fix: do not only lockup the default upload_folder

api.py

@@ -5,7 +5,7 @@
 import os
 import base64
 
-from flask import request
+from flask import request, current_app
 from flask_restx import Namespace, Resource, abort
 from sqlalchemy import text
 
@@ -488,7 +488,7 @@ def post():
 
         # get base64 file located at full_scenario_location and send it to Chall-Manager
         # ex: b07afae94edec5d8a74c8d7b590feb63/deploy.zip
-        full_scenario_location = os.path.join(os.getcwd(), "CTFd", "uploads", scenario.location)
+        full_scenario_location = os.path.join(current_app.config.get("UPLOAD_FOLDER"), scenario.location)
         try: 
             with open(full_scenario_location, "rb") as f:  
                 # TODO add hash checksum          
@@ -603,7 +603,7 @@ def patch():
 
             print("new_scenario = ", new_scenario)
 
-            full_scenario_location = os.path.join(os.getcwd(), "CTFd", "uploads", new_scenario.location)
+            full_scenario_location = os.path.join(current_app.config.get("UPLOAD_FOLDER"), scenario.location)
             try: 
                 with open(full_scenario_location, "rb") as f:  
                     # TODO add hash checksum