Fix hidden pages not being able to load (#1019)

* Fixes bug where pages marked as `hidden` weren't loading
    * It's possible that some users used this behavior however this fix implements the correct behavior. The `draft` setting can be used to completely hide pages.

CTFd/utils/config/pages.py

@@ -13,5 +13,5 @@ def get_pages():
 @cache.memoize()
 def get_page(route):
     return Pages.query.filter(
-        Pages.route == route, Pages.draft.isnot(True), Pages.hidden.isnot(True)
+        Pages.route == route, Pages.draft.isnot(True)
     ).first()

tests/test_views.py

@@ -13,7 +13,9 @@ from tests.helpers import (
     gen_file,
     gen_page,
 )
+from CTFd.cache import clear_pages
 from CTFd.utils import set_config
+from CTFd.utils.config.pages import get_pages
 from CTFd.utils.encoding import hexencode
 from freezegun import freeze_time
 
@@ -89,6 +91,32 @@ def test_page_requiring_auth():
     destroy_ctfd(app)
 
 
+def test_hidden_pages():
+    """Test that hidden pages aren't on the navbar but can be loaded"""
+    app = create_ctfd()
+    with app.app_context():
+        page = gen_page(
+            app.db,
+            title="HiddenPageTitle",
+            route="this-is-a-hidden-route",
+            content="This is some HTML",
+            hidden=True,
+        )
+        clear_pages()
+        assert page not in get_pages()
+
+        with app.test_client() as client:
+            r = client.get("/")
+            assert r.status_code == 200
+            assert "HiddenPageTitle" not in r.get_data(as_text=True)
+
+        with app.test_client() as client:
+            r = client.get("/this-is-a-hidden-route")
+            assert r.status_code == 200
+            assert "This is some HTML" in r.get_data(as_text=True)
+    destroy_ctfd(app)
+
+
 def test_not_found():
     """Should return a 404 for pages that are not found"""
     app = create_ctfd()