* Read smtp server configuration from config.py
The CTFd/utils/email/smtp.py file has a provision to read SMTP
configuration for all fields from either the UI or CTFd/config.py file.
Two fields, `MAIL_SERVER` and `MAIL_PORT`, were not being read from the
config.py file. This commit fixes this issue.
* Update simple SMTP server tests
* Reimplement admin send mail to users as `/api/v1/users/<user_id>/email`
* Update form and related Javascript
* Write test for controller
* Closes#897
* Fix creating users from the admin panel while name changes are disabled; clean up user & team schema validators
* Closes#832
* Coerce /api/v1/teams/<team_id> to /api/v1/teams/<int:team_id>
* Consider account configs when user patches their own account
* Add test for name changing
* Add test to ensure that users changing emails are marked unconfirmed
* Only allow users to change to emails in whitelisted domains
* Simplify assertion for error check
* Require CSRF-Token header on state changing API requests
* Require CSRF nonces on more than just POSTs,
* Replace usage of `fetch()` with custom `CTFd.fetch()` implementation
* Fix subdirectory deployments in a generic manner by modifying`request.path` to combine both `request.script_root` and `request.path` and also creating a request preprocessor to redirect users into the true CTFd app. Without this sessions will be invalid because sessions will be set to a subdirectory.
* Add a test for testing subdirectory deployments and the customized CTFdRequest object.
* Fix `TestingConfig.SAFE_MODE` getting stuck in between tests.
* Order AWS keys properly in travis.yml
* Redirect to `request.full_path` instead of just `request.path`
* Adds plugin functions to register javascript and CSS in the admin panel
* Move global plugin script/stylesheet lists into application factory specific lists
* Closes#804
* Show notification titles on the notification list page
* Allow for deleting notifications
* Update notification UI in admin panel
* Make /api/v1/notifications/<id> accessible to all
* Default `login_as_user()` and `register_user()` to fail on invalid credentials
* Fix email confirmations and improve test.
* Breaks confirm.html page because of change from team to user
* Clean up admin mail settings to use new label/small structure
* Fix password resets from double hashing passwords
* Fixing a bug where prerequisites could not be set for dynamic challenges due to a division by zero error where defaults were being set unnecessarily.
* Creating unit test for adding requirement to dynamic challenges
* Fix downloading files as an anonymous user.
* Fix viewing challenges anonymously if they have empty requirements. Closes#789
* Allow anonymous users to see see challenges with empty requirements or anonymized challenges
* Fix setting mail_username, mail_password; Fix setting auth for get_smtp
* Add MAIL_USEAUTH to config.py
* Add more mail documentation to config.py
* Prevent overriding smtp attributes on config update; update email tests to use mail_userauth
* Grant admin write access to verified field in UserSchema.
* Add test admin can view and modify verified status
* Add test for creating users with settings
* Add codecov threshold for test failures
* Update base.html to move custom_css precedence
* Fix Page creation & caching
* Add Page loading test
* Fix creating Page with an invalid route
* Don't call cache.clear() unless it's absolutely needed
* Fix showing uploaded files after uploading to media library
* Fix previewing challenges from the admin panel if it has requirements
* Hardcode CACHE_THRESHOLD to 0 in FileSystemCache to prevent random sessions getting deleted (Closes#772)
* Fix creating users, teams from the API, hash password in models vs in schemas, stop caching CSS at the decorator level, fix tests
* Fix whitelisted emails and add test
* Set proper defaults in accounts config
* Fix dynamic challenges to work in user mode and team mode (Closes#759)
* Add test for solving dynamic challenges and challenge de-valuation
* Add missing oauth_login link to team_enrollment.html
* Update CHANGELOG
* Update README
* Upgrade migration script to port visibility settings
* Add message about visibility settings and port over visibility settings
* Close#758
* Add tests for dynamic value challenges
* Fix user and admin panel user/team graphs
* Closes#682
* Unify login and logout under specific functions
* Closes#659
* Rename Challenges.hidden to Challenges.state
* Start to clean up API and front end integration starting with profile updating
* Slightly cleaner code
* Clean API to respond with success, data, and status codes
* Simpler COUNTRIES_LIST and update profile to use COUNTRIES_LIST
* Lookup country code in users page. Update front end calls to get API data properly
* Fix some API endpoints and fix JS to process new responses
* Update config.py to support new values
* Closes#635
* Update some code to handle user types, add email domain whitelisting
* Write a logging wrapper
* Use logging wrapper for submissions
* Close#656
* Break up config.html to make it easier to maintain
* Fix logging, domain_whitelist, and config
* Improving views.py, starting to add Announcements
* Starting announcements front end
* Make it easier to see large images, clean up some more REST API differences
* Closes#668
* Update Proxyfix config to REVERSE_PROXY
* Add announcements front end
* Move creation/edit modals into seperate files. Start moving user updating into their admin profile pages.
