mirror of
https://github.com/aljazceru/CTFd.git
synced 2025-12-18 06:24:23 +01:00
b8d0f80d01
2.2.0 / 2019-12-22
==================
## Notice
2.2.0 focuses on updating the front end of CTFd to use more modern programming practices and changes some aspects of core CTFd design. If your current installation is using a custom theme or custom plugin with ***any*** kind of JavaScript, it is likely that you will need to upgrade that theme/plugin to be useable with v2.2.0.
**General**
* Team size limits can now be enforced from the configuration panel
* Access tokens functionality for API usage
* Admins can now choose how to deliver their notifications
* Toast (new default)
* Alert
* Background
* Sound On / Sound Off
* There is now a notification counter showing how many unread notifications were received
* Setup has been redesigned to have multiple steps
* Added Description
* Added Start time and End time,
* Added MajorLeagueCyber integration
* Added Theme and color selection
* Fixes issue where updating dynamic challenges could change the value to an incorrect value
* Properly use a less restrictive regex to validate email addresses
* Bump Python dependencies to latest working versions
* Admins can now give awards to team members from the team's admin panel page
**API**
* Team member removals (`DELETE /api/v1/teams/[team_id]/members`) from the admin panel will now delete the removed members's Submissions, Awards, Unlocks
**Admin Panel**
* Admins can now user a color input box to specify a theme color which is injected as part of the CSS configuration. Theme developers can use this CSS value to change colors and styles accordingly.
* Challenge updates will now alert you if the challenge doesn't have a flag
* Challenge entry now allows you to upload files and enter simple flags from the initial challenge creation page
**Themes**
* Significant JavaScript and CSS rewrite to use ES6, Webpack, yarn, and babel
* Theme asset specially generated URLs
* Static theme assets are now loaded with either .dev.extension or .min.extension depending on production or development (i.e. debug server)
* Static theme assets are also given a `d` GET parameter that changes per server start. Used to bust browser caches.
* Use `defer` for script tags to not block page rendering
* Only show the MajorLeagueCyber button if configured in configuration
* The admin panel now links to https://help.ctfd.io/ in the top right
* Create an `ezToast()` function to use [Bootstrap's toasts](https://getbootstrap.com/docs/4.3/components/toasts/)
* The user-facing navbar now features icons
* Awards shown on a user's profile can now have award icons
* The default MarkdownIt render created by CTFd will now open links in new tabs
* Country flags can now be shown on the user pages
**Deployment**
* Switch `Dockerfile` from `python:2.7-alpine` to `python:3.7-alpine`
* Add `SERVER_SENT_EVENTS` config value to control whether Notifications are enabled
* Challenge ID is now recorded in the submission log
**Plugins**
* Add an endpoint parameter to `register_plugin_assets_directory()` and `register_plugin_asset()` to control what endpoint Flask uses for the added route
**Miscellaneous**
* `CTFd.utils.email.sendmail()` now allows the caller to specify subject as an argument
* The subject allows for injecting custom variable via the new `CTFd.utils.formatters.safe_format()` function
* Admin user information is now error checked during setup
* Added yarn to the toolchain and the yarn dev, yarn build, yarn verify, and yarn clean scripts
* Prevent old CTFd imports from being imported
213 lines
7.1 KiB
Python
213 lines
7.1 KiB
Python
#!/usr/bin/env python
|
|
# -*- coding: utf-8 -*-
|
|
|
|
from CTFd.utils import set_config
|
|
from CTFd.models import Users, Teams
|
|
from tests.helpers import (
|
|
create_ctfd,
|
|
destroy_ctfd,
|
|
register_user,
|
|
login_as_user,
|
|
gen_user,
|
|
gen_team,
|
|
gen_award,
|
|
)
|
|
|
|
|
|
def test_teams_get():
|
|
"""Can a user get /teams"""
|
|
app = create_ctfd(user_mode="teams")
|
|
with app.app_context():
|
|
with app.test_client() as client:
|
|
set_config("account_visibility", "public")
|
|
r = client.get("/teams")
|
|
assert r.status_code == 200
|
|
set_config("account_visibility", "private")
|
|
r = client.get("/teams")
|
|
assert r.status_code == 302
|
|
set_config("account_visibility", "admins")
|
|
r = client.get("/teams")
|
|
assert r.status_code == 404
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_accessing_hidden_teams():
|
|
"""Hidden teams should not give any data from /teams or /api/v1/teams"""
|
|
app = create_ctfd(user_mode="teams")
|
|
with app.app_context():
|
|
register_user(app)
|
|
register_user(app, name="visible_user", email="visible_user@ctfd.io")
|
|
with login_as_user(app, name="visible_user") as client:
|
|
user = Users.query.filter_by(id=2).first()
|
|
team = gen_team(app.db, name="visible_team", hidden=True)
|
|
team.members.append(user)
|
|
user.team_id = team.id
|
|
app.db.session.commit()
|
|
|
|
assert client.get("/teams/1").status_code == 404
|
|
assert client.get("/api/v1/teams/1").status_code == 404
|
|
