Fix access to unreleased challenges through /chals/<id> endpoint (#689)

2018-10-06 10:29:30 +02:00 · 2018-10-06 10:29:30 +02:00 · 41933cc367
parent 14ea952a2a
commit 41933cc367
1 changed files with 2 additions and 0 deletions
--- a/CTFd/challenges.py
+++ b/CTFd/challenges.py
@ -133,6 +133,8 @@ def chal_view(chal_id):
    teamid = session.get('id')

    chal = Challenges.query.filter_by(id=chal_id).first_or_404()
+    if chal.hidden:
+        abort(404)
    chal_class = get_chal_class(chal.type)

    tags = [tag.tag for tag in Tags.query.add_columns('tag').filter_by(chal=chal.id).all()]