Improved Team Handling (#1713)

* Prevent team joining while already on a team
* Return 403 instead of 200 for team join/create errors
* Allow team captains whose teams haven't done anything to disband their team
* Closes #1588

tests/teams/test_auth.py

@@ -58,10 +58,47 @@ def test_teams_join_post():
                 }
             r = client.post("/teams/join", data=data)
             assert r.status_code == 302
+
+            # Cannot join a team with an incorrect password
             incorrect_data = data
             incorrect_data["password"] = ""
             r = client.post("/teams/join", data=incorrect_data)
+            assert r.status_code == 403
+    destroy_ctfd(app)
+
+
+def test_teams_join_when_already_on_team():
+    """Test that a user cannot join another team"""
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        gen_user(app.db, name="user")
+        gen_team(app.db, email="team1@ctfd.io", name="team1")
+        gen_team(app.db, email="team2@ctfd.io", name="team2")
+        with login_as_user(app) as client:
+            r = client.get("/teams/join")
             assert r.status_code == 200
+            with client.session_transaction() as sess:
+                data = {
+                    "name": "team1",
+                    "password": "password",
+                    "nonce": sess.get("nonce"),
+                }
+            r = client.post("/teams/join", data=data)
+            assert r.status_code == 302
+
+            # Try to join another team while on a team
+            r = client.get("/teams/join")
+            assert r.status_code == 200
+            with client.session_transaction() as sess:
+                data = {
+                    "name": "team2",
+                    "password": "password",
+                    "nonce": sess.get("nonce"),
+                }
+            r = client.post("/teams/join", data=data)
+            assert r.status_code == 403
+            user = Users.query.filter_by(name="user").first()
+            assert user.team.name == "team1"
     destroy_ctfd(app)
 
 
@@ -104,3 +141,72 @@ def test_team_join_ratelimited():
                 assert r.status_code == 429
                 assert Users.query.filter_by(id=2).first().team_id is None
     destroy_ctfd(app)
+
+
+def test_teams_new_get():
+    """Can a user get /teams/new"""
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        register_user(app)
+        with login_as_user(app) as client:
+            r = client.get("/teams/new")
+            assert r.status_code == 200
+    destroy_ctfd(app)
+
+
+def test_teams_new_post():
+    """Can a user post /teams/new"""
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        gen_user(app.db, name="user")
+        with login_as_user(app) as client:
+            with client.session_transaction() as sess:
+                data = {
+                    "name": "team",
+                    "password": "password",
+                    "nonce": sess.get("nonce"),
+                }
+            r = client.post("/teams/new", data=data)
+            assert r.status_code == 302
+
+            # You can't create a team with a duplicate name
+            r = client.post("/teams/new", data=data)
+            assert r.status_code == 403
+
+            # You can't create a team with an empty name
+            incorrect_data = data
+            incorrect_data["name"] = ""
+            r = client.post("/teams/new", data=incorrect_data)
+            assert r.status_code == 403
+    destroy_ctfd(app)
+
+
+def test_teams_new_post_when_already_on_team():
+    """Test that a user cannot create a new team while on a team"""
+    app = create_ctfd(user_mode="teams")
+    with app.app_context():
+        gen_user(app.db, name="user")
+        with login_as_user(app) as client:
+            with client.session_transaction() as sess:
+                data = {
+                    "name": "team1",
+                    "password": "password",
+                    "nonce": sess.get("nonce"),
+                }
+            r = client.post("/teams/new", data=data)
+            assert r.status_code == 302
+
+            # Try to create another team while on a team
+            r = client.get("/teams/new")
+            assert r.status_code == 200
+            with client.session_transaction() as sess:
+                data = {
+                    "name": "team2",
+                    "password": "password",
+                    "nonce": sess.get("nonce"),
+                }
+            r = client.post("/teams/join", data=data)
+            assert r.status_code == 403
+            user = Users.query.filter_by(name="user").first()
+            assert user.team.name == "team1"
+    destroy_ctfd(app)