single use flags

[zoomequipd]

Desire: As an admin of a CTF, the ability, at a challenge level, to enable flags to be used only one time. Behavior: If a challenge has multiple flags, reject all submissions of any correct flags already submitted. Behavior: If a challenge does not have multiple flags, no flags should be accepted once the single flag is used. (disable the challenge?)

Use Case: During a CTF, we anticipate having a lock pick village providing flags to competitors that, for instance, pick a lock. A single flag can be shared between competitors, which we want to prevent. Multiple flags (PR #86 ) provides the ability to hand out multiple flags but does not prevent the same flag from being used more than once.

I can probably help out with this, but am wondering how @Nakiami might want it solved.

I was thinking this might be the best way

Add a boolean column in the challenges table for the "single use flags". Upon submission of a correct flag, if challenge "single use flags" value is true, check the submission table to see if that flag has already been submitted, if flag already submitted, count as incorrect and give message that flag was already used. else count as correct.

The one behavior I'm not sure how to handle is when a challenge has all flags used. I think this situation can be detected easily enough (length of array of flags == number of correct submissions). But I'm not clear on how to best indicate to competitors that all available flags have been used when viewing the challenge. Ideally submission wouldn't be possible to submit a flag as to not waste competitors time submitting flags to a challenge that will never accept them.

Let me know your thoughts and I'll see if I can get a PR put together.

[Nakiami]

Hi, I think the best way to solve both this and the multiple flags problem is to break the flags out into a separate table in the DB. This way, you get clean separation from the challenge, and can mark each key as single-use only.

[zoomequipd]

That makes sense. I was trying to avoid changing the database schema for backwards compatibility. Assuming you're not opposed to that I can work on implementing this over the next couple months. I'm worried that it might be above my competency.

[Nakiami]

Haha, go for it. It's the best way to learn!