__init__.py

import glob
import hashlib
import hmac
import importlib
import os.path
from flask import send_file, jsonify
from flask.helpers import safe_join
from CTFd.models import Challenges, Solves, Pages, db
from CTFd.schemas.pages import PageSchema
from CTFd.utils import get_config
from CTFd.utils.modes import get_model
from CTFd.utils.dates import ctf_ended, ctf_started
from CTFd.utils.user import is_verified, is_admin, get_current_team
from CTFd.utils.decorators import during_ctf_time_only, authed_only, require_team
from sqlalchemy.sql import and_

def load(app):
    # Load all the subcomponents (which resides in this directory)
    this_dir = os.path.abspath(os.path.dirname(__file__))
    modules = sorted(glob.glob(this_dir + '/*.py'))
    blacklist = {'__pycache__', '__init__.py'}
    for mod in modules:
        mod = os.path.basename(mod)
        if mod in blacklist: continue
        mod = '.' + mod[:-3]
        mod = importlib.import_module(mod, package=__package__)
        mod.load(app)
        print(' * pbctf: Loaded subcomponent, %s' % mod)

    def nonce():
        from flask import session
        return session.get('nonce')
    app.jinja_env.globals.update(nonce=nonce)

    #@app.route("/OneSignalSDKWorker.js", methods=["GET"])
    #def worker():
    #    filename = safe_join(app.root_path, 'themes', 'tsgctf', 'static', 'OneSignalSDKWorker.js')
    #    return send_file(filename)

    @app.route("/api/v1/dates", methods=["GET"])
    def dates():
        start = get_config('start')
        end = get_config('end')
        is_started = ctf_started()
        is_ended = ctf_ended()

        return jsonify({
            'success': True,
            'data': {
                'start': start,
                'end': end,
                'is_started': is_started,
                'is_ended': is_ended,
                'is_verified': is_verified() or is_admin(),
            },
        })

    @app.route("/api/v1/rules", methods=["GET"])
    def rules():
        page = Pages.query.filter_by(route='rules', auth_required=False).first_or_404()
        schema = PageSchema()
        response = schema.dump(page)

        if response.errors:
                return {"success": False, "errors": response.errors}, 400

        return {"success": True, "data": response.data}

    @app.route("/api/v1/sponsors", methods=["GET"])
    def sponsors():
        page = Pages.query.filter_by(route='sponsors', auth_required=False).first_or_404()
        schema = PageSchema()
        response = schema.dump(page)

        if response.errors:
                return {"success": False, "errors": response.errors}, 400

        return {"success": True, "data": response.data}

    @app.route("/api/v1/challenges/solves", methods=["GET"])
    @during_ctf_time_only
    def solves():
        chals = (
            Challenges.query.filter(
                and_(Challenges.state != "hidden", Challenges.state != "locked")
            )
            .order_by(Challenges.value)
            .all()
        )

        Model = get_model()

        solves_sub = (
            db.session.query(
                Solves.challenge_id, db.func.count(Solves.challenge_id).label("solves")
            )
            .join(Model, Solves.account_id == Model.id)
            .filter(Model.banned == False, Model.hidden == False)
            .group_by(Solves.challenge_id)
            .subquery()
        )

        solves = (
            db.session.query(
                solves_sub.columns.challenge_id,
                solves_sub.columns.solves,
                Challenges.name,
            )
            .join(Challenges, solves_sub.columns.challenge_id == Challenges.id)
            .all()
        )

        response = []
        has_solves = []

        for challenge_id, count, name in solves:
            challenge = {"id": challenge_id, "name": name, "solves": count}
            response.append(challenge)
            has_solves.append(challenge_id)
        for c in chals:
            if c.id not in has_solves:
                challenge = {"id": c.id, "name": c.name, "solves": 0}
                response.append(challenge)

        db.session.close()
        return {"success": True, "data": response}

    @app.route("/api/v1/teams/me/team_code", methods=["GET"])
    @authed_only
    @require_team
    def team_code():
        team = get_current_team()
        HMAC_KEY = b'5116723a36f9e8cd6ab7341be44ca04abd2fe54866bc16cff20c79b787f16934'
        code = hmac.new(HMAC_KEY, str(team.id).encode(), hashlib.sha256).hexdigest()

        return {"success": True, "data": {"team_code": code}}