API Error: config is too long - JSON bool values not sent correctly - 400 bad request on PATCH requests

Environment:

• CTFd Version/Commit: 3.3.0 (ctfd/ctfd:latest image)
• Operating System: Docker on AWS ECS
• Web Browser and Version: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:89.0) Gecko/20100101 Firefox/89.0

What happened? Send the following request:

curl 'https://host/api/v1/configs' -X PATCH -H 'User-Agent: Mozilla/5.0
(Macintosh; Intel Mac OS X 10.14; rv:89.0) Gecko/20100101 Firefox/89.0' -H
'Accept: application/json' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H
'Referer: https://host/admin/config' -H 'Content-Type: application/json' -H
'CSRF-Token: ****************************************************' -H 'Origin:
https://host' -H 'DNT: 1' -H 'Connection: keep-alive' -H 'Cookie:
session=******-******-**************' -H 'Sec-GPC: 1' -H 'TE: Trailers'
--data-raw $'{"successful_registration_email_subject":"Successfully registered
for {ctf_name}","successful_registration_email_body":"You\'ve successfully
    registered for {ctf_name}\041","verification_email_subject":"Confirm your
    account for {ctf_name}","verification_email_body":"Welcome to
    {ctf_name}\041\\r\\n\\r\\nClick the following link to confirm and activate
    your account:\\r\\n{url}\\r\\n\\r\\nIf the link is not clickable, try
    copying and pasting it into your
    browser.","user_creation_email_subject":"Message from
    {ctf_name}","user_creation_email_body":"A new account has been created for
    you for {ctf_name} at {url}. \\r\\n\\r\\nUsername: {name}\\r\\nPassword:
    {password}","password_reset_subject":"Password Reset Request from
    {ctf_name}","password_reset_body":"Did you initiate a password reset on
    {ctf_name}? If you didn\'t initiate this request you can ignore this email.
    \\r\\n\\r\\nClick the following link to reset your
    password:\\r\\n{url}\\r\\n\\r\\nIf the link is not clickable, try copying
    and pasting it into your
    browser.","password_change_alert_subject":"Password Change Confirmation for
    {ctf_name}","password_change_alert_body":"Your password for {ctf_name} has
    been changed.\\r\\n\\r\\nIf you didn\'t request a password change you can
    reset your password here:
    {url}","mailfrom_addr":"","mail_server":"","mail_port":"","mail_username":null,
    "mail_password":null,"mailgun_base_url":"","mailgun_api_key":"",
    "mail_useauth":false,"mail_ssl":false,"mail_tls":false}' 

gives a 400 bad request status with the following body

{"success": false, "errors": {"value": ["mail_useauth config is too long"]}}

while if I change the false values in the JSON to "false" (with quotes), I get the expected 200 OK status.

What did you expect to happen?

{"success": true

How to reproduce your issue Use Firefox’s integrated developer tools to copy the request as cURL and used cURL to send it again.

Any associated stack traces or error logs

./CTFd/themes/core/assets/js/fetch.js/t.default
https://host/themes/admin/static/js/pages/configs.min.js:1:62180
./CTFd/themes/core/assets/js/api.js/n</e.prototype.request
https://host/themes/admin/static/js/pages/configs.min.js:1:26970
./CTFd/themes/core/assets/js/patch.js/o.API.prototype.patch_config_list
https://host/themes/admin/static/js/pages/configs.min.js:1:65384
v
https://host/themes/admin/static/js/pages/configs.min.js:1:4002
dispatch
https://host/themes/admin/static/js/vendor.bundle.min.js:110:39033
add/h.handle
https://host/themes/admin/static/js/vendor.bundle.min.js:110:37028

[phretor]

Meanwhile I’ve tested this patch, which seems to be doing the job:

diff --git i/CTFd/api/v1/config.py w/CTFd/api/v1/config.py
index a0368ff..7837857 100644
--- i/CTFd/api/v1/config.py
+++ w/CTFd/api/v1/config.py
@@ -115,6 +115,8 @@ class ConfigList(Resource):
         schema = ConfigSchema()
 
         for key, value in req.items():
+            if isinstance(value, bool):
+                value = str(value)
             response = schema.load({"key": key, "value": value})
             if response.errors:
                 # Inject config key into error

[ColdHeat]

This should be fixed now, if not please comment or open a new issue.