Tags: crd/CTFd
Tags
Mark 3.2.0 release date in CHANGELOG (CTFd#1756) # 3.2.0 / 2020-12-07 **General** - Add Team invites. - Team invites are links containing a token that allow a user to join a team without knowing the team password - Captains can generate invite tokens for their teams - Admins can generate Team invite links as well - Improved Team handling - Prevent team joining while already on a team - Return 403 instead of 200 for team join/create errors - Allow team captains whose teams haven't done anything to disband their team - Allow for uploading navbar logo, favicon, and index page banner during initial setup - Fixed issue in teams mode where a user couldn't unlock a hint despite their team having enough points - The fix for this is essentially to allow the user's points to go negative - Imports have been made more stable - This is primarily done by killing MySQL processes that are locking metadta - This is a subpar approach but it seems to be the only solution to avoid a metadata lock in MySQL. This approach did not appear to be needed under Postgres or SQLite **API** - Addition of `POST /api/v1/teams/me/members` to generate invite tokens for teams - Fixed an issue in `POST /api/v1/awards` where CTFd would 500 when a user could not be found by the provided `user_id` - `POST /api/v1/unlocks` in teams mode now uses the team's score to determine if a user can purchase a hint - Properly check for existing unlocks in teams mode in `POST /api/v1/unlocks` - `/api/v1/notifications` and `/api/v1/notifications/[notification_id]` now have an html parameter which specifies the rendered content of the notification content **Themes** - Add Team Invite icon and Disband Team icon to teams/private.html - Add teams/invite.html file to handle team joining with invites - Added syntax highlighting to challenge descriptions, pages, hints, notifications, comments, and markdown editors - This is done with `highlight.js` which has been added to `package.json` - Fix notifications to properly fix/support Markdown and HTML notifications - Notifications SQL Model now has an html propery - Notifications API schemas now has an html field - Removed MomentJS (see https://momentjs.com/docs/#/-project-status/) in favor of dayjs - dayjs is mostly API compatible with MomentJS. The only major changes were: - dayjs always uses browser local time so you don't need to call `.local()` - dayjs segments out some MomentJS functionality into plugins which need to be imported in before using those features - Fixed issue in `challenge.html` where the current attempt count would have a typo - Fixed issue in `challenge.html` where the max attempts for a challenge would not show if it was set to 1 - Edit donut charts to have easier to read legends and labels - Make data zoom bars thinner and more transparent - Add logo, banner, and favicon settings to the setup.html **Plugins** - The `auth.register` (`/register`) endpoint now accepts a `?next=` parameter to define where to redirect to after registration - There is now a `registered_only` decorator to redirect users to `auth.register` (`/register`) instead of `auth.login` (`/login`) - Don't run `db.create_all()` as much during plugin upgrade or during imports - By avoiding this we can let alembic and migrations do more of the table creation work but this means that plugins specifically opt into `app.db.create_all()` and will not implicitly get it through `upgrade()`. - This means plugins that run `upgrade()` without a migrations folder (no idea who would do this really) will need to upgrade their code. - The plugin `upgrade()` function now accepts a `lower` parameter which specifies what lower revision should be used to start from. - This is used to support plugin migrations during import so that we can import data directly at the point that the import was taken from - `lower="current"` means to use the current revision and `lower=None` would mean to use the absolute base revision (e.g. plugin's first installation) - By default this doesn't change `upgrade()` behavior **Admin Panel** - Add Favicon uploading to the Admin Panel - Move Logo uploading to the Theme tab in the Admin Panel - The challenge left side bar tabs have been rewritten into VueJS components. - This fixes a number of issues with the consistency of what data is deleted/edited in the challenge editor - This also prevents having to refresh the page in most challenge editing situations - Fixed a possible bug where the update available alert wouldn't go away on server restart - Examples for regex flags are now provided - Wrong submissions has been renamed to Incorrect Submissions - Graphs in the Admin Statistics page will now scroll with mouse wheel to improve browsing large datasets - Fixed an issue where Users/Teams could be created with a null password **Deployment** - A