* Update font-awesome to 5.4.1
* Switch to user-edit icon
* Update the update_check function to send up more anonymous data for statistics purposes.
* Start work on #640
* Add the user action modals and update API to fix responses
* Fix admin teams page
* Add challenge requirements
* Implement anonymous locked challenges
* Team editting from admin panel
* Switch from simple cache to filesystem cache
* Implements a Cache backed server side session (#658) and fixes Users editting endpoint
* Add our messaging for docs
* Closes#700
* Remove invalid import
* Move challenge enditting around a whole lot and probably break a bunch of things
* Show challenge names in prerequisites instead of challenge IDs
* Closes#661
* Change user templates to use url_for
* Remove extra function
* Rewrite admin panel to use url_for
* Fix events to work under subdirectories
* Start cleaning up config panel
* Fix filesystem uploader; deprecate view_challenges_unregistered, view_scoreboard_if_authed, prevent_registration, view_after_ctf; implement new visibility decorators
* Remove workshop mode, fix some glitches with the new visibility settings
* Fix ctf_logo on core theme
* Fix setup errors
* Removing default from get_config b/c of memoization issues and getting some tests working
* Relax email regex validation rule (#693)
* Update to pycodestyle and fix new lint errors
* Add a ctf_id to update_check
* Change challenge plugin layout. Rename mailgun configs to be more descriptive (Closes#702)
* Detect if people try to set routes with '/' to simplify #690
* Closes#690
* Clean up some code
* Clean up challenge submit to rate limit
* Fix js version compatability issue
* Close some TODOs
* Hide challenges if not authenticated
* Make set_config reset the cache for those config values
* Return 404 on empty challenges for /api/v1/<challenge_id>/solves
* Fix setting boolean configs
* Properly change account config settings
* Move datetimes to isoformat (Closes#703)
* Remove all .isoformat() calls because it isn't UTC aware (ends in Z). Switch to isoformat function & filter
* Make /v1/submissions endpoint work for admin submission creation
* Make oauth_id unique for Users and Teams
* Move challenge submission endpoint and implement mark solved. Fix some isoformat issues.
* Only show team's missing challenges if in team mode
* Adding support for Hints & Unlocks
* Update challenge submission url
* Fix encoding functions in Python3
* Fix hexencode in Python3
* Added functional tests for challenges API for non-admin users (#705)
* Set hint default type to be standard
* Fix some JS issues. Closes#704
* Implement session.regenerate on top of the CachingSessionInterface
* Challenge challenge attempt responses from numbers to strings
* Fix password updating for UserSchema
* Remove leftover challenge submission code
* Remove old migrations :(, resolve challenge requirements not loading correctly, move migration functions
* Added functional tests for challenges/hints/admin API (#710)
* Fix helpers and re-add JSONLite
* Install MySQL 5.7
* Try more mysql
* Update password for mysql
* Fixing issuse in Users.get_solves
* Add new import/export code
* Switch to CTFdSerializer for Python 3
* Re-implement import exports and add a very flaky test
* Redesign submissions API response
* Get export to roundtrip in tests
* Int score b/c Decimal is not JSON serializeable
* Remove unused route methods
* Fix POST /api/v1/configs and start adding admin tests
* Add user_id and team_id to top/10
* Fix admin creating Teams
* Fix Team website validation
* Change admins_only to reply with a 403 if the request is JSON
* Organize admin tests and fix authed_only to return 403 on unauthed
* Adding check_account_visibility, check_score_visibility for /api/v1/teams/<team_id>/(solves|awards|fails)
* Fix teams/me endpoints again
* Fix users/me endpoints to return 403 if unauthed
* Fix Python 3 config API
* Add fetch and promise polyfills. (#712)
* Add exec to docker-entrypoint.sh (#713)
* Display import_ctf Exceptions via repr (#651)
- Wraps exceptions on `/admin/import` returned to users in a `repr()`, making debugging easier.
