3.8.2 / 2025-02-05

Security

• Fixes a vulnerability where a malicious admin user could import a crafted zip file to write files arbitrarily depending on the deployment

General

• When a user is submission ratelimited, those submissions will now be the ratelimit submission type instead of incorrect
• Fix issues with ratelimiting on max attempt challenges
• Switch max attempt timeout messaging to seconds instead of minutes
• Fix issue where users would get an error when solving an already solved challenge

Plugins

• Add Ratelimiteds submission class
• Add BaseChallenge.ratelimited() method which creates Ratelimiteds submissions
• Add force_all parameter to CTFd.plugins.migrations.upgrade() to allow plugins to decide if they want to force run all migrations
• Add app.overridden_functions global which allows plugin developers to override functions that support the behavior
• Raise ChallengeSolveException in BaseChallenge.solve() when encountering a duplicate solve situation

Themes

• Mark required fields in registration, login, and custom fields with a red asterisk

Deployment

• The provided Docker Compose file will no longer use the root user and instead use the provided ctfd user
• Add PUT method to IP address tracking

Translations

• Add Norwegian, Turkish, Croatian translation