restart policy set to `always` has been added to nginx in docker-compose - Rename `requirements.txt` to `requirements.in` and generate `requirements.txt` using `pip-tools` under Python 3.6 - `UPLOAD_PROVIDER` no longer has a default `filesystem` set in config.ini. Instead it is defaulted through `config.py` **Miscellaneous** - The `psycopg2` dependency in development.txt has been removed in favor of `psycopg2-binary` which was updated to 2.8.6 - The `moto` dependency in development.txt has been updated to 1.3.16 - Add `pip-tools` to `development.txt` - Add `import_ctf` and `export_ctf` commands to `manage.py` and deprecate `import.py` and `export.py` - Override the `MAIL_SERVER` config with the `TESTING_MAIL_SERVER` envvar during tests - `ping` events in the notification event handler have been fixed to not send duplicates
Mark 3.1.1 (CTFd#1663) # 3.1.1 / 2020-09-22 **General** - Fix notification deliverability when there are multiple tabs open - Only play notification sounds in the master tab that receives the notification **Admin Panel** - Fix issue preventing admins from emailing users through the Admin Panel - Improve Notification UI - Clears notification form after notification submission - Add notification to notification list after creation **Themes** - Add fix for trying to increment solves when solves are hidden - Update JS dependencies to fix a transpiliation error preventing optional custom fields from being left empty - `@babel/core`, `@babel/preset-env`, `@fortawesome/fontawesome-free`, and `babel-loader` were updated but only `@babel/core` needs to be updated to resolve the transpiliation issue - Remove `console.log` statements from minified production JS - Compress notification sound and document the compression command **Miscellaneous** - Add the ability to override the sender header of email sent via SMTP with the `MAILSENDER_ADDR` config value
Mark 3.0.2 (CTFd#1617) # 3.0.2 / 2020-08-23 **Admin Panel** - Fix submission searching in Admin Panel - Fix update banner being hidden behind navbar **Plugins** - Change default `input` & `submit` blocks in `challenge.html` to use the default values specified in the original challenge type plugins
Mark 3.0.1 (CTFd#1594) # 3.0.1 / 2020-08-12 **General** - Fix issue where admins could not see user graphs/api data if score visibility was set to hidden **Admin Panel** - Allow the Admin Panel Submissions page to filter by Account IDs, Challenge IDs, and Challenge Names - Link to correct submissions for challenge from the challenge page **API** - Fix regression for creating hints via ctfcli. See CTFd#1582 for details. CTFd#1582. - Deprecate `CTFd.api.v1.helpers.models.build_model_filters` and wrap it to `CTFd.utils.helpers.models.build_model_filters` **Themes** - Fix team pages to use the correct core errors component **Plugins** - Fix issues with previewing challenges under some challenge type plugins **Deployment** - Values specified in `config.ini` will now supercede values specified via environment variable. Config behavior is as follows: 1. Config Key exists in `config.ini` and is set to a value. That value becomes the app config. 2. Config Key exists in `config.ini` but is set to an empty string. An envvar with the same name is looked up. The envvar's value is used as the app config. 3. If the envvar is not found, fall back to the default specified value in `config.py` 4. If there is no default, use None or an empty string
Mark 3.0.0 (CTFd#1572) # 3.0.0 / 2020-07-27 ## Changelog Summary The CTFd v3 Changelog represents the changes from v2.5.0 to v3. It is a summarized version of the changes that occured in all CTFd v3 beta/alpha releases. CTFd v3 contains some breaking changes but many plugins remain compatible. Themes will need some minor changes to be compatible with v3. These changes are made with great consideration to existing installations and for the health of the overall CTFd project. If you rely on specific behavior, you can always download the last CTFd v2 release on Github. Official plugin/theme updates will be sent to the email addresses on file. The major changes in CTFd v3 are as follows with the detailed changelog beneath: - ### Server Side HTML/Markdown Rendering HTML rendering in some cases (challenge description rendering, hint content rendering) has been moved to the server side. Previously it was rendered by the browser but this led to a lot of duplicated behavior and complexity in some plugins. Rendering that HTML content on the server allows CTFd to take more advantage of theme content and reduce duplicated code across themes. In addition, HTML sanitization can be enabled on the CTFd installation to prevent the injection of malicious scripts in HTML content. - ### CommonMark CTFd now uses [CommonMark](https://commonmark.org/) for HTML/Markdown rendering. This leads