* Add error messages to the admin panel, fix schemas for users, start working on UI for imports/exports
* Make unauthed challenge submission attempt return 403 instead of 302, Fix user deletion, fix associated tests, remove TODOs
* Remove old means of creating solves
* Remove most of the content from teams.js and users.js
* Remove extra code from /challenges.js
* Fix POST'ing & PATCH'ing pages
* Make (users|teams)/fails return only count to users. Fix public score graphs to factor in awards
* Fix admin side scoregraphs. Fix Awardschemas for admins
* Add requirements to db migration
* Adding some team decorators
* Fix require_team_mode decorator
* Make verified emails decorator return 403 on JSON requests
* Redo initial revision
* Add SQLiteJSON back
* Adding ratelimit to /redirect and removing POST from /oauth
* Fix PATCH tags
* Actually fix PATCH tags
* Simplify 500.html
* Added tests for challenges, awards, files, flags, hints ... (#723)
* Added tests for challenges, awards, files, flags, hints, notifications, pages, submissions, tags
* Fix user data validation functions, Fix hidden challenges and include test
* Add a locked state to attempt
* OAuth teams get verified, use logging functions in redirect route
* Removing extra print call
* Update requirements.txt
* Fix possible AttributeError
* Start work on #716
* Closes#717
* Fix issue patching teams
* Rename .j2 to .html, implement preview for challenges if admin
* Move admin/challenge.html to admin/challenges/challenge.html
* Remove old modals
* Add Reset CTF button (#639)
* Add Reset link to config.html
* Delete Tracking
* files handler should return a 404 on files it cant find
* Denote official teams (#729), make scoregraph fill to zero
* Remove old javascript files, make some challenge elements refresh by reloading
* Fix team editting modals to work more reliably
* Fix rendering of CTF paused
* Remove hide_scores funtion and roll it into scores visibility
* Log to stdout/stderr by default (#719)
* Fix user searching
* Remove searching for users/teams by country
* Add badges to admin team and user pages, implement user banning (#643)
* Remove shell.py, clean up admin team.html, add tests for banned users, teams
* Start cleaning up dynamic_challenges to meet new challenge type plugin format
* Remove POST method from teams.public
* Add credentials: 'same-origin' to all fetch calls (#734)
* Add challenge preview, add challenge deletion, fix file deletions when deleting challenges
* Fix imports UI (#735)
* Show prerequisites before adding a blank one (#738), Refresh all challenges after a submission (#739)
* Admins can see hidden challenges
* Fix some UI elements, fix loading location hash, set version to be 2.0.0
* Clean up some challenge plugin pages
* Add default for flag type
* Fix Python3 bytes/str issues
* Add in MLC urls and support user mode for oauth
* Fix seeing user graphs when scores are hidden, clean up setup.html, add links to MLC oauth
* Add state parameter support
* Use URLSafeTimedSerializer wrapper for sending token based emails
* setting APPLICATION_ROOT from env var (#732)
* Rearrange config.py and update README
* Updating README
* Mark 1.2.0.
* Update CHANGELOG.
* Add `window.challenge.data` object.
* Don't raise a 500 when an endpoint can't be found but was POST'ed too. Mostly from scanners...
* Add test for not found endpoints.
* Fixing issue with clearing logo on config update.
