mirror of
https://github.com/aljazceru/CTFd.git
synced 2025-12-17 05:54:19 +01:00
9264e96428
# 3.1.0 / 2020-09-08 **General** - Loosen team password confirmation in team settings to also accept the team captain's password to make it easier to change the team password - Adds the ability to add custom user and team fields for registration/profile settings. - Improve Notifications pubsub events system to use a subscriber per server instead of a subscriber per browser. This should improve the reliability of CTFd at higher load and make it easier to deploy the Notifications system **Admin Panel** - Add a comments functionality for admins to discuss challenges, users, teams, pages - Adds a legal section in Configs where users can add a terms of service and privacy policy - Add a Custom Fields section in Configs where admins can add/edit custom user/team fields - Move user graphs into a modal for Admin Panel **API** - Add `/api/v1/comments` to manipulate and create comments **Themes** - Make scoreboard caching only cache the score table instead of the entire page. This is done by caching the specific template section. Refer to #1586, specifically the changes in `scoreboard.html`. - Add rel=noopener to external links to prevent tab napping attacks - Change the registration page to reference links to Terms of Service and Privacy Policy if specified in configuration **Miscellaneous** - Make team settings modal larger in the core theme - Update tests in Github Actions to properly test under MySQL and Postgres - Make gevent default in serve.py and add a `--disable-gevent` switch in serve.py - Add `tenacity` library for retrying logic - Add `pytest-sugar` for slightly prettier pytest output - Add a `listen()` method to `CTFd.utils.events.EventManager` and `CTFd.utils.events.RedisEventManager`. - This method should implement subscription for a CTFd worker to whatever underlying notification system there is. This should be implemented with gevent or a background thread. - The `subscribe()` method (which used to implement the functionality of the new `listen()` function) now only handles passing notifications from CTFd to the browser. This should also be implemented with gevent or a background thread.
204 lines
6.9 KiB
Python
204 lines
6.9 KiB
Python
#!/usr/bin/env python
|
|
# -*- coding: utf-8 -*-
|
|
|
|
from CTFd.models import UserFieldEntries
|
|
from tests.helpers import (
|
|
create_ctfd,
|
|
destroy_ctfd,
|
|
gen_field,
|
|
login_as_user,
|
|
register_user,
|
|
)
|
|
|
|
|
|
def test_new_fields_show_on_pages():
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
register_user(app)
|
|
|
|
gen_field(app.db)
|
|
|
|
with login_as_user(app) as client:
|
|
r = client.get("/register")
|
|
assert "CustomField" in r.get_data(as_text=True)
|
|
assert "CustomFieldDescription" in r.get_data(as_text=True)
|
|
|
|
r = client.get("/settings")
|
|
assert "CustomField" in r.get_data(as_text=True)
|
|
assert "CustomFieldDescription" in r.get_data(as_text=True)
|
|
|
|
r = client.patch(
|
|
"/api/v1/users/me",
|
|
json={"fields": [{"field_id": 1, "value": "CustomFieldEntry"}]},
|
|
)
|
|
resp = r.get_json()
|
|
assert resp["success"] is True
|
|
assert resp["data"]["fields"][0]["value"] == "CustomFieldEntry"
|
|
assert resp["data"]["fields"][0]["description"] == "CustomFieldDescription"
|
|
assert resp["data"]["fields"][0]["name"] == "CustomField"
|
|
assert resp["data"]["fields"][0]["field_id"] == 1
|
|
|
|
r = client.get("/user")
|
|
resp = r.get_data(as_text=True)
|
|
assert "CustomField" in resp
|
|
assert "CustomFieldEntry" in resp
|
|
|
|
r = client.get("/users/2")
|
|
resp = r.get_data(as_text=True)
|
|
assert "CustomField" in resp
|
|
assert "CustomFieldEntry" in resp
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_fields_required_on_register():
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
gen_field(app.db)
|
|
|
|
with app.app_context():
|
|
with app.test_client() as client:
|
|
client.get("/register")
|
|
with client.session_transaction() as sess:
|
|
data = {
|
|
"name": "user",
|
|
"email": "user@ctfd.io",
|
|
"password": "password",
|
|
"nonce": sess.get("nonce"),
|
|
}
|
|
client.post("/register", data=data)
|
|
with client.session_transaction() as sess:
|
|
assert sess.get("id") is None
|
|
|
|
with client.session_transaction() as sess:
|
|
data = {
|
|
"name": "user",
|
|
"email": "user@ctfd.io",
|
|
"password": "password",
|
|
"fields[1]": "custom_field_value",
|
|
"nonce": sess.get("nonce"),
|
|
}
|
|
client.post("/register", data=data)
|
|
with client.session_transaction() as sess:
|
|
assert sess["id"]
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_fields_properties():
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
register_user(app)
|
|
|
|
gen_field(
|
|
app.db, name="CustomField1", required=True, public=True, editable=True
|
|
)
|
|
gen_field(
|
|
app.db, name="CustomField2", required=False, public=True, editable=True
|
|
)
|
|
gen_field(
|
|
app.db, name="CustomField3", required=False, public=False, editable=True
|
|
)
|
|
gen_field(
|
|
app.db, name="CustomField4", required=False, public=False, editable=False
|
|
)
|
|
|
|
with login_as_user(app) as client:
|
|
r = client.get("/register")
|
|
resp = r.get_data(as_text=True)
|
|
assert "CustomField1" in resp
|
|
assert "CustomField2" in resp
|
|
assert "CustomField3" in resp
|
|
assert "CustomField4" in resp
|
|
|
|
r = client.get("/settings")
|
|
resp = r.get_data(as_text=True)
|
|
assert "CustomField1" in resp
|
|
assert "CustomField2" in resp
|
|
assert "CustomField3" in resp
|
|
assert "CustomField4" not in resp
|
|
|
|
r = client.patch(
|
|
"/api/v1/users/me",
|
|
json={
|
|
"fields": [
|
|
{"field_id": 1, "value": "CustomFieldEntry1"},
|
|
{"field_id": 2, "value": "CustomFieldEntry2"},
|
|
{"field_id": 3, "value": "CustomFieldEntry3"},
|
|
{"field_id": 4, "value": "CustomFieldEntry4"},
|
|
]
|
|
},
|
|
)
|
|
resp = r.get_json()
|
|
assert resp == {
|
|
"success": False,
|
|
"errors": {"fields": ["Field 'CustomField4' cannot be editted"]},
|
|
}
|
|
|
|
r = client.patch(
|
|
"/api/v1/users/me",
|
|
json={
|
|
"fields": [
|
|
{"field_id": 1, "value": "CustomFieldEntry1"},
|
|
{"field_id": 2, "value": "CustomFieldEntry2"},
|
|
{"field_id": 3, "value": "CustomFieldEntry3"},
|
|
]
|
|
},
|
|
)
|
|
assert r.status_code == 200
|
|
|
|
r = client.get("/user")
|
|
resp = r.get_data(as_text=True)
|
|
assert "CustomField1" in resp
|
|
assert "CustomField2" in resp
|
|
assert "CustomField3" not in resp
|
|
assert "CustomField4" not in resp
|
|
|
|
r = client.get("/users/2")
|
|
resp = r.get_data(as_text=True)
|
|
assert "CustomField1" in resp
|
|
assert "CustomField2" in resp
|
|
assert "CustomField3" not in resp
|
|
assert "CustomField4" not in resp
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_boolean_checkbox_field():
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
gen_field(app.db, name="CustomField1", field_type="boolean", required=False)
|
|
|
|
with app.test_client() as client:
|
|
r = client.get("/register")
|
|
resp = r.get_data(as_text=True)
|
|
|
|
# We should have rendered a checkbox input
|
|
assert "checkbox" in resp
|
|
|
|
with client.session_transaction() as sess:
|
|
data = {
|
|
"name": "user",
|
|
"email": "user@ctfd.io",
|
|
"password": "password",
|
|
"nonce": sess.get("nonce"),
|
|
"fields[1]": "y",
|
|
}
|
|
client.post("/register", data=data)
|
|
with client.session_transaction() as sess:
|
|
assert sess["id"]
|
|
|
|
assert UserFieldEntries.query.count() == 1
|
|
assert UserFieldEntries.query.filter_by(id=1).first().value is True
|
|
|
|
with login_as_user(app) as client:
|
|
r = client.get("/settings")
|
|
resp = r.get_data(as_text=True)
|
|
assert "CustomField1" in resp
|
|
assert "checkbox" in resp
|
|
|
|
r = client.patch(
|
|
"/api/v1/users/me", json={"fields": [{"field_id": 1, "value": False}]}
|
|
)
|
|
assert r.status_code == 200
|
|
assert UserFieldEntries.query.count() == 1
|
|
assert UserFieldEntries.query.filter_by(id=1).first().value is False
|
|
destroy_ctfd(app)
|