* Convert Challenge plugin static methods into class methods
* Copy the create, read, update, attempt, solve, fail methods into the BaseChallenge class so that they can be re-used between challenge plugins
* Adds Enums for visibility configs for better reusability. Old tests will continue to use the static values but new ones should use the enum values.
* Closes#929
* Switches from Plotly to echarts. Saves file space and allows for more flexibility in graphing types.
* Changes colorHash slightly to change color output for demo data.
* Closes#1433
* Closes#1332
* Pages by default now strip script tags and other potential XSS vectors
* lxml and html5lib are now pinned dependencies
* Challenge plugins rewritten to allow for better re-useability of template content and allow more control from the theme side
* Adds `window.init.theme_settings` which is a JSON blob that's passed by CTFd and configurable from the Admin Panel
* Adds `config.html` which should be a form which can be loaded into the Admin Panel and able to emit a JSON blob which can be used as `window.init.theme_settings`.
* Closes#1329
* The top scoreboard endpoint `/api/v1/scoreboard/top/<count>` is now more performant (3x) due to better response generation
In local testing I went from 3.5s to 1.2s.
* Improve response times of `/api/v1/scoreboard` significantly by avoiding hitting the database to get every team member's score
* Fix issue where a hidden/banned user's score could be revealed as a member of a team
From tests I was able to cut this down from 11s to 0.5s. This endpoint also will still be heavily cached which should improve performance for a lot of users.
* Replace user facing pagination with Flask SQLAlchemy Pagination objects
* Closes#1353
I think this is a big improvement but I feel like this is harder to create a theme construct around.
2.5.0 / 2020-06-02
==================
**General**
* Use a session invalidation strategy inspired by Django. Newly generated user sessions will now include a HMAC of the user's password. When the user's password is changed by someone other than the user the previous HMACs will no longer be valid and the user will be logged out when they next attempt to perform an action.
* A user and team's place, and score are now cached and invalidated on score changes.
**API**
* Add `/api/v1/challenges?view=admin` to allow admin users to see all challenges regardless of their visibility state
* Add `/api/v1/users?view=admin` to allow admin users to see all users regardless of their hidden/banned state
* Add `/api/v1/teams?view=admin` to allow admin users to see all teams regardless of their hidden/banned state
* The scoreboard endpoints `/api/v1/scoreboard` & `/api/v1/scoreboard/top/[count]` should now be more performant because score and place for Users/Teams are now cached
**Deployment**
* `docker-compose` now provides a basic nginx configuration and deploys nginx on port 80
**Miscellaneous**
* The `get_config` and `get_page` config utilities now use SQLAlchemy Core instead of SQLAlchemy ORM for slight speedups
* Update Flask-Migrate to 2.5.3 and regenerate the migration environment. Fixes using `%` signs in database passwords.
* Remove Python 2 specific code
* Require imports to have a proper isort-supported order
* Only test/lint on Python 3
* Bump most dependencies to latest supported version
