mirror of
https://github.com/aljazceru/CTFd.git
synced 2025-12-17 05:54:19 +01:00
b8d0f80d01
2.2.0 / 2019-12-22
==================
## Notice
2.2.0 focuses on updating the front end of CTFd to use more modern programming practices and changes some aspects of core CTFd design. If your current installation is using a custom theme or custom plugin with ***any*** kind of JavaScript, it is likely that you will need to upgrade that theme/plugin to be useable with v2.2.0.
**General**
* Team size limits can now be enforced from the configuration panel
* Access tokens functionality for API usage
* Admins can now choose how to deliver their notifications
* Toast (new default)
* Alert
* Background
* Sound On / Sound Off
* There is now a notification counter showing how many unread notifications were received
* Setup has been redesigned to have multiple steps
* Added Description
* Added Start time and End time,
* Added MajorLeagueCyber integration
* Added Theme and color selection
* Fixes issue where updating dynamic challenges could change the value to an incorrect value
* Properly use a less restrictive regex to validate email addresses
* Bump Python dependencies to latest working versions
* Admins can now give awards to team members from the team's admin panel page
**API**
* Team member removals (`DELETE /api/v1/teams/[team_id]/members`) from the admin panel will now delete the removed members's Submissions, Awards, Unlocks
**Admin Panel**
* Admins can now user a color input box to specify a theme color which is injected as part of the CSS configuration. Theme developers can use this CSS value to change colors and styles accordingly.
* Challenge updates will now alert you if the challenge doesn't have a flag
* Challenge entry now allows you to upload files and enter simple flags from the initial challenge creation page
**Themes**
* Significant JavaScript and CSS rewrite to use ES6, Webpack, yarn, and babel
* Theme asset specially generated URLs
* Static theme assets are now loaded with either .dev.extension or .min.extension depending on production or development (i.e. debug server)
* Static theme assets are also given a `d` GET parameter that changes per server start. Used to bust browser caches.
* Use `defer` for script tags to not block page rendering
* Only show the MajorLeagueCyber button if configured in configuration
* The admin panel now links to https://help.ctfd.io/ in the top right
* Create an `ezToast()` function to use [Bootstrap's toasts](https://getbootstrap.com/docs/4.3/components/toasts/)
* The user-facing navbar now features icons
* Awards shown on a user's profile can now have award icons
* The default MarkdownIt render created by CTFd will now open links in new tabs
* Country flags can now be shown on the user pages
**Deployment**
* Switch `Dockerfile` from `python:2.7-alpine` to `python:3.7-alpine`
* Add `SERVER_SENT_EVENTS` config value to control whether Notifications are enabled
* Challenge ID is now recorded in the submission log
**Plugins**
* Add an endpoint parameter to `register_plugin_assets_directory()` and `register_plugin_asset()` to control what endpoint Flask uses for the added route
**Miscellaneous**
* `CTFd.utils.email.sendmail()` now allows the caller to specify subject as an argument
* The subject allows for injecting custom variable via the new `CTFd.utils.formatters.safe_format()` function
* Admin user information is now error checked during setup
* Added yarn to the toolchain and the yarn dev, yarn build, yarn verify, and yarn clean scripts
* Prevent old CTFd imports from being imported
433 lines
16 KiB
Python
433 lines
16 KiB
Python
#!/usr/bin/env python
|
|
# -*- coding: utf-8 -*-
|
|
|
|
import os
|
|
|
|
from flask import url_for
|
|
from tests.helpers import (
|
|
create_ctfd,
|
|
destroy_ctfd,
|
|
register_user,
|
|
login_as_user,
|
|
gen_challenge,
|
|
gen_file,
|
|
gen_page,
|
|
)
|
|
from CTFd.cache import clear_pages
|
|
from CTFd.utils import set_config
|
|
from CTFd.utils.config.pages import get_pages
|
|
from CTFd.utils.encoding import hexencode
|
|
from freezegun import freeze_time
|
|
|
|
|
|
def test_index():
|
|
