hackademic/controller/class.ShowChallengeController.php at next-dev · Hackademic/hackademic · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
<?php
/**
 * Hackademic-CMS/controller/class.ShowChallengeController.php
 *
 * Hackademic Show Challenge Controller
 * Class for the Show Challenge page in Frontend
 *
 * Copyright (c) 2012 OWASP
 *
 * LICENSE:
 *
 * This file is part of Hackademic CMS
 * (https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project).
 *
 * Hackademic CMS is free software: you can redistribute it and/or modify it under
 * the terms of the GNU General Public License as published by the Free Software
 * Foundation, either version 2 of the License, or (at your option) any later
 * version.
 *
 * Hackademic CMS is distributed in the hope that it will be useful, but WITHOUT ANY
 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
 * PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along with
 * Hackademic CMS.  If not, see <http://www.gnu.org/licenses/>.
 *
 * PHP Version 5.
 *
 * @author    Pragya Gupta <pragya18nsit@gmail.com>
 * @author    Konstantinos Papapanagiotou <conpap@gmail.com>
 * @copyright 2012 OWASP
 * @license   GNU General Public License http://www.gnu.org/licenses/gpl.html
 */
require_once HACKADEMIC_PATH."model/common/class.Challenge.php";
require_once HACKADEMIC_PATH."model/common/class.User.php";
require_once HACKADEMIC_PATH."admin/model/class.ClassMemberships.php";
require_once HACKADEMIC_PATH."admin/model/class.ClassChallenges.php";
require_once HACKADEMIC_PATH."controller/class.HackademicController.php";

class ShowChallengeController extends HackademicController
{

    private static $_action_type = 'show_challenge';

    public function go()
    {
        if (isset($_GET['id'])) {
            if (isset($_GET['class_id'])) {
                $class_id = htmlspecialchars($_GET['class_id']);
            }
            $id = $_GET['id'];
            $challenge=Challenge::getChallenge($id);
            $this->setViewTemplate('showChallenge.tpl');
            $this->addToView('challenge', $challenge);
            if (!self::isLoggedIn()) {
                $this->addErrorMessage("You must login to be able to take the challenge");
            } else if (self::isAdmin() || self::IsAllowed(self::getLoggedInUser(), $challenge->id)) {
                $this->addToView('is_allowed', true);
                $this->addToView('username', self::getLoggedInUser());
                $this->addToView('class_id', $class_id);
            } else {
                $this->addErrorMessage(
                    'You cannot take the challenge as you are not
					    a member of any class to which this challenge is assigned and
						this challenge is not publicly available for solving .'
                );
            }
            $this->generateView(self::$_action_type);
        }
    }

    protected static function isAllowed($username, $challenge_id)
    {
        $user = User::findByUserName($username);
        $dbg_array = ClassChallenges::getChallengesOfUser($user->id);
        foreach ($dbg_array as $element) {
            if ($element->id === $challenge_id) {
                return true;
            }
        }
        return false;
    }
}