assert client.get("/api/v1/teams/1/solves").status_code == 404
|
|
assert client.get("/api/v1/teams/1/fails").status_code == 404
|
|
assert client.get("/api/v1/teams/1/awards").status_code == 404
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_hidden_teams_visibility():
|
|
"""Hidden teams should not show up on /teams or /api/v1/teams or /api/v1/scoreboard"""
|
|
app = create_ctfd(user_mode="teams")
|
|
with app.app_context():
|
|
register_user(app)
|
|
with login_as_user(app) as client:
|
|
user = Users.query.filter_by(id=2).first()
|
|
team = gen_team(app.db, name="visible_team", hidden=True)
|
|
team.members.append(user)
|
|
user.team_id = team.id
|
|
app.db.session.commit()
|
|
|
|
r = client.get("/teams")
|
|
response = r.get_data(as_text=True)
|
|
assert team.name not in response
|
|
|
|
r = client.get("/api/v1/teams")
|
|
response = r.get_json()
|
|
assert team.name not in response
|
|
|
|
gen_award(app.db, user.id, team_id=team.id)
|
|
|
|
r = client.get("/scoreboard")
|
|
response = r.get_data(as_text=True)
|
|
assert team.name not in response
|
|
|
|
r = client.get("/api/v1/scoreboard")
|
|
response = r.get_json()
|
|
assert team.name not in response
|
|
|
|
# Team should re-appear after disabling hiding
|
|
# Use an API call to cause a cache clear
|
|
with login_as_user(app, name="admin") as admin:
|
|
r = admin.patch("/api/v1/teams/1", json={"hidden": False})
|
|
assert r.status_code == 200
|
|
|
|
r = client.get("/teams")
|
|
response = r.get_data(as_text=True)
|
|
assert team.name in response
|
|
|
|
r = client.get("/api/v1/teams")
|
|
response = r.get_data(as_text=True)
|
|
assert team.name in response
|
|
|
|
r = client.get("/api/v1/scoreboard")
|
|
response = r.get_data(as_text=True)
|
|
assert team.name in response
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_teams_get_user_mode():
|
|
"""Can a user get /teams if user mode"""
|
|
app = create_ctfd(user_mode="users")
|
|
with app.app_context():
|
|
register_user(app)
|
|
with login_as_user(app) as client:
|
|
r = client.get("/teams")
|
|
assert r.status_code == 404
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_teams_new_get():
|
|
"""Can a user get /teams/new"""
|
|
app = create_ctfd(user_mode="teams")
|
|
with app.app_context():
|
|
register_user(app)
|
|
with login_as_user(app) as client:
|
|
r = client.get("/teams/new")
|
|
assert r.status_code == 200
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_teams_new_post():
|
|
"""Can a user post /teams/new"""
|
|
app = create_ctfd(user_mode="teams")
|
|
with app.app_context():
|
|
gen_user(app.db, name="user")
|
|
with login_as_user(app) as client:
|
|
with client.session_transaction() as sess:
|
|
data = {
|
|
"name": "team",
|
|
"password": "password",
|
|
"nonce": sess.get("nonce"),
|
|
}
|
|
r = client.post("/teams/new", data=data)
|
|
assert r.status_code == 302
|
|
r = client.post("/teams/new", data=data)
|
|
assert r.status_code == 200
|
|
incorrect_data = data
|
|
incorrect_data["name"] = ""
|
|
r = client.post("/teams/new", data=incorrect_data)
|
|
assert r.status_code == 200
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_team_get():
|
|
"""Can a user get /team"""
|
|
app = create_ctfd(user_mode="teams")
|
|
with app.app_context():
|
|
user = gen_user(app.db)
|
|
team = gen_team(app.db)
|
|
team.members.append(user)
|
|
user.team_id = team.id
|
|
app.db.session.commit()
|
|
with login_as_user(app, name="user_name", password="password") as client:
|
|
r = client.get("/team")
|
|
assert r.status_code == 200
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_teams_id_get():
|
|
"""Can a user get /teams/<int:team_id>"""
|
|
app = create_ctfd(user_mode="teams")
|
|
with app.app_context():
|
|
user = gen_user(app.db)
|
|
team = gen_team(app.db)
|
|
team.members.append(user)
|
|
user.team_id = team.id
|
|
app.db.session.commit()
|
|
with login_as_user(app, name="user_name", password="password") as client:
|
|
r = client.get("/teams/1")
|
|
assert r.status_code == 200
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_team_size_limit():
|
|
"""Only team_size amount of members can join a team"""
|
|
app = create_ctfd(user_mode="teams")
|
|
with app.app_context():
|
|
set_config("team_size", 1)
|
|
|
|
# Create a team with only one member
|
|
team = gen_team(app.db, member_count=1)
|
|
team_id = team.id
|
|
|
|
register_user(app)
|
|
with login_as_user(app) as client:
|
|
r = client.get("/teams/join")
|
|
assert r.status_code == 200
|
|
|
|
# User should be blocked from joining
|
|
with client.session_transaction() as sess:
|
|
data = {
|
|
"name": "team_name",
|
|
"password": "password",
|
|
"nonce": sess.get("nonce"),
|
|
}
|
|
r = client.post("/teams/join", data=data)
|
|
resp = r.get_data(as_text=True)
|
|
assert len(Teams.query.filter_by(id=team_id).first().members) == 1
|
|
assert "already reached the team size limit of 1" in resp
|
|
|
|
# Can the user join after the size has been bumped
|
|
set_config("team_size", 2)
|
|
r = client.post("/teams/join", data=data)
|
|
resp = r.get_data(as_text=True)
|
|
assert len(Teams.query.filter_by(id=team_id).first().members) == 2
|
|
destroy_ctfd(app)
|