to much more consistent rendering of HTML/Markdown content. In some cases, this can break your HTML output. You can use our [development testing script](https://gist.github.com/ColdHeat/085c47359ab86c18864135a198cbe505) to check if your HTML output will change and correct it accordingly. - ### Forms, Nonces, Sessions CTFd no longer directly injects values into the global session object for a theme. You may have used this as `{{ nonce }}` or `{{ id }}`. Instead these values should be accessed via the `Session` global as so: `{{ Session.nonce }}`. All of the public facing forms in CTFd have been converted to form globals with WTForms. You can access them via the `Form` global in Jinja. For example, `{{ Forms.auth.LoginForm() }}`. A `{{ form.nonce() }}` function is available on all forms for easier access to the CSRF nonce as well. Old forms will still work if the nonce used in the form is updated to `{{ Session.nonce }}`. Values provided by configuration and plugins can now be accessed via the `Configs` and `Plugins` globals. For example `{{ Configs.ctf_name }}` and `{{ Plugins.scripts }}`. See the `base.html` file of the core theme to get an idea of how to use these values. - ### Challenge Type Plugin Enhancements Challenge type plugins now have better re-useability with the rest of CTFd. Plugin code no longer needs to copy unchanged methods over from the base challenge plugin classes. In addition, challenge HTML is now rendered on the server side using a new `challenge.html` file provided by the current theme. This means that the theme effectively controls how a challenge should look overall, but the challenge plugin controls the overall content. - ### Python 3 CTFd v3 is Python 3 only. - ### Docker image based on Debian The Docker image used in CTFd is now based on Debian. - ### config.ini Instead of editting `config.py` directly, it's now a better idea to edit `config.ini` or provide your configuration via environment variables ## Detailed Changelog **General** - CTFd is now Python 3 only - Render markdown with the CommonMark spec provided by `cmarkgfm` - HTML/Markdown content is now rendered on the server side in most cases. - This includes challenge descriptions, hint content, and page content - Ability to render markdown stripped of any malicious JavaScript or HTML. - Controlled via the `HTML_SANITIZATION` server side configuration value - Inject `Config`, `User`, `Team`, `Session`, and `Plugin` globals into Jinja - User sessions no longer store any user-specific attributes. - Sessions only store the user's ID, CSRF nonce, and an hmac of the user's password - This allows for session invalidation on password changes - The user facing side of CTFd now has user and team searching - Accept additional profile fields during registration (affiliation, website, country) - This does not add additional inputs. Themes or additional JavaScript can add the form inputs. **Admin Panel** - Use EasyMDE as an improved description/text editor for Markdown enabled fields. - Media Library button now integrated into EasyMDE enabled fields - VueJS now used as the underlying implementation for the Media Library - Fix setting theme color in Admin Panel - Green outline border has been removed from the Admin Panel - GeoIP support now available for converting IP addresses to guessed countries - Redesign the challenge creation form to use a radio button with challenge type selection instead of a select input **API** - Significant overhauls in API documentation provided by Swagger UI and Swagger json - Make almost all API endpoints provide filtering and searching capabilities - Change `GET /api/v1/config/<config_key>` to return structured data according to ConfigSchema - Admins can no longer ban themselves through `PATCH /api/v1/users/[user_id]` - Add `html` item for `GET /api/v1/hints/[hint_id]` which contains the rendered HTML of the Hint content - Remove `content` from `GET /api/v1/hints` **Themes** - Themes now have access to the `Configs` global which provides wrapped access to `get_config`. - For example, `{{ Configs.ctf_name }}` instead of `get_ctf_name()` or `get_config('ctf_name')` - Themes must now specify a `challenge.html` which control how a challenge should look. - The main library for charts has been changed from Plotly to Apache ECharts. - Forms have been moved into wtforms for easier form rendering inside of Jinja. - From Jinja you can access forms via the Forms global i.e. `{{ Forms }}` - This allows theme developers to more easily re-use a form without having to copy-paste HTML. - Themes can now provide a theme settings JSON blob which can be injected into the theme with `{{ Configs.theme_settings }}` - Core theme now includes the challenge ID in location hash identifiers to always refer the right challenge despite duplicate names - Spinner centering