* Truncate scoreboard team name to 50 characters.
* Changing to a new plugin oriented challenge type plugin and fixing extra width on admin chal description
* Add window.challenge.submit, renderSubmissionResponse, and csrf_nonce
* Update admin side renderer calls
* Updating to Flask 1.0 and adding files for flask run
* Adding a preliminary case-insensitive key
* Adding case insensitive keys
* Adding CTF Logo
* Reducing the amount of team information shown on the main page
* Add better base64 helpers
* Switch from button to badge
* Rudimentary solve checking from admin panel
* Refine admin chals solves view & fix PEP8
* Compare base64 encoded data with bytestring
* Removing need to urlencode/urldecode in base64 wrappers
* Adding decorator documentation
* Randomly order tests & add test for case_insensitive flags
* Add regex flag case_insensitive test
* Add tests for /admin/chal/1/solves and ctf_logo
* Chals endpoint seperation (#572)
* Separate the logic of ctftime and email confirmations and admin checking into decorators
* Separate the chals endpoint into /chals and /chals/:id. Closes#552, #435.
* Challenges are now loaded directly from the server before being displayed to the user.
* Challenge modals now use `{{ description }}` instead of `{{ desc }}`.
* 403 is now a more common status code and can indicate that a CTF has not begun or that you are not logged in. This is in addition to CSRF failures.
* Update tests to new behavior
* Fixing glitch if an entry chal or team id isn't defined
* Markdown it (#574)
* Replace Marked with Markdown-It
* Update modal change (#576)
* Switch update modals to use nunjucks instead of JS to load in data.
* Fix previewing challenges after hitting the challenge update button.
* Fix edit-files issue with an unnecessary request.
* Fix solves button
* Closes#592
* Upgrade to Bootstrap v4 beta 3
* Fix incorrect FontAwesome5 icon
* Fixing regressions & code quality issues. Files, Tags & Hints now appear in the admin challenge preview. Fixed color issues with file buttons and badges. Pass script_root into challenge type plugin.
* Fixing incorrect FontAwesome5 icon
* Fix test for /admin/chals/<chalid>
* Expand test to include tags, hints, files
* Improve imports/exports to reduce the likelihood of a conflict
* To allow previous version imports of keys to work - fill in key `type` from `key_type`. (#520)
* Adding an import_ctf test
* Bootstrap v4 (#490)
* Upgrading original theme to use Bootstrap v4 and overall improve use of utility classes
* Fixing graph issues. Colors per team & cleaner hover
* The solves tab now shows relative time instead of absolute time
* Redesign admin theme
* Updating modals and changing form name from desc to description
* Moving CSS config from Pages to Config page
* Adding IP address count to statistics
* Move control of certain modals (files, flags, tags, hints) to challenges page
* Expanding size of config page
* Combining statistics and graphs pages
* Moving percentage solved to the statistics page instead of the admin challenges page
* Rename Keys.key_type to Keys.type (#459) (#478)
* Rename keys.key_type to keys.type (#459)
* Fixing previous migration to not be worried about key_type v type
* Fixing loading of challenge type plugins
* Switching from Handlebars to Nunjucks (#491)
* Switching from Handlebars to Nunjucks
* Allow admins to unlock hints before CTF begins and test that this is not allowed for regular users
* Authed only (#492)
* Adding authed_only decorator and adding next to url_for
* Adding a basic preview to hints (#494)
* Hints have a preview now for creating and updating hints. HTML and markdown are still allowed.
* Ezq (#495)
* Adding ezq as a simple wrapper around bootstrap modals
* Use tabs not spaces and remove gray background on inputs
* Adding title & draft to Pages. Making page preview open a new tab (#497)
* Adding title & draft to Pages.
