Skip to content

Commit 188959a

Browse files
Kathode-NegativeKathode-Negative
committed
implemented unlock circumventing
1 parent 1124044 commit 188959a

1 file changed

Lines changed: 111 additions & 58 deletions

File tree

‎CTFd/plugins/hintpointdelay/__init__.py‎

Lines changed: 111 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33

44
from CTFd.cache import clear_standings
55
from CTFd.constants.languages import SELECT_LANGUAGE_LIST
6-
from CTFd.models import Hints, Unlocks, db, get_class_by_tablename
7-
from CTFd.plugins.LuaUtils import ConfigPanel, _LuaAsset
6+
from CTFd.models import Awards, Hints, Unlocks, db, get_class_by_tablename
7+
from CTFd.plugins.LuaUtils import ConfigPanel, _LuaAsset, run_after_route
88
from CTFd.schemas.awards import AwardSchema
99
from CTFd.schemas.unlocks import UnlockSchema
1010
from CTFd.utils import get_config
@@ -14,6 +14,7 @@
1414
during_ctf_time_only,
1515
require_verified_emails,
1616
)
17+
from CTFd.utils.logging import log
1718
from CTFd.utils.user import get_current_user
1819

1920

@@ -32,21 +33,7 @@ def __init__(self, user, hint):
3233
self.hint = hint.id
3334
self.challenge = hint.challenge_id
3435

35-
36-
hintpoint = Blueprint(
37-
"hintpointdelay",
38-
__name__,
39-
template_folder="templates",
40-
static_folder="staticAssets",
41-
)
42-
43-
def load(app):
44-
app.db.create_all()
45-
46-
app.jinja_env.globals.update(hintpointassets=_LuaAsset("hintpointdelay"))
47-
app.register_blueprint(hintpoint, url_prefix="/hintpointdelay")
48-
49-
def get_modified_challenge_points(challenge):
36+
def get_modified_challenge_points(challenge):
5037
user = get_current_user()
5138
hintids = DelayedHints.query.filter(
5239
DelayedHints.challenge == challenge.id,
@@ -63,49 +50,67 @@ def get_modified_challenge_points(challenge):
6350

6451
return score
6552

66-
def apply_delayed_hints(challenge):
67-
user = get_current_user()
68-
hintids = DelayedHints.query.filter(
69-
DelayedHints.challenge == challenge.id,
70-
DelayedHints.user == user.id,
71-
).all()
53+
def apply_delayed_hints(challenge):
54+
user = get_current_user()
55+
hintids = DelayedHints.query.filter(
56+
DelayedHints.challenge == challenge.id,
57+
DelayedHints.user == user.id,
58+
).all()
59+
60+
if hintids:
61+
for hid in hintids:
62+
hint = Hints.query.filter(
63+
Hints.id== hid,
64+
).first()
65+
if hint:
66+
name = hint.name
67+
description = hint.description
68+
category = hint.category
69+
user_id = user.id
70+
user_awards = user.awards
71+
72+
for award in user_awards:
73+
if award.value == 0 and award.name == name and award.description == description and award.category == category and (award.user_id == user_id or award.team_id == user.team_id):
74+
#delete old award
75+
db.session.delete(award)
76+
77+
#create new award with cost
78+
award_schema = AwardSchema()
79+
new_award = {
80+
"user_id": user.id,
81+
"team_id": user.team_id,
82+
"name": hint.name,
83+
"description": hint.description,
84+
"value": (-hint.cost),
85+
"category": hint.category,
86+
}
87+
88+
new_award = award_schema.load(new_award)
89+
db.session.add(new_award.data)
90+
break
91+
92+
db.session.delete(hint)
93+
db.session.commit()
94+
db.session.close()
95+
clear_standings()
7296

73-
if hintids:
74-
for hid in hintids:
75-
hint = Hints.query.filter(
76-
Hints.id== hid,
77-
).first()
78-
if hint:
79-
name = hint.name
80-
description = hint.description
81-
category = hint.category
82-
user_id = user.id
83-
user_awards = user.awards
84-
85-
for award in user_awards:
86-
if award.cost == 0 and award.name == name and award.description == description and award.category == category and (award.user_id == user_id or award.team_id == user.team_id):
87-
#delete old award
88-
db.session.delete(award)
89-
90-
#create new award with cost
91-
award_schema = AwardSchema()
92-
new_award = {
93-
"user_id": user.id,
94-
"team_id": user.team_id,
95-
"name": hint.name,
96-
"description": hint.description,
97-
"value": (-hint.cost),
98-
"category": hint.category,
99-
}
100-
101-
new_award = award_schema.load(new_award)
102-
db.session.add(new_award.data)
103-
104-
db.session.commit()
105-
db.session.close()
106-
clear_standings()
10797

98+
hintpoint = Blueprint(
99+
"hintpointdelay",
100+
__name__,
101+
template_folder="templates",
102+
static_folder="staticAssets",
103+
)
104+
105+
def load(app):
106+
app.db.create_all()
107+
108+
#jinja globals
109+
app.jinja_env.globals.update(hintpointvalue=get_modified_challenge_points)
110+
app.jinja_env.globals.update(hintpointassets=_LuaAsset("hintpointdelay"))
111+
app.register_blueprint(hintpoint, url_prefix="/hintpointdelay")
108112

113+
#config page
109114
@app.route("/admin/hintpointdelay")
110115
@admins_only
111116
def hintpoint_config():
@@ -126,6 +131,54 @@ def hintpoint_config():
126131
]
127132
return render_template("hintconfig.html", configs=configs)
128133

134+
#modified award unlock
135+
def modify_award(res):
136+
req = request.get_json()
137+
award_data = res[0].get_json()
138+
if not award_data['success']:
139+
return
140+
141+
user = get_current_user()
142+
143+
Model = get_class_by_tablename(req["type"])
144+
hint = Model.query.filter_by(id=req["target"]).first_or_404()
145+
146+
if(req["type"] == "hints"):
147+
name = hint.name
148+
description = hint.description
149+
category = hint.category
150+
user_id = user.id
151+
user_awards = user.awards
152+
153+
for award in user_awards:
154+
if award.value != 0 and award.name == name and award.description == description and award.category == category and (award.user_id == user_id or award.team_id == user.team_id):
155+
#delete old award
156+
db.session.delete(award)
157+
158+
#create new award with cost
159+
award_schema = AwardSchema()
160+
new_award = {
161+
"user_id": user.id,
162+
"team_id": user.team_id,
163+
"name": hint.name,
164+
"description": hint.description,
165+
"value": (0),
166+
"category": hint.category,
167+
}
168+
169+
new_award = award_schema.load(new_award)
170+
db.session.add(new_award.data)
171+
172+
delayedhint = DelayedHints(user,hint)
173+
db.session.add(delayedhint)
174+
break
175+
176+
db.session.commit()
177+
clear_standings()
178+
179+
180+
run_after_route(app,'api.unlocks_unlock_list',modify_award)
181+
129182
@during_ctf_time_only
130183
@require_verified_emails
131184
@authed_only
@@ -198,6 +251,7 @@ def post(self):
198251
response = schema.dump(response.data)
199252

200253
return {"success": True, "data": response.data}
254+
201255
elif target_type == "solutions":
202256
schema = UnlockSchema()
203257
response = schema.load(req, session=db.session)
@@ -235,4 +289,3 @@ def post(self):
235289
},
236290
400,
237291
)
238-

0 commit comments

Comments
 (0)