.py b/CTFd/auth.py index 3fc1c789..e73471ba 100644 --- a/CTFd/auth.py +++ b/CTFd/auth.py @@ -86,7 +86,7 @@ def reset_password(data=None): except BadTimeSignature: return render_template('reset_password.html', errors=['Your link has expired']) except: - return render_template('reset_password.html', errors=['Your link appears broken, please try again.']) + return render_template('reset_password.html', errors=['Your link appears broken, please try again']) team = Teams.query.filter_by(name=name).first_or_404() team.password = bcrypt_sha256.encrypt(request.form['password'].strip()) db.session.commit() @@ -101,8 +101,20 @@ def reset_password(data=None): if request.method == 'POST': email = request.form['email'].strip() team = Teams.query.filter_by(email=email).first() + + errors = [] + + if utils.can_send_mail() is False: + return render_template( + 'reset_password.html', + errors=['Email could not be sent due to server misconfiguration'] + ) + if not team: - return render_template('reset_password.html', errors=['If that account exists you will receive an email, please check your inbox']) + return render_template( + 'reset_password.html', + errors=['If that account exists you will receive an email, please check your inbox'] + ) s = TimedSerializer(app.config['SECRET_KEY']) token = s.dumps(team.name) text = """ @@ -114,7 +126,10 @@ Did you initiate a password reset? utils.sendmail(email, text) - return render_template('reset_password.html', errors=['If that account exists you will receive an email, please check your inbox']) + return render_template( + 'reset_password.html', + errors=['If that account exists you will receive an email, please check your inbox'] + ) return render_template('reset_password.html') @@ -134,12 +149,15 @@ def register(): emails = Teams.query.add_columns('email', 'id').filter_by(email=email).first() pass_short = len(password) == 0 pass_long = len(password) > 128 - valid_email = re.match(r"(^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$)", request.form['email']) + valid_email = utils.check_email_format(request.form['email']) + team_name_email_check = utils.check_email_format(name) if not valid_email: - errors.append("That email doesn't look right") + errors.append("Please enter a valid email address") if names: errors.append('That team name is already taken') + if team_name_email_check is True: + errors.append('Your team name cannot be an email address') if emails: errors.append('That email has already been used') if pass_short: @@ -196,7 +214,13 @@ def login(): if request.method == 'POST': errors = [] name = request.form['name'] - team = Teams.query.filter_by(name=name).first() + + # Check if the user submitted an email address or a team name + if utils.check_email_format(name) is True: + team = Teams.query.filter_by(email=name).first() + else: + team = Teams.query.filter_by(name=name).first() + if team: if team and bcrypt_sha256.verify(request.form['password'], team.password): try: diff --git a/CTFd/themes/original/templates/login.html b/CTFd/themes/original/templates/login.html index 2f276cb4..d7d5e008 100644 --- a/CTFd/themes/original/templates/login.html +++ b/CTFd/themes/original/templates/login.html @@ -36,7 +36,7 @@ diff --git a/CTFd/themes/original/templates/reset_password.html b/CTFd/themes/original/templates/reset_password.html index 1b32d830..e939fde0 100644 --- a/CTFd/themes/original/templates/reset_password.html +++ b/CTFd/themes/original/templates/reset_password.html @@ -19,6 +19,7 @@ {% endfor %} + {% if can_send_mail() %}
+ {% else %} +This CTF is not configured to send email.
+Please contact an organizer to have your password reset
+