vishalbhat07/ctfd
0
1#!/usr/bin/env python2# -*- coding: utf-8 -*-3 4from CTFd.models import UserFieldEntries5from tests.helpers import (6 create_ctfd,7 destroy_ctfd,8 gen_field,9 login_as_user,10 register_user,11)12 13 14def test_new_fields_show_on_pages():15 app = create_ctfd()16 with app.app_context():17 register_user(app)18 19 gen_field(app.db)20 21 with app.test_client() as client:22 r = client.get("/register")23 assert "CustomField" in r.get_data(as_text=True)24 assert "CustomFieldDescription" in r.get_data(as_text=True)25 26 with login_as_user(app) as client:27 r = client.get("/settings")28 assert "CustomField" in r.get_data(as_text=True)29 assert "CustomFieldDescription" in r.get_data(as_text=True)30 31 r = client.patch(32 "/api/v1/users/me",33 json={"fields": [{"field_id": 1, "value": "CustomFieldEntry"}]},34 )35 resp = r.get_json()36 assert resp["success"] is True37 assert resp["data"]["fields"][0]["value"] == "CustomFieldEntry"38 assert resp["data"]["fields"][0]["description"] == "CustomFieldDescription"39 assert resp["data"]["fields"][0]["name"] == "CustomField"40 assert resp["data"]["fields"][0]["field_id"] == 141 42 r = client.get("/user")43 resp = r.get_data(as_text=True)44 assert "CustomField" in resp45 assert "CustomFieldEntry" in resp46 47 r = client.get("/users/2")48 resp = r.get_data(as_text=True)49 assert "CustomField" in resp50 assert "CustomFieldEntry" in resp51 destroy_ctfd(app)52 53 54def test_fields_required_on_register():55 app = create_ctfd()56 with app.app_context():57 gen_field(app.db)58 59 with app.app_context():60 with app.test_client() as client:61 client.get("/register")62 with client.session_transaction() as sess:63 data = {64 "name": "user",65 "email": "user@examplectf.com",66 "password": "password",67 "nonce": sess.get("nonce"),68 }69 client.post("/register", data=data)70 with client.session_transaction() as sess:71 assert sess.get("id") is None72 73 with client.session_transaction() as sess:74 data = {75 "name": "user",76 "email": "user@examplectf.com",77 "password": "password",78 "fields[1]": "custom_field_value",79 "nonce": sess.get("nonce"),80 }81 client.post("/register", data=data)82 with client.session_transaction() as sess:83 assert sess["id"]84 destroy_ctfd(app)85 86 87def test_fields_properties():88 """Test that users can set and edit custom fields"""89 app = create_ctfd()90 with app.app_context():91 gen_field(92 app.db, name="CustomField1", required=True, public=True, editable=True93 )94 gen_field(95 app.db, name="CustomField2", required=False, public=True, editable=True96 )97 gen_field(98 app.db, name="CustomField3", required=False, public=False, editable=True99 )100 gen_field(101 app.db, name="CustomField4", required=False, public=False, editable=False102 )103 104 with app.test_client() as client:105 r = client.get("/register")106 resp = r.get_data(as_text=True)107 assert "CustomField1" in resp108 assert "CustomField2" in resp109 assert "CustomField3" in resp110 assert "CustomField4" in resp111 112 # Manually register user so that we can populate the required field113 with client.session_transaction() as sess:114 data = {115 "name": "user",116 "email": "user@examplectf.com",117 "password": "password",118 "fields[1]": "custom_field_value",119 "nonce": sess.get("nonce"),120 }121 client.post("/register", data=data)122 with client.session_transaction() as sess:123 assert sess["id"]124 125 with login_as_user(app) as client:126 r = client.get("/settings")127 resp = r.get_data(as_text=True)128 assert "CustomField1" in resp129 assert "CustomField2" in resp130 assert "CustomField3" in resp131 assert "CustomField4" not in resp132 133 r = client.patch(134 "/api/v1/users/me",135 json={136 "fields": [137 {"field_id": 1, "value": "CustomFieldEntry1"},138 {"field_id": 2, "value": "CustomFieldEntry2"},139 {"field_id": 3, "value": "CustomFieldEntry3"},140 {"field_id": 4, "value": "CustomFieldEntry4"},141 ]142 },143 )144 resp = r.get_json()145 assert resp == {146 "success": False,147 "errors": {"fields": ["Field 'CustomField4' cannot be editted"]},148 }149 150 r = client.patch(151 "/api/v1/users/me",152 json={153 "fields": [154 {"field_id": 1, "value": "CustomFieldEntry1"},155 {"field_id": 2, "value": "CustomFieldEntry2"},156 {"field_id": 3, "value": "CustomFieldEntry3"},157 ]158 },159 )160 assert r.status_code == 200161 162 r = client.get("/user")163 resp = r.get_data(as_text=True)164 assert "CustomField1" in resp165 assert "CustomField2" in resp166 assert "CustomField3" not in resp167 assert "CustomField4" not