Repository: CTFd/CTFd

Issue:
Hide flag-submit-box for anonymous users
**Environment**:

  - CTFd Version/Commit: 2.0.1 from master
  - Operating System: Debian Stretch, Ubuntu 18.04, ...
  - Web Browser and Version: Firefox 63

**What happened?**

* In admin, set visibility of challenges to public
* Logout
* Open challenge view (`/challenges`)
* Click on a challenge
* Box to submit flag is displayed, but not possible to submit flag

![selection_615](https://user-images.githubusercontent.com/527767/49752426-a6578f80-fcb0-11e8-9d8b-52f2d9bcdb8d.png)

**What did you expect to happen?**

* ...
* Open challenge view (`/challenges`)
* Click on a challenge
* **NO** Box to submit flag is displayed

![selection_616](https://user-images.githubusercontent.com/527767/49752417-a192db80-fcb0-11e8-93a5-d6910300a11b.png)

**How to reproduce your issue**

_see above_

**Any associated stack traces or error logs**

_none_





Discussion:
**Suggested fix**

I think it would be enough to hide [submit-row](https://github.com/LosFuzzys/CTFd/blob/losctf/CTFd/plugins/challenges/assets/view.html#L69-L79 ),

e.g. via `{% if id is defined %}` - but since this is a client-side template this not not work that way.

CTFd should be automatically redirecting the user to a login page. This is likely another regression. 
So just to be clear, instead of not showing the submission box the way that we handle submissions for unauthed users is that they should be able to submit and then upon submission they get redirected to the login page. 

I should have a fix for this soon. 
Ok, thanks for the clarification. That's indeed not the way I understood that feature.
Being able to submit encourages a sign up I think 😄

Resolving patch:
diff --git a/CTFd/api/v1/challenges.py b/CTFd/api/v1/challenges.py
--- a/CTFd/api/v1/challenges.py
+++ b/CTFd/api/v1/challenges.py
@@ -266,8 +266,15 @@ def delete(self, challenge_id):
 class ChallengeAttempt(Resource):
     @during_ctf_time_only
     @require_verified_emails
-    @authed_only
     def post(self):
+        if authed() is False:
+            return {
+                'success': True,
+                'data': {
+                    'status': "authentication_required",
+                }
+            }, 403
+
         if request.content_type != 'application/json':
             request_data = request.form
         else:


Test patch:
diff --git a/tests/users/test_challenges.py b/tests/users/test_challenges.py
--- a/tests/users/test_challenges.py
+++ b/tests/users/test_challenges.py
@@ -317,13 +317,6 @@ def test_that_view_challenges_unregistered_works():
         r = client.get('/api/v1/challenges')
         assert r.get_json()['data']
 
-        # r = client.get('/chals/solves')
-        # data = r.get_data(as_text=True)
-        # assert json.loads(data) == json.loads('''{
-        #       "1": 0
-        #     }
-        #     ''')
-
         r = client.get('/api/v1/challenges/1/solves')
         assert r.get_json().get('data') is not None
 
@@ -333,7 +326,8 @@ def test_that_view_challenges_unregistered_works():
         }
         r = client.post('/api/v1/challenges/attempt'.format(chal_id), json=data)
         assert r.status_code == 403
-        resp = r.get_json().get('data') is None
+        assert r.get_json().get('data').get('status') == "authentication_required"
+        assert r.get_json().get('data').get('message') is None
     destroy_ctfd(app)