From 8d91a3fa8d20817a9c2971caa267d0d6a59a2d25 Mon Sep 17 00:00:00 2001
From: Kevin Chung <kchung@ctfd.io>
Date: Sat, 8 Jun 2019 01:00:28 -0400
Subject: [PATCH] Fix hidden pages not being able to load (#1019)

* Fixes bug where pages marked as `hidden` weren't loading
    * It's possible that some users used this behavior however this fix implements the correct behavior. The `draft` setting can be used to completely hide pages.
---
 CTFd/utils/config/pages.py |  2 +-
 tests/test_views.py        | 28 ++++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/CTFd/utils/config/pages.py b/CTFd/utils/config/pages.py
index 98a11b19..f8d9a362 100644
--- a/CTFd/utils/config/pages.py
+++ b/CTFd/utils/config/pages.py
@@ -13,5 +13,5 @@ def get_pages():
 @cache.memoize()
 def get_page(route):
     return Pages.query.filter(
-        Pages.route == route, Pages.draft.isnot(True), Pages.hidden.isnot(True)
+        Pages.route == route, Pages.draft.isnot(True)
     ).first()
diff --git a/tests/test_views.py b/tests/test_views.py
index 1655ba5f..1f6a0f36 100644
--- a/tests/test_views.py
+++ b/tests/test_views.py
@@ -13,7 +13,9 @@ from tests.helpers import (
     gen_file,
     gen_page,
 )
+from CTFd.cache import clear_pages
 from CTFd.utils import set_config
+from CTFd.utils.config.pages import get_pages
 from CTFd.utils.encoding import hexencode
 from freezegun import freeze_time
 
@@ -89,6 +91,32 @@ def test_page_requiring_auth():
     destroy_ctfd(app)
 
 
+def test_hidden_pages():
+    """Test that hidden pages aren't on the navbar but can be loaded"""
+    app = create_ctfd()
+    with app.app_context():
+        page = gen_page(
+            app.db,
+            title="HiddenPageTitle",
+            route="this-is-a-hidden-route",
+            content="This is some HTML",
+            hidden=True,
+        )
+        clear_pages()
+        assert page not in get_pages()
+
+        with app.test_client() as client:
+            r = client.get("/")
+            assert r.status_code == 200
+            assert "HiddenPageTitle" not in r.get_data(as_text=True)
+
+        with app.test_client() as client:
+            r = client.get("/this-is-a-hidden-route")
+            assert r.status_code == 200
+            assert "This is some HTML" in r.get_data(as_text=True)
+    destroy_ctfd(app)
+
+
 def test_not_found():
     """Should return a 404 for pages that are not found"""
     app = create_ctfd()