in resp168 169 r = client.get("/users/2")170 resp = r.get_data(as_text=True)171 assert "CustomField1" in resp172 assert "CustomField2" in resp173 assert "CustomField3" not in resp174 assert "CustomField4" not in resp175 destroy_ctfd(app)176 177 178def test_boolean_checkbox_field():179 app = create_ctfd()180 with app.app_context():181 gen_field(app.db, name="CustomField1", field_type="boolean", required=False)182 183 with app.test_client() as client:184 r = client.get("/register")185 resp = r.get_data(as_text=True)186 187 # We should have rendered a checkbox input188 assert "checkbox" in resp189 190 with client.session_transaction() as sess:191 data = {192 "name": "user",193 "email": "user@examplectf.com",194 "password": "password",195 "nonce": sess.get("nonce"),196 "fields[1]": "y",197 }198 client.post("/register", data=data)199 with client.session_transaction() as sess:200 assert sess["id"]201 202 assert UserFieldEntries.query.count() == 1203 assert UserFieldEntries.query.filter_by(id=1).first().value is True204 205 with login_as_user(app) as client:206 r = client.get("/settings")207 resp = r.get_data(as_text=True)208 assert "CustomField1" in resp209 assert "checkbox" in resp210 211 r = client.patch(212 "/api/v1/users/me", json={"fields": [{"field_id": 1, "value": False}]}213 )214 assert r.status_code == 200215 assert UserFieldEntries.query.count() == 1216 assert UserFieldEntries.query.filter_by(id=1).first().value is False217 destroy_ctfd(app)218 219 220def test_user_needs_all_required_fields():221 """Test that users need to submit all required fields before viewing challenges"""222 app = create_ctfd()223 with app.app_context():224 # Manually create a user who has no fields set225 register_user(app)226 227 # Create the fields that we want228 gen_field(229 app.db, name="CustomField1", required=True, public=True, editable=True230 )231 gen_field(232 app.db, name="CustomField2", required=False, public=True, editable=True233 )234 gen_field(235 app.db, name="CustomField3", required=False, public=False, editable=True236 )237 gen_field(238 app.db, name="CustomField4", required=False, public=False, editable=False239 )240 241 # We can see all fields when we try to register242 with app.test_client() as client:243 r = client.get("/register")244 resp = r.get_data(as_text=True)245 assert "CustomField1" in resp246 assert "CustomField2" in resp247 assert "CustomField3" in resp248 assert "CustomField4" in resp249 250 # When we login with our manually made user251 # we should see all fields because we are missing a required field252 with login_as_user(app) as client:253 r = client.get("/settings")254 resp = r.get_data(as_text=True)255 assert "CustomField1" in resp256 assert "CustomField2" in resp257 assert "CustomField3" in resp258 assert "CustomField4" in resp259 260 r = client.get("/challenges")261 assert r.status_code == 302262 assert r.location.startswith("/settings")263 264 # Populate the non-required fields265 r = client.patch(266 "/api/v1/users/me",267 json={268 "fields": [269 {"field_id": 2, "value": "CustomFieldEntry2"},270 {"field_id": 3, "value": "CustomFieldEntry3"},271 {"field_id": 4, "value": "CustomFieldEntry4"},272 ]273 },274 )275 assert r.status_code == 200276 277 # I should still be restricted from seeing challenges278 r = client.get("/challenges")279 assert r.status_code == 302280 assert r.location.startswith("/settings")281 282 # I should still see all fields b/c I don't have a complete profile283 r = client.get("/settings")284 resp = r.get_data(as_text=True)285 assert "CustomField1" in resp286 assert "CustomField2" in resp287 assert "CustomField3" in resp288 assert "CustomField4" in resp289 290 # Populate the required fields291 r = client.patch(292 "/api/v1/users/me",293 json={"fields": [{"field_id": 1, "value": "CustomFieldEntry1"}]},294 )295 assert r.status_code == 200296 297 # I can now go to challenges298 r = client.get("/challenges")299 assert r.status_code == 200300 301 # I should only see edittable fields302 r = client.get("/settings")303 resp = r.get_data(as_text=True)304 assert "CustomField1" in resp305 assert "CustomField2" in resp306 assert "CustomField3" in resp307 assert "CustomField4" not in resp308 309 # I can't edit a non-editable field310 r = client.patch(311 "/api/v1/users/me",312 json={"fields": [{"field_id": 4, "value": "CustomFieldEntry4"}]},313 )314 resp = r.get_json()315 assert resp == {316 "success": False,317 "errors": {"fields": ["Field 'CustomField4' cannot be editted"]},318 }319 destroy_ctfd(app)320