mirror of
https://github.com/aljazceru/CTFd.git
synced 2025-12-17 22:14:25 +01:00
2.0.0 (#741)
* Fix user and admin panel user/team graphs * Closes #682 * Unify login and logout under specific functions * Closes #659 * Rename Challenges.hidden to Challenges.state * Start to clean up API and front end integration starting with profile updating * Slightly cleaner code * Clean API to respond with success, data, and status codes * Simpler COUNTRIES_LIST and update profile to use COUNTRIES_LIST * Lookup country code in users page. Update front end calls to get API data properly * Fix some API endpoints and fix JS to process new responses * Update config.py to support new values * Closes #635 * Update some code to handle user types, add email domain whitelisting * Write a logging wrapper * Use logging wrapper for submissions * Close #656 * Break up config.html to make it easier to maintain * Fix logging, domain_whitelist, and config * Improving views.py, starting to add Announcements * Starting announcements front end * Make it easier to see large images, clean up some more REST API differences * Closes #668 * Update Proxyfix config to REVERSE_PROXY * Add announcements front end * Move creation/edit modals into seperate files. Start moving user updating into their admin profile pages. * Update font-awesome to 5.4.1 * Switch to user-edit icon * Update the update_check function to send up more anonymous data for statistics purposes. * Start work on #640 * Add the user action modals and update API to fix responses * Fix admin teams page * Add challenge requirements * Implement anonymous locked challenges * Team editting from admin panel * Switch from simple cache to filesystem cache * Implements a Cache backed server side session (#658) and fixes Users editting endpoint * Add our messaging for docs * Closes #700 * Remove invalid import * Move challenge enditting around a whole lot and probably break a bunch of things * Show challenge names in prerequisites instead of challenge IDs * Closes #661 * Change user templates to use url_for * Remove extra function * Rewrite admin panel to use url_for * Fix events to work under subdirectories * Start cleaning up config panel * Fix filesystem uploader; deprecate view_challenges_unregistered, view_scoreboard_if_authed, prevent_registration, view_after_ctf; implement new visibility decorators * Remove workshop mode, fix some glitches with the new visibility settings * Fix ctf_logo on core theme * Fix setup errors * Removing default from get_config b/c of memoization issues and getting some tests working * Relax email regex validation rule (#693) * Update to pycodestyle and fix new lint errors * Add a ctf_id to update_check * Change challenge plugin layout. Rename mailgun configs to be more descriptive (Closes #702) * Detect if people try to set routes with '/' to simplify #690 * Closes #690 * Clean up some code * Clean up challenge submit to rate limit * Fix js version compatability issue * Close some TODOs * Hide challenges if not authenticated * Make set_config reset the cache for those config values * Return 404 on empty challenges for /api/v1/<challenge_id>/solves * Fix setting boolean configs * Properly change account config settings * Move datetimes to isoformat (Closes #703) * Remove all .isoformat() calls because it isn't UTC aware (ends in Z). Switch to isoformat function & filter * Make /v1/submissions endpoint work for admin submission creation * Make oauth_id unique for Users and Teams * Move challenge submission endpoint and implement mark solved. Fix some isoformat issues. * Only show team's missing challenges if in team mode * Adding support for Hints & Unlocks * Update challenge submission url * Fix encoding functions in Python3 * Fix hexencode in Python3 * Added functional tests for challenges API for non-admin users (#705) * Set hint default type to be standard * Fix some JS issues. Closes #704 * Implement session.regenerate on top of the CachingSessionInterface * Challenge challenge attempt responses from numbers to strings * Fix password updating for UserSchema * Remove leftover challenge submission code * Remove old migrations :(, resolve challenge