"""Does the index page return a 200 by default"""
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
with app.test_client() as client:
|
|
r = client.get("/")
|
|
assert r.status_code == 200
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_page():
|
|
"""Test that users can access pages that are created in the database"""
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
gen_page(
|
|
app.db, title="Title", route="this-is-a-route", content="This is some HTML"
|
|
)
|
|
|
|
with app.test_client() as client:
|
|
r = client.get("/this-is-a-route")
|
|
assert r.status_code == 200
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_draft_pages():
|
|
"""Test that draft pages can't be seen"""
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
gen_page(
|
|
app.db,
|
|
title="Title",
|
|
route="this-is-a-route",
|
|
content="This is some HTML",
|
|
draft=True,
|
|
)
|
|
|
|
with app.test_client() as client:
|
|
r = client.get("/this-is-a-route")
|
|
assert r.status_code == 404
|
|
|
|
register_user(app)
|
|
client = login_as_user(app)
|
|
r = client.get("/this-is-a-route")
|
|
assert r.status_code == 404
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_page_requiring_auth():
|
|
"""Test that pages properly require authentication"""
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
gen_page(
|
|
app.db,
|
|
title="Title",
|
|
route="this-is-a-route",
|
|
content="This is some HTML",
|
|
auth_required=True,
|
|
)
|
|
|
|
with app.test_client() as client:
|
|
r = client.get("/this-is-a-route")
|
|
assert r.status_code == 302
|
|
assert r.location == "http://localhost/login?next=%2Fthis-is-a-route%3F"
|
|
|
|
register_user(app)
|
|
client = login_as_user(app)
|
|
r = client.get("/this-is-a-route")
|
|
assert r.status_code == 200
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_hidden_pages():
|
|
"""Test that hidden pages aren't on the navbar but can be loaded"""
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
page = gen_page(
|
|
app.db,
|
|
title="HiddenPageTitle",
|
|
route="this-is-a-hidden-route",
|
|
content="This is some HTML",
|
|
hidden=True,
|
|
)
|
|
clear_pages()
|
|
assert page not in get_pages()
|
|
|
|
with app.test_client() as client:
|
|
r = client.get("/")
|
|
assert r.status_code == 200
|
|
assert "HiddenPageTitle" not in r.get_data(as_text=True)
|
|
|
|
with app.test_client() as client:
|
|
r = client.get("/this-is-a-hidden-route")
|
|
assert r.status_code == 200
|
|
assert "This is some HTML" in r.get_data(as_text=True)
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_not_found():
|
|
"""Should return a 404 for pages that are not found"""
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
with app.test_client() as client:
|
|
r = client.get("/this-should-404")
|
|
assert r.status_code == 404
|
|
r = client.post("/this-should-404")
|
|
assert r.status_code == 404
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_themes_handler():
|
|
"""Test that the themes handler is working properly"""
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
with app.test_client() as client:
|
|
r = client.get("/themes/core/static/css/main.min.css")
|
|
assert r.status_code == 200
|
|
r = client.get("/themes/core/static/css/404_NOT_FOUND")
|
|
assert r.status_code == 404
|
|
r = client.get("/themes/core/static/%2e%2e/%2e%2e/%2e%2e/utils.py")
|
|
assert r.status_code == 404
|
|
r = client.get("/themes/core/static/%2e%2e%2f%2e%2e%2f%2e%2e%2futils.py")
|
|
assert r.status_code == 404
|
|
r = client.get("/themes/core/static/..%2f..%2f..%2futils.py")
|
|
assert r.status_code == 404
|
|
r = client.get("/themes/core/static/../../../utils.py")
|
|
assert r.status_code == 404
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_pages_routing_and_rendering():
|
|
"""Test that pages are routing and rendering"""
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
html = """##The quick brown fox jumped over the lazy dog"""
|
|
route = "test"
|
|
title = "Test"
|
|
gen_page(app.db, title, route, html)
|
|
|
|
with app.test_client() as client:
|
|
r = client.get("/test")
|
|
output = r.get_data(as_text=True)
|
|
