From db2cc99cc703c96a5c877d48cdf249ef4ae02b4e Mon Sep 17 00:00:00 2001
From: Jack Miner <3ch01c@gmail.com>
Date: Sun, 24 Mar 2019 20:34:01 -0600
Subject: [PATCH 01/18] Added support for mothballing puzzles containing files
 with spaces in their filenames and creating mothball path if it doesn't
 exist.

---
 devel/moth.py       | 7 ++++---
 devel/mothballer.py | 3 +++
 docs/CREDITS.md     | 1 +
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/devel/moth.py b/devel/moth.py
index 6a62116..6d04aa2 100644
--- a/devel/moth.py
+++ b/devel/moth.py
@@ -12,6 +12,7 @@ import os
 import random
 import string
 import tempfile
+import shlex
 
 messageChars = b'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
 
@@ -112,7 +113,7 @@ class Puzzle:
                 elif key == 'name':
                     pass
                 elif key == 'file':
-                    parts = val.split()
+                    parts = shlex.split(val)
                     name = parts[0]
                     hidden = False
                     stream = open(name, 'rb')
@@ -264,10 +265,10 @@ class Puzzle:
     def html_body(self):
         """Format and return the markdown for the puzzle body."""
         return mistune.markdown(self.get_body(), escape=False)
-        
+
     def package