Closes #241

src/application.py

@@ -2,6 +2,7 @@
 import os
 import requests
 import sys
+import uuid
 from datetime import datetime
 
 import jwt
@@ -583,7 +584,7 @@ def create_contest():
     end = request.form.get("end")
     description = request.form.get("description").replace('\r', '').strip()
     contest_name = request.form.get("contest_name")
-    scoreboard_key = request.form.get("scoreboard_key")
+    scoreboard_key = str(uuid.uuid4())
     scoreboard_visible = bool(request.form.get("scoreboard_visible"))
 
     # Ensure contest ID is valid

src/templates/contest/contest.html

@@ -23,7 +23,8 @@ <h1 style="display: inline;">{{ title }}</h1>
                        href="{{ request.path }}/notify">Notify Participants</a>
                 {% endif %}
                 <a class="dropdown-item"
-                   href="/api/contest/scoreboard/{{ request.path[9:] }}?key={{ scoreboard_key }}">View CTFtime Scoreboard</a>
+                   href="/api/contest/scoreboard/{{ request.path[9:] }}?key={{ scoreboard_key }}"
+                   target="_blank">View CTFtime Scoreboard</a>
             </div>
         </div>
     {% endif %}

src/templates/contest/create.html

@@ -52,19 +52,8 @@ <h1>Create Contest</h1>
     <div class="form-control mb-3" style="border: 0;">
         <div>
             <input type="checkbox" id="scoreboard_visible" name="scoreboard_visible">
-            <label for="scoreboard_visible">Scoreboard Visible?</label>
+            <label for="scoreboard_visible">Scoreboard Visible to Players? <i>(This will not affect the CTFtime scoreboard, which will always be accessible through a scoreboard key)</i></label>
         </div>
-        <div>Live scoreboard feed (for CTFtime): <span id="lsf_host"></span>/api/contest/scoreboard/<span id="lsf_cid"></span>?key=<span id="lsf_key"></span></div>
-        <input type="hidden" name="scoreboard_key">
-        <script>
-          document.querySelector("#lsf_host").innerText = location.origin;
-          let lsf_key = crypto.randomUUID();
-          document.querySelector("#lsf_key").innerText = lsf_key;
-          document.querySelector("input[name=scoreboard_key]").value = lsf_key;
-          document.querySelector("input[name=contest_id]").addEventListener("change", e => {
-              document.querySelector("#lsf_cid").innerText = e.target.value;
-          });
-        </script>
     </div>
     <input class="btn btn-primary" type="submit" value="Create Contest">
     <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>

src/tests/test_contest.py

@@ -49,8 +49,7 @@ def test_contest(client, database):
         'start': datetime.strftime(datetime.now(), "%Y-%m-%dT%H:%M:%S.%fZ"),
         'end': datetime.strftime(datetime.now() + timedelta(600), "%Y-%m-%dT%H:%M:%S.%fZ"),  # noqa E501
         'description': 'testing contest description',
-        'scoreboard_visible': True,
-        'scoreboard_key': '00000000-0000-0000-0000-000000000000'
+        'scoreboard_visible': True
     }, follow_redirects=True)
     assert result.status_code == 200
     assert b'Testing Contest' in result.data
@@ -241,7 +240,8 @@ def test_contest(client, database):
     result = client.get('/api/contest/scoreboard/testingcontest?key=' + admin_api)
     assert result.status_code == 401
 
-    result = client.get('/api/contest/scoreboard/testingcontest?key=00000000-0000-0000-0000-000000000000')  # noqa
+    key = database.execute("SELECT scoreboard_key FROM contests WHERE id='testingcontest'")[0]["scoreboard_key"]
+    result = client.get('/api/contest/scoreboard/testingcontest?key=' + key)
     assert result.status_code == 200
     assert result.data == b'{"standings": [{"pos": 1, "team": "normal_user", "score": 2}]}'  # noqa