assert "<h2>The quick brown fox jumped over the lazy dog</h2>" in output
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_user_get_profile():
|
|
"""Can a registered user load their private profile (/profile)"""
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
register_user(app)
|
|
client = login_as_user(app)
|
|
r = client.get("/profile")
|
|
assert r.status_code == 200
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_user_can_access_files():
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
from CTFd.utils.uploads import rmdir
|
|
|
|
chal = gen_challenge(app.db)
|
|
chal_id = chal.id
|
|
path = app.config.get("UPLOAD_FOLDER")
|
|
|
|
location = os.path.join(path, "test_file_path", "test.txt")
|
|
directory = os.path.dirname(location)
|
|
model_path = os.path.join("test_file_path", "test.txt")
|
|
|
|
try:
|
|
os.makedirs(directory)
|
|
with open(location, "wb") as obj:
|
|
obj.write("testing file load".encode())
|
|
gen_file(app.db, location=model_path, challenge_id=chal_id)
|
|
url = url_for("views.files", path=model_path)
|
|
|
|
# Unauthed user should be able to see challenges if challenges are public
|
|
set_config("challenge_visibility", "public")
|
|
with app.test_client() as client:
|
|
r = client.get(url)
|
|
|
|
assert r.status_code == 200
|
|
assert r.get_data(as_text=True) == "testing file load"
|
|
|
|
# Unauthed user should not be able to see challenges if challenges are private
|
|
set_config("challenge_visibility", "private")
|
|
with app.test_client() as client:
|
|
r = client.get(url)
|
|
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
# Authed user should be able to see files if challenges are private
|
|
register_user(app)
|
|
client = login_as_user(app)
|
|
r = client.get(url)
|
|
assert r.status_code == 200
|
|
assert r.get_data(as_text=True) == "testing file load"
|
|
|
|
with freeze_time("2017-10-5"):
|
|
# Friday, October 6, 2017 12:00:00 AM GMT-04:00 DST
|
|
set_config("start", "1507262400")
|
|
for v in ("public", "private"):
|
|
set_config("challenge_visibility", v)
|
|
|
|
# Unauthed users shouldn't be able to see files if the CTF hasn't started
|
|
client = app.test_client()
|
|
r = client.get(url)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
# Authed users shouldn't be able to see files if the CTF hasn't started
|
|
client = login_as_user(app)
|
|
r = client.get(url)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
# Admins should be able to see files if the CTF hasn't started
|
|
admin = login_as_user(app, "admin")
|
|
r = admin.get(url)
|
|
assert r.status_code == 200
|
|
assert r.get_data(as_text=True) == "testing file load"
|
|
|
|
with freeze_time("2017-10-7"):
|
|
# Friday, October 6, 2017 12:00:00 AM GMT-04:00 DST
|
|
set_config("end", "1507262400")
|
|
for v in ("public", "private"):
|
|
set_config("challenge_visibility", v)
|
|
|
|
# Unauthed users shouldn't be able to see files if the CTF has ended
|
|
client = app.test_client()
|
|
r = client.get(url)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
# Authed users shouldn't be able to see files if the CTF has ended
|
|
client = login_as_user(app)
|
|
r = client.get(url)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
# Admins should be able to see files if the CTF has ended
|
|
admin = login_as_user(app, "admin")
|
|
r = admin.get(url)
|
|
assert r.status_code == 200
|
|
assert r.get_data(as_text=True) == "testing file load"
|
|
finally:
|
|
rmdir(directory)
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_user_can_access_files_with_auth_token():
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
from CTFd.utils.uploads import rmdir
|
|
|
|
chal = gen_challenge(app.db)
|
|
chal_id = chal.id
|
|
path = app.config.get("UPLOAD_FOLDER")
|
|
|
|
md5hash = hexencode(os.urandom(16))
|
|
|
|
location = os.path.join(path, md5hash, "test.txt")
|
|
directory = os.path.dirname(location)
|
|
model_path = os.path.join(md5hash, "test.txt")
|
|
|
|
try:
|
|
os.makedirs(directory)
|
|
with open(location, "wb") as obj:
|
|
obj.write("testing file load".encode())
|
|
gen_file(app.db, location=model_path, challenge_id=chal_id)
|
|
url = url_for("views.files", path=model_path)
