EventSource polyfill from Yaffle/EventSource interferes with Russian users

Environment:

• CTFd Version/Commit: 3.5.0
• Operating System: any
• Web Browser and Version: any

What happened? The Yaffle/EventSource polyfill contains code that pops an alert with some message about the Ukraine war 15s after every page load.

https://github.com/Yaffle/EventSource/issues/199

What did you expect to happen? Not do this. I want to clarify that I don't even know what this message says and am not making a political statement, but I don't think this is intended behavior.

How to reproduce your issue Change timezone to a russian timezone, visit a CTFd site.

Any associated stack traces or error logs

Can you reproduce this on https://demo.ctfd.io/? I'm not able to because I don't think we've updated to use an affected version of this library. I tried the core theme as well as the other themes that we provide.

I'm willing to update package.json to pin the version of the polyfill to an old version but I don't think any of the distributed js currently includes the affected version of the package.

Please note that you will need to change the theme to core as core-beta doesn't include this polyfill.

In the repo it looks like yarn.lock shows that we use version 1.0.19. https://github.com/CTFd/CTFd/blob/471bd48f1c699cb233daeda662ae2737df0af26f/yarn.lock#L2580-L2583

You're right, can't reproduce. I wasn't aware that one of our organizers had updated the core theme for our ctf, apologies!

I think this is worth fixing for us but I don't think it's very pressing and it is mostly just going to be pinning the package.json to be the version used in yarn.lock.

Sorry that this affected you and thanks for reporting it anyway!