Repository: CTFd/CTFd (python)

Issue:
Hide flag-submit-box for anonymous users
**Environment**:

  - CTFd Version/Commit: 2.0.1 from master
  - Operating System: Debian Stretch, Ubuntu 18.04, ...
  - Web Browser and Version: Firefox 63

**What happened?**

* In admin, set visibility of challenges to public
* Logout
* Open challenge view (`/challenges`)
* Click on a challenge
* Box to submit flag is displayed, but not possible to submit flag

![selection_615](https://user-images.githubusercontent.com/527767/49752426-a6578f80-fcb0-11e8-9d8b-52f2d9bcdb8d.png)

**What did you expect to happen?**

* ...
* Open challenge view (`/challenges`)
* Click on a challenge
* **NO** Box to submit flag is displayed

![selection_616](https://user-images.githubusercontent.com/527767/49752417-a192db80-fcb0-11e8-93a5-d6910300a11b.png)

**How to reproduce your issue**

_see above_

**Any associated stack traces or error logs**

_none_




Pull request:
Allow unauthed users to attempt challenges if visibility is public bu…
* Allow unauthed users to attempt challenges if visibility is public but get redirected (Closes #797)

Patch:
diff --git a/CTFd/api/v1/challenges.py b/CTFd/api/v1/challenges.py
index 0a6f5348..521f83fd 100644
--- a/CTFd/api/v1/challenges.py
+++ b/CTFd/api/v1/challenges.py
@@ -266,8 +266,15 @@ class Challenge(Resource):
 class ChallengeAttempt(Resource):
     @during_ctf_time_only
     @require_verified_emails
-    @authed_only
     def post(self):
+        if authed() is False:
+            return {
+                'success': True,
+                'data': {
+                    'status': "authentication_required",
+                }
+            }, 403
+
         if request.content_type != 'application/json':
             request_data = request.form
         else:


Test patch:
diff --git a/tests/users/test_challenges.py b/tests/users/test_challenges.py
index d107a069..d6f83355 100644
--- a/tests/users/test_challenges.py
+++ b/tests/users/test_challenges.py
@@ -317,13 +317,6 @@ def test_that_view_challenges_unregistered_works():
         r = client.get('/api/v1/challenges')
         assert r.get_json()['data']
 
-        # r = client.get('/chals/solves')
-        # data = r.get_data(as_text=True)
-        # assert json.loads(data) == json.loads('''{
-        #       "1": 0
-        #     }
-        #     ''')
-
         r = client.get('/api/v1/challenges/1/solves')
         assert r.get_json().get('data') is not None
 
@@ -333,7 +326,8 @@ def test_that_view_challenges_unregistered_works():
         }
         r = client.post('/api/v1/challenges/attempt'.format(chal_id), json=data)
         assert r.status_code == 403
-        resp = r.get_json().get('data') is None
+        assert r.get_json().get('data').get('status') == "authentication_required"
+        assert r.get_json().get('data').get('message') is None
     destroy_ctfd(app)