* Making page preview open a new tab instead of render in the existing tab
* Draft pages cannot be seen without a preview
* Update check (#499)
* Add update_check function
* Notify user that a CTFd update is available in the admin panel
* Adding update_check tests
* Ratelimit (#500)
* Implementing a ratelimit function
* Fix error page formatting
* Add rate limiting tests
* Rate limit authentication functions and rate limit admin send email function
* Load user solves before we load challenges to avoid unstyled buttons (#502)
* Add a challenge preview (#503)
* Adding a challenge preview to the admin panel
* Change /admin/chals/<int:chalid> to /admin/chal/<int:chalid>
* Adding codecov (#504)
* Test coverage at https://codecov.io/gh/CTFd/CTFd
* Sendmail improvements (#505)
* Add get_smtp timeout, add sendmail error messages
* Adding more error handling to sendmail
* Adding Flask-Script (#507)
* Pause ctf (#508)
* Implement CTF pausing
* Test CTF pausing
* Fix loading challenges for users (#510)
* Fix loading challenges for users
* Temporarily switch themes in test
* Pause help text (#509)
* Adding pause help text
* Pages authed (#511)
* Adding authentication options to pages
* Adding tests for accessing pages while draft & auth_required
* Merging master into 1.1 (#513)
* Name the core theme and remove the original theme
* Implementing workshop mode
* Fixing a bug in /chals/solves where challenges with 0 solves weren't hidden.
* Spinner errors are now 20vh down instead of 210px down
* Users now use their private team endpoint at /team instead of /team/<id>
* Disallow email-address team names & allow login with team name or email address
* Don't show password reset form if server isn't configured
* Add a message to contact admins instead of submit password reset form
* Add utils.check_email_format()
* Adding config.json concept in lieu of config.html
* Add links to the admin menubar from a plugin
* Add links to the user navigation menubar from plugin
* Add tests for navbar links
* Closes#423
* Allows Challenges to have custom tables which allow them to have custom behavior
* Adding create, update, delete staticmethods giving Challenge Types a static interface to implement
* Updating to use dataset and datafreeze
* Use a new datafreeze serializer to get around Python 3 issues.
* Update requirements.txt
* Add simple test for export_ctf()
* Adopting a challenge type layout from deckar01
* Move standard challenge modals into the plugin
* Migration to change challenge type id to a string
* Travis testing now builds with MySQL, SQLite, and Postgres
* Rework get_standings to use the row ID instead of the saved time because of differences in database time precision
* Users should always be able to get their score, even if banned
* Fixing scoring logic when users haven't solved problems
* Hide None descriptions for awards
CTFd creates the database instead of the docker-compose files which allows us to control encoding. Also adds a test for registering with a unicode team name.
* Switching to using strings to store IP addresses because of the issues with storing them properly, Fixes#302, Fixes $306
* Only runs migrations when using a real database because SQlite is too inflexible to support migrations properly
* Removes calls to the ip helper functions but they can remain in case someone needs them in a plugin.
* Switching to Flask-Migrate to create tables/database. Adding Hints & Unlocks.
* Adding db.create_all call for sqlite db's (sqlite is not properly handled with alembic yet)
* Python 3 testing works properly with 3.5
* Adding admin side of hints
* Hints are viewable for users
* Testing 3.6
* Fixing Python 3 testing
* Fixing both kinds of tests :)
* PEP8 lint project and add linting checks to build process (#229)
* Revert "PEP8 lint project and add linting checks to build process (#229)"
This reverts commit 15d89d2b66030cdc2a6276b0a73acaa4912c06ab.
* Use <int:xxx> in routes to prevent some errors 500 (#192)
* Use first_or_404() to prevent some errors 500 (#193)
* Add a populating script for awards. (#191)
* Creating upload_file util
* Marking 1.0.0 in __init__ and starting database migrations
* Upgrading some more HTML
* Adding CHANGELOG.md
* PEP 8 compliance (#183)
* Group imports: standard library, third party, local
* Remove unnecessary spaces
* Comments should start with a # and a single space
* Adding tests for GETs on user facing pages
* Adding more user facing tests
51% test coverage
* Fixes#182
* Cleaning up Pages
Fixes a bug with CSS updating
Kevin Chung
s-nirali
FaultyMach1ine
Peter
Raihan Ramadistra
Nick Gonella
krzys_h
Jared Deckard