|
|
|
|
register_user(app)
|
|
with login_as_user(app) as client:
|
|
req = client.get("/api/v1/challenges/1")
|
|
data = req.get_json()
|
|
file_url = data["data"]["files"][0]
|
|
|
|
with app.test_client() as client:
|
|
r = client.get(url)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
r = client.get(
|
|
url_for(
|
|
"views.files",
|
|
path=model_path,
|
|
token="random_token_that_shouldnt_work",
|
|
)
|
|
)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
r = client.get(file_url)
|
|
assert r.status_code == 200
|
|
assert r.get_data(as_text=True) == "testing file load"
|
|
|
|
# Unauthed users shouldn't be able to see files if the CTF is admins only
|
|
set_config("challenge_visibility", "admins")
|
|
r = client.get(file_url)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
set_config("challenge_visibility", "private")
|
|
|
|
with freeze_time("2017-10-5"):
|
|
# Friday, October 6, 2017 12:00:00 AM GMT-04:00 DST
|
|
set_config("start", "1507262400")
|
|
|
|
# Unauthed users shouldn't be able to see files if the CTF hasn't started
|
|
r = client.get(file_url)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
with freeze_time("2017-10-5"):
|
|
# Friday, October 6, 2017 12:00:00 AM GMT-04:00 DST
|
|
set_config("start", "1507262400")
|
|
for v in ("public", "private"):
|
|
set_config("challenge_visibility", v)
|
|
|
|
# Unauthed users shouldn't be able to see files if the CTF hasn't started
|
|
client = app.test_client()
|
|
r = client.get(file_url)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
# Authed users shouldn't be able to see files if the CTF hasn't started
|
|
client = login_as_user(app)
|
|
r = client.get(file_url)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
# Admins should be able to see files if the CTF hasn't started
|
|
admin = login_as_user(app, "admin")
|
|
r = admin.get(file_url)
|
|
assert r.status_code == 200
|
|
assert r.get_data(as_text=True) == "testing file load"
|
|
|
|
with freeze_time("2017-10-7"):
|
|
# Friday, October 6, 2017 12:00:00 AM GMT-04:00 DST
|
|
set_config("end", "1507262400")
|
|
for v in ("public", "private"):
|
|
set_config("challenge_visibility", v)
|
|
|
|
# Unauthed users shouldn't be able to see files if the CTF has ended
|
|
client = app.test_client()
|
|
r = client.get(file_url)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
# Authed users shouldn't be able to see files if the CTF has ended
|
|
client = login_as_user(app)
|
|
r = client.get(file_url)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
# Admins should be able to see files if the CTF has ended
|
|
admin = login_as_user(app, "admin")
|
|
r = admin.get(file_url)
|
|
assert r.status_code == 200
|
|
assert r.get_data(as_text=True) == "testing file load"
|
|
finally:
|
|
rmdir(directory)
|
|
destroy_ctfd(app)
|
|
|
|
|
|
def test_user_can_access_files_if_view_after_ctf():
|
|
app = create_ctfd()
|
|
with app.app_context():
|
|
from CTFd.utils.uploads import rmdir
|
|
|
|
chal = gen_challenge(app.db)
|
|
chal_id = chal.id
|
|
path = app.config.get("UPLOAD_FOLDER")
|
|
|
|
md5hash = hexencode(os.urandom(16))
|
|
|
|
location = os.path.join(path, md5hash, "test.txt")
|
|
directory = os.path.dirname(location)
|
|
model_path = os.path.join(md5hash, "test.txt")
|
|
|
|
try:
|
|
os.makedirs(directory)
|
|
with open(location, "wb") as obj:
|
|
obj.write("testing file load".encode())
|
|
gen_file(app.db, location=model_path, challenge_id=chal_id)
|
|
|
|
register_user(app)
|
|
with login_as_user(app) as client:
|
|
req = client.get("/api/v1/challenges/1")
|
|
data = req.get_json()
|
|
file_url = data["data"]["files"][0]
|
|
|
|
# After ctf end
|
|
with freeze_time("2017-10-7"):
|
|
# Friday, October 6, 2017 12:00:00 AM GMT-04:00 DST
|
|
set_config("end", "1507262400")
|
|
|
|
r = client.get(file_url)
|
|
assert r.status_code == 403
|
|
assert r.get_data(as_text=True) != "testing file load"
|
|
|
|
set_config("view_after_ctf", True)
|
|
r = client.get(file_url)
|
|
assert r.status_code == 200
|
|
assert r.get_data(as_text=True) == "testing file load"
|
|
finally:
|
|
rmdir(directory)
|
|
|
|
destroy_ctfd(app)
|