requirements not loading correctly, move migration functions * Added functional tests for challenges/hints/admin API (#710) * Fix helpers and re-add JSONLite * Install MySQL 5.7 * Try more mysql * Update password for mysql * Fixing issuse in Users.get_solves * Add new import/export code * Switch to CTFdSerializer for Python 3 * Re-implement import exports and add a very flaky test * Redesign submissions API response * Get export to roundtrip in tests * Int score b/c Decimal is not JSON serializeable * Remove unused route methods * Fix POST /api/v1/configs and start adding admin tests * Add user_id and team_id to top/10 * Fix admin creating Teams * Fix Team website validation * Change admins_only to reply with a 403 if the request is JSON * Organize admin tests and fix authed_only to return 403 on unauthed * Adding check_account_visibility, check_score_visibility for /api/v1/teams/<team_id>/(solves|awards|fails) * Fix teams/me endpoints again * Fix users/me endpoints to return 403 if unauthed * Fix Python 3 config API * Add fetch and promise polyfills. (#712) * Add exec to docker-entrypoint.sh (#713) * Display import_ctf Exceptions via repr (#651) - Wraps exceptions on `/admin/import` returned to users in a `repr()`, making debugging easier. * Add error messages to the admin panel, fix schemas for users, start working on UI for imports/exports * Make unauthed challenge submission attempt return 403 instead of 302, Fix user deletion, fix associated tests, remove TODOs * Remove old means of creating solves * Remove most of the content from teams.js and users.js * Remove extra code from /challenges.js * Fix POST'ing & PATCH'ing pages * Make (users|teams)/fails return only count to users. Fix public score graphs to factor in awards * Fix admin side scoregraphs. Fix Awardschemas for admins * Add requirements to db migration * Adding some team decorators * Fix require_team_mode decorator * Make verified emails decorator return 403 on JSON requests * Redo initial revision * Add SQLiteJSON back * Adding ratelimit to /redirect and removing POST from /oauth * Fix PATCH tags * Actually fix PATCH tags * Simplify 500.html * Added tests for challenges, awards, files, flags, hints ... (#723) * Added tests for challenges, awards, files, flags, hints, notifications, pages, submissions, tags * Fix user data validation functions, Fix hidden challenges and include test * Add a locked state to attempt * OAuth teams get verified, use logging functions in redirect route * Removing extra print call * Update requirements.txt * Fix possible AttributeError * Start work on #716 * Closes #717 * Fix issue patching teams * Rename .j2 to .html, implement preview for challenges if admin * Move admin/challenge.html to admin/challenges/challenge.html * Remove old modals * Add Reset CTF button (#639) * Add Reset link to config.html * Delete Tracking * files handler should return a 404 on files it cant find * Denote official teams (#729), make scoregraph fill to zero * Remove old javascript files, make some challenge elements refresh by reloading * Fix team editting modals to work more reliably * Fix rendering of CTF paused * Remove hide_scores funtion and roll it into scores visibility * Log to stdout/stderr by default (#719) * Fix user searching * Remove searching for users/teams by country * Add badges to admin team and user pages, implement user banning (#643) * Remove shell.py, clean up admin team.html, add tests for banned users, teams * Start cleaning up dynamic_challenges to meet new challenge type plugin format * Remove POST method from teams.public * Add credentials: 'same-origin' to all fetch calls (#734) * Add challenge preview, add challenge deletion, fix file deletions when deleting challenges * Fix imports UI (#735) * Show prerequisites before adding a blank one (#738), Refresh all challenges after a submission (#739) * Admins can see hidden challenges * Fix some UI elements, fix loading location hash, set version to be 2.0.0 * Clean up some challenge plugin pages * Add default for flag type * Fix Python3 bytes/str issues * Add in MLC urls and support user mode for oauth * Fix seeing user graphs when scores are hidden, clean up setup.html, add links to MLC oauth * Add state parameter support * Use URLSafeTimedSerializer wrapper for sending token based emails * setting APPLICATION_ROOT from env var (#732) * Rearrange config.py and update README * Updating README