has been switched from a hard coded margin in CSS to flexbox CSS classes from Bootstrap **Plugins** - Challenge plugins have changed in structure to better allow integration with themes and prevent obtrusive Javascript/XSS. - Challenge rendering now uses `challenge.html` from the provided theme. - Accessing the challenge view content is now provided by `/api/v1/challenges/<challenge_id>` in the `view` section. This allows for HTML to be properly sanitized and rendered by the server allowing CTFd to remove client side Jinja rendering. - `challenge.html` now specifies what's required and what's rendered by the theme. This allows the challenge plugin to avoid having to deal with aspects of the challenge besides the description and input. - A more complete migration guide will be provided when CTFd v3 leaves beta - Display current attempt count in challenge view when max attempts is enabled - `get_standings()`, `get_team_stanadings()`, `get_user_standings()` now has a fields keyword argument that allows for specificying additional fields that SQLAlchemy should return when building the response set. - Useful for gathering additional data when building scoreboard pages - Flags can now control the message that is shown to the user by raising `FlagException` - Fix `override_template()` functionality **Deployment** - Enable SQLAlchemy's `pool_pre_ping` by default to reduce the likelihood of database connection issues - Mailgun email settings are now deprecated. Admins should move to SMTP email settings instead. - Postgres is now considered a second class citizen in CTFd. It is tested against but not a main database backend. If you use Postgres, you are entirely on your own with regards to supporting CTFd. - Docker image now uses Debian instead of Alpine. See CTFd#1215 for rationale. - `docker-compose.yml` now uses a non-root user to connect to MySQL/MariaDB - `config.py` should no longer be editting for configuration, instead edit `config.ini` or the environment variables in `docker-compose.yml` **Miscellaneous** - Fix an issue where email sending would be broken if the CTF name contained a colon - Lint Markdown files with Prettier - Lint Dockerfile and docker-compose.yml in Github Actions - Lint JavaScript files with eslint - Certain static strings have been converted into Enums for better re-useability throughout the code base - Switch to using Github Actions for testing and linting - Better handling of missing challenge types. Missing challenge types no longer bring down all other challenges. - Documentation has been seperated out into a seperate repo (https://github.com/CTFd/docs). - Documentation hosting has moved from ReadTheDocs to Netlify - Any links in the codebase to help.ctfd.io have been changed to docs.ctfd.io.
Mark 2.4.3 (CTFd#1440) 2.4.3 / 2020-05-24 ================== **Miscellaneous** * Notifications/Events endpoint will now immediately send a ping instead of waiting a few seconds. * Upgrade `gunicorn` dependency to `19.10.0` * Upgrade `boto3` dependency to `1.13.9` * Improve `import_ctf()` reliability by closing all connections before dropping & recreating database * Close database session in IP tracking code in failure situations to avoid potential dangling database connections * Don't allow backups to be imported if they do not have a `db` folder * Change `import_ctf()` process slightly to import built-in tables first and then plugin tables * Handle exception where a regex Flag is invalid **API** * File deletion endpoint (`DELETE /api/v1/files/[file_id]`) will now correctly delete the associated file **Plugins** * Add `CTFd.plugins.get_plugin_names()` to get a list of available plugins * Add `CTFd.plugins.migrations.current()` to get the current revision of a plugin migration * Improve `CTFd.plugins.migrations.upgrade()` to be able to upgrade to a specific plugin migration * Run plugin migrations during import process **Themes** * Update jQuery to v3.5.1 to fix mobile hamburger menu * Upgrade some dependencies in yarn lockfile * Fix invalid team link being generated in `scoreboard.js` **Admin Panel** * Fix sending of user creation notification email * Fix button to remove users from teams
Merge pull request CTFd#1391 from CTFd/mark-2.4.2 2.4.2 / 2020-05-08 ================== **Admin Panel** * Fix Challenge Reset in Admin Panel where Dynamic Challenges prevented resetting Challenges **Plugins** * Add the `CTFd.plugins.migrations` module to allow plugins to handle migrations. Plugins should now call `CTFd.plugins.migrations.upgrade` instead of `app.db.create_all` which will allow the plugin to have database migrations. * Make Dynamic Challenges have a cascading deletion constraint against their respective Challenge row **Miscellaneous** * Add `app.plugins_dir` object to refer to the directory where plugins are installed
PreviousNext