vishalbhat07/ctfd
0
1#!/usr/bin/env python2# -*- coding: utf-8 -*-3 4from CTFd.models import Users5from CTFd.utils import set_config6from tests.helpers import (7 create_ctfd,8 destroy_ctfd,9 gen_award,10 login_as_user,11 register_user,12)13 14 15def test_accessing_hidden_users():16 """Hidden users should not give any data from /users or /api/v1/users"""17 app = create_ctfd()18 with app.app_context():19 register_user(20 app, name="visible_user", email="visible_user@examplectf.com"21 ) # ID 222 register_user(23 app, name="hidden_user", email="hidden_user@examplectf.com"24 ) # ID 325 register_user(26 app, name="banned_user", email="banned_user@examplectf.com"27 ) # ID 428 user = Users.query.filter_by(name="hidden_user").first()29 user.hidden = True30 app.db.session.commit()31 user = Users.query.filter_by(name="banned_user").first()32 user.banned = True33 app.db.session.commit()34 35 with login_as_user(app, name="visible_user") as client:36 assert client.get("/users/3").status_code == 40437 assert client.get("/api/v1/users/3").status_code == 40438 assert client.get("/api/v1/users/3/solves").status_code == 40439 assert client.get("/api/v1/users/3/fails").status_code == 40440 assert client.get("/api/v1/users/3/awards").status_code == 40441 42 assert client.get("/users/4").status_code == 40443 assert client.get("/api/v1/users/4").status_code == 40444 assert client.get("/api/v1/users/4/solves").status_code == 40445 assert client.get("/api/v1/users/4/fails").status_code == 40446 assert client.get("/api/v1/users/4/awards").status_code == 40447 destroy_ctfd(app)48 49 50def test_hidden_user_visibility():51 """Hidden users should not show up on /users or /api/v1/users or /api/v1/scoreboard"""52 app = create_ctfd()53 with app.app_context():54 register_user(app, name="hidden_user")55 56 with login_as_user(app, name="hidden_user") as client:57 user = Users.query.filter_by(id=2).first()58 user_id = user.id59 user_name = user.name60 user.hidden = True61 app.db.session.commit()62 63 r = client.get("/users")64 response = r.get_data(as_text=True)65 # Only search in body content66 body_start = response.find("<body>")67 body_end = response.find("</body>")68 response = response[body_start:body_end]69 assert user_name not in response70 71 r = client.get("/api/v1/users")72 response = r.get_json()73 assert user_name not in response74 75 gen_award(app.db, user_id)76 77 r = client.get("/scoreboard")78 response = r.get_data(as_text=True)79 # Only search in body content80 body_start = response.find("<body>")81 body_end = response.find("</body>")82 response = response[body_start:body_end]83 assert user_name not in response84 85 r = client.get("/api/v1/scoreboard")86 response = r.get_json()87 assert user_name not in response88 89 # User should re-appear after disabling hiding90 # Use an API call to cause a cache clear91 with login_as_user(app, name="admin") as admin:92 r = admin.patch("/api/v1/users/2", json={"hidden": False})93 assert r.status_code == 20094 95 r = client.get("/users")96 response = r.get_data(as_text=True)97 # Only search in body content98 body_start = response.find("<body>")99 body_end = response.find("</body>")100 response = response[body_start:body_end]101 assert user_name in response102 103 r = client.get("/api/v1/users")104 response = r.get_data(as_text=True)105 assert user_name in response106 107 r = client.get("/api/v1/scoreboard")108 response = r.get_data(as_text=True)109 assert user_name in response110 destroy_ctfd(app)111 112 113def test_num_users_limit():114 """Only num_users users can be created"""115 app = create_ctfd()116 with app.app_context():117 set_config("num_users", 1)118 119 register_user(app)120 with app.test_client() as client:121 r = client.get("/register")122 assert r.status_code == 403123 124 # team should be blocked from creation125 with client.session_transaction() as sess:126 data = {127 "name": "user",128 "email": "user@examplectf.com",129 "password": "password",130 "nonce": sess.get("nonce"),131 }132 r = client.post("/register", data=data)133 resp = r.get_data(as_text=True)134 # This number is 2 to account for the admin and the registered user135 assert Users.query.count() == 2136 assert "Reached the maximum number of users" in resp137 138 # Can the team be created after the num has been bumped139 set_config("num_users", 2)140 with client.session_transaction() as sess:141 data = {142 "name": "user1",143 "email": "user1@examplectf.com",144 "password": "password",145 "nonce": sess.get("nonce"),146 }147 r = client.post("/register", data=data)148 resp = r.get_data(as_text=True)149 assert r.status_code == 302150 assert Users.query.count() == 3151 destroy_ctfd(app)152