This commit is contained in:
Kevin Chung
@@ -1,302 +1,50 @@
|
||||
from flask import current_app as app, render_template, request, redirect, jsonify, url_for, Blueprint
|
||||
from CTFd.utils import admins_only, is_admin, cache
|
||||
from CTFd.models import db, Teams, Solves, Awards, Challenges, WrongKeys, Keys, Tags, Files, Tracking, Pages, Config, Hints, Unlocks, DatabaseError
|
||||
from CTFd.plugins.keys import get_key_class, KEY_CLASSES
|
||||
from flask import current_app as app, render_template, request, redirect, jsonify, render_template_string
|
||||
from CTFd.utils.decorators import admins_only
|
||||
from CTFd.models import db, Teams, Solves, Awards, Challenges, Fails, Flags, Tags, Files, Tracking, Pages, Configs, Hints, Unlocks
|
||||
from CTFd.plugins.flags import get_flag_class, FLAG_CLASSES
|
||||
from CTFd.plugins.challenges import get_chal_class, CHALLENGE_CLASSES
|
||||
|
||||
from CTFd import utils
|
||||
|
||||
from CTFd.admin import admin
|
||||
from CTFd.utils import config, validators, uploads
|
||||
import os
|
||||
|
||||
admin_challenges = Blueprint('admin_challenges', __name__)
|
||||
|
||||
|
||||
@admin_challenges.route('/admin/chal_types', methods=['GET'])
|
||||
@admin.route('/admin/challenges')
|
||||
@admins_only
|
||||
def admin_chal_types():
|
||||
data = {}
|
||||
for class_id in CHALLENGE_CLASSES:
|
||||
challenge_class = CHALLENGE_CLASSES.get(class_id)
|
||||
data[challenge_class.id] = {
|
||||
'id': challenge_class.id,
|
||||
'name': challenge_class.name,
|
||||
'templates': challenge_class.templates,
|
||||
'scripts': challenge_class.scripts,
|
||||
}
|
||||
|
||||
return jsonify(data)
|
||||
def challenges_listing():
|
||||
challenges = Challenges.query.all()
|
||||
return render_template('admin/challenges/challenges.html', challenges=challenges)
|
||||
|
||||
|
||||
@admin_challenges.route('/admin/chals', methods=['POST', 'GET'])
|
||||
@admin.route('/admin/challenges/<int:challenge_id>')
|
||||
@admins_only
|
||||
def admin_chals():
|
||||
if request.method == 'POST':
|
||||
chals = Challenges.query.order_by(Challenges.value).all()
|
||||
def challenges_detail(challenge_id):
|
||||
challenges = dict(Challenges.query.with_entities(Challenges.id, Challenges.name).all())
|
||||
challenge = Challenges.query.filter_by(id=challenge_id).first_or_404()
|
||||
solves = Solves.query.filter_by(challenge_id=challenge.id).all()
|
||||
flags = Flags.query.filter_by(challenge_id=challenge.id).all()
|
||||
challenge_class = get_chal_class(challenge.type)
|
||||
|
||||
json_data = {'game': []}
|
||||
for chal in chals:
|
||||
tags = [tag.tag for tag in Tags.query.add_columns('tag').filter_by(chal=chal.id).all()]
|
||||
files = [str(f.location) for f in Files.query.filter_by(chal=chal.id).all()]
|
||||
hints = []
|
||||
for hint in Hints.query.filter_by(chal=chal.id).all():
|
||||
hints.append({'id': hint.id, 'cost': hint.cost, 'hint': hint.hint})
|
||||
|
||||
type_class = CHALLENGE_CLASSES.get(chal.type)
|
||||
type_name = type_class.name if type_class else None
|
||||
|
||||
json_data['game'].append({
|
||||
'id': chal.id,
|
||||
'name': chal.name,
|
||||
'value': chal.value,
|
||||
'description': chal.description,
|
||||
'category': chal.category,
|
||||
'files': files,
|
||||
'tags': tags,
|
||||
'hints': hints,
|
||||
'hidden': chal.hidden,
|
||||
'max_attempts': chal.max_attempts,
|
||||
'type': chal.type,
|
||||
'type_name': type_name,
|
||||
'type_data': {
|
||||
'id': type_class.id,
|
||||
'name': type_class.name,
|
||||
'templates': type_class.templates,
|
||||
'scripts': type_class.scripts,
|
||||
}
|
||||
})
|
||||
|
||||
db.session.close()
|
||||
return jsonify(json_data)
|
||||
else:
|
||||
challenges = Challenges.query.all()
|
||||
return render_template('admin/challenges.html', challenges=challenges)
|
||||
static_path = os.path.basename(challenge_class.blueprint.static_url_path)
|
||||
update_j2 = render_template_string(
|
||||
challenge_class.blueprint.open_resource(
|
||||
os.path.join(static_path, 'update.html')
|
||||
).read().decode('utf-8'),
|
||||
# Python 3
|
||||
challenge=challenge
|
||||
)
|
||||
update_script = os.path.join(challenge_class.route, 'update.js')
|
||||
return render_template(
|
||||
'admin/challenges/challenge.html',
|
||||
update_template=update_j2,
|
||||
update_script=update_script,
|
||||
challenge=challenge,
|
||||
challenges=challenges,
|
||||
solves=solves,
|
||||
flags=flags
|
||||
)
|
||||
|
||||
|
||||
@admin_challenges.route('/admin/chal/<int:chalid>', methods=['GET', 'POST'])
|
||||
@admin.route('/admin/challenges/new')
|
||||
@admins_only
|
||||
def admin_chal_detail(chalid):
|
||||
chal = Challenges.query.filter_by(id=chalid).first_or_404()
|
||||
chal_class = get_chal_class(chal.type)
|
||||
|
||||
if request.method == 'POST':
|
||||
status, message = chal_class.attempt(chal, request)
|
||||
if status:
|
||||
return jsonify({'status': 1, 'message': message})
|
||||
else:
|
||||
return jsonify({'status': 0, 'message': message})
|
||||
elif request.method == 'GET':
|
||||
obj, data = chal_class.read(chal)
|
||||
|
||||
tags = [tag.tag for tag in Tags.query.add_columns('tag').filter_by(chal=chal.id).all()]
|
||||
files = [str(f.location) for f in Files.query.filter_by(chal=chal.id).all()]
|
||||
hints = []
|
||||
for hint in Hints.query.filter_by(chal=chal.id).all():
|
||||
hints.append({'id': hint.id, 'cost': hint.cost, 'hint': hint.hint})
|
||||
|
||||
data['tags'] = tags
|
||||
data['files'] = files
|
||||
data['hints'] = hints
|
||||
|
||||
return jsonify(data)
|
||||
|
||||
|
||||
@admin_challenges.route('/admin/chal/<int:chalid>/solves', methods=['GET'])
|
||||
@admins_only
|
||||
def admin_chal_solves(chalid):
|
||||
response = {'teams': []}
|
||||
if utils.hide_scores():
|
||||
return jsonify(response)
|
||||
solves = Solves.query.join(Teams, Solves.teamid == Teams.id).filter(Solves.chalid == chalid).order_by(
|
||||
Solves.date.asc())
|
||||
for solve in solves:
|
||||
response['teams'].append({'id': solve.team.id, 'name': solve.team.name, 'date': solve.date})
|
||||
return jsonify(response)
|
||||
|
||||
|
||||
@admin_challenges.route('/admin/tags/<int:chalid>', methods=['GET', 'POST'])
|
||||
@admins_only
|
||||
def admin_tags(chalid):
|
||||
if request.method == 'GET':
|
||||
tags = Tags.query.filter_by(chal=chalid).all()
|
||||
json_data = {'tags': []}
|
||||
for x in tags:
|
||||
json_data['tags'].append({'id': x.id, 'chal': x.chal, 'tag': x.tag})
|
||||
return jsonify(json_data)
|
||||
|
||||
elif request.method == 'POST':
|
||||
newtags = request.form.getlist('tags[]')
|
||||
for x in newtags:
|
||||
tag = Tags(chalid, x)
|
||||
db.session.add(tag)
|
||||
db.session.commit()
|
||||
db.session.close()
|
||||
return '1'
|
||||
|
||||
|
||||
@admin_challenges.route('/admin/tags/<int:tagid>/delete', methods=['POST'])
|
||||
@admins_only
|
||||
def admin_delete_tags(tagid):
|
||||
if request.method == 'POST':
|
||||
tag = Tags.query.filter_by(id=tagid).first_or_404()
|
||||
db.session.delete(tag)
|
||||
db.session.commit()
|
||||
db.session.close()
|
||||
return '1'
|
||||
|
||||
|
||||
@admin_challenges.route('/admin/hints', defaults={'hintid': None}, methods=['POST', 'GET'])
|
||||
@admin_challenges.route('/admin/hints/<int:hintid>', methods=['GET', 'POST', 'DELETE'])
|
||||
@admins_only
|
||||
def admin_hints(hintid):
|
||||
if hintid:
|
||||
hint = Hints.query.filter_by(id=hintid).first_or_404()
|
||||
|
||||
if request.method == 'POST':
|
||||
hint.hint = request.form.get('hint')
|
||||
hint.chal = int(request.form.get('chal'))
|
||||
hint.cost = int(request.form.get('cost') or 0)
|
||||
db.session.commit()
|
||||
|
||||
elif request.method == 'DELETE':
|
||||
db.session.delete(hint)
|
||||
db.session.commit()
|
||||
db.session.close()
|
||||
return ('', 204)
|
||||
|
||||
json_data = {
|
||||
'hint': hint.hint,
|
||||
'type': hint.type,
|
||||
'chal': hint.chal,
|
||||
'cost': hint.cost,
|
||||
'id': hint.id
|
||||
}
|
||||
db.session.close()
|
||||
return jsonify(json_data)
|
||||
else:
|
||||
if request.method == 'GET':
|
||||
hints = Hints.query.all()
|
||||
json_data = []
|
||||
for hint in hints:
|
||||
json_data.append({
|
||||
'hint': hint.hint,
|
||||
'type': hint.type,
|
||||
'chal': hint.chal,
|
||||
'cost': hint.cost,
|
||||
'id': hint.id
|
||||
})
|
||||
return jsonify({'results': json_data})
|
||||
elif request.method == 'POST':
|
||||
hint = request.form.get('hint')
|
||||
chalid = int(request.form.get('chal'))
|
||||
cost = int(request.form.get('cost') or 0)
|
||||
hint_type = request.form.get('type', 0)
|
||||
hint = Hints(chal=chalid, hint=hint, cost=cost)
|
||||
db.session.add(hint)
|
||||
db.session.commit()
|
||||
json_data = {
|
||||
'hint': hint.hint,
|
||||
'type': hint.type,
|
||||
'chal': hint.chal,
|
||||
'cost': hint.cost,
|
||||
'id': hint.id
|
||||
}
|
||||
db.session.close()
|
||||
return jsonify(json_data)
|
||||
|
||||
|
||||
@admin_challenges.route('/admin/files/<int:chalid>', methods=['GET', 'POST'])
|
||||
@admins_only
|
||||
def admin_files(chalid):
|
||||
if request.method == 'GET':
|
||||
files = Files.query.filter_by(chal=chalid).all()
|
||||
json_data = {'files': []}
|
||||
for x in files:
|
||||
json_data['files'].append({'id': x.id, 'file': x.location})
|
||||
return jsonify(json_data)
|
||||
if request.method == 'POST':
|
||||
if request.form['method'] == "delete":
|
||||
utils.delete_file(request.form['file'])
|
||||
|
||||
db.session.commit()
|
||||
db.session.close()
|
||||
return '1'
|
||||
elif request.form['method'] == "upload":
|
||||
files = request.files.getlist('files[]')
|
||||
|
||||
for f in files:
|
||||
utils.upload_file(file=f, chalid=chalid)
|
||||
|
||||
db.session.commit()
|
||||
db.session.close()
|
||||
return '1'
|
||||
|
||||
|
||||
@admin_challenges.route('/admin/chal/<int:chalid>/<prop>', methods=['GET'])
|
||||
@admins_only
|
||||
def admin_get_values(chalid, prop):
|
||||
challenge = Challenges.query.filter_by(id=chalid).first_or_404()
|
||||
if prop == 'keys':
|
||||
chal_keys = Keys.query.filter_by(chal=challenge.id).all()
|
||||
json_data = {'keys': []}
|
||||
for x in chal_keys:
|
||||
key_class = get_key_class(x.type)
|
||||
json_data['keys'].append({
|
||||
'id': x.id,
|
||||
'key': x.flag,
|
||||
'type': x.type,
|
||||
'type_name': key_class.name,
|
||||
'templates': key_class.templates,
|
||||
})
|
||||
return jsonify(json_data)
|
||||
elif prop == 'tags':
|
||||
tags = Tags.query.filter_by(chal=chalid).all()
|
||||
json_data = {'tags': []}
|
||||
for x in tags:
|
||||
json_data['tags'].append({
|
||||
'id': x.id,
|
||||
'chal': x.chal,
|
||||
'tag': x.tag
|
||||
})
|
||||
return jsonify(json_data)
|
||||
elif prop == 'hints':
|
||||
hints = Hints.query.filter_by(chal=chalid)
|
||||
json_data = {'hints': []}
|
||||
for hint in hints:
|
||||
json_data['hints'].append({
|
||||
'hint': hint.hint,
|
||||
'type': hint.type,
|
||||
'chal': hint.chal,
|
||||
'cost': hint.cost,
|
||||
'id': hint.id
|
||||
})
|
||||
return jsonify(json_data)
|
||||
|
||||
|
||||
@admin_challenges.route('/admin/chal/new', methods=['GET', 'POST'])
|
||||
@admins_only
|
||||
def admin_create_chal():
|
||||
if request.method == 'POST':
|
||||
chal_type = request.form['chaltype']
|
||||
chal_class = get_chal_class(chal_type)
|
||||
chal_class.create(request)
|
||||
return redirect(url_for('admin_challenges.admin_chals'))
|
||||
else:
|
||||
return render_template('admin/chals/create.html')
|
||||
|
||||
|
||||
@admin_challenges.route('/admin/chal/delete', methods=['POST'])
|
||||
@admins_only
|
||||
def admin_delete_chal():
|
||||
challenge = Challenges.query.filter_by(id=request.form['id']).first_or_404()
|
||||
chal_class = get_chal_class(challenge.type)
|
||||
chal_class.delete(challenge)
|
||||
return '1'
|
||||
|
||||
|
||||
@admin_challenges.route('/admin/chal/update', methods=['POST'])
|
||||
@admins_only
|
||||
def admin_update_chal():
|
||||
challenge = Challenges.query.filter_by(id=request.form['id']).first_or_404()
|
||||
chal_class = get_chal_class(challenge.type)
|
||||
chal_class.update(challenge, request)
|
||||
return redirect(url_for('admin_challenges.admin_chals'))
|
||||
def challenges_new():
|
||||
return render_template('admin/challenges/new.html')
|
||||
|
||||
Reference in New Issue
Block a user