aljaz/CTFd
1
0
Fork 0
mirror of https://github.com/aljazceru/CTFd.git synced 2025-12-17 14:04:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Properly hide users/teams if they are set to banned/hidden (#932)

Browse Source 
* Properly hide users/teams if they are set to hidden/banned
    * This should be in the API and in the main user panel. This should not affect admins. 
* Update tests to reflect this behavior.
This commit is contained in:
Kevin Chung
2019-04-04 22:44:18 -04:00
committed by GitHub
parent 268ed85f60
commit 7c60c697ee
10 changed files with 181 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
tests/teams/test_teams.py
View File

@@ -22,6 +22,27 @@ def test_teams_get():
destroy_ctfd(app)
def test_accessing_hidden_teams():
"""Hidden teams should not give any data from /teams or /api/v1/teams"""
app = create_ctfd(user_mode="teams")
with app.app_context():
register_user(app)
register_user(app, name="visible_user", email="visible_user@ctfd.io")
with login_as_user(app, name="visible_user") as client:
user = Users.query.filter_by(id=2).first()
team = gen_team(app.db, name='visible_team', hidden=True)
team.members.append(user)
user.team_id = team.id
app.db.session.commit()
assert client.get('/teams/1').status_code == 404
assert client.get('/api/v1/teams/1').status_code == 404
assert client.get('/api/v1/teams/1/solves').status_code == 404
assert client.get('/api/v1/teams/1/fails').status_code == 404
assert client.get('/api/v1/teams/1/awards').status_code == 404
destroy_ctfd(app)
def test_hidden_teams_visibility():
"""Hidden teams should not show up on /teams or /api/v1/teams or /api/v1/scoreboard"""
app = create_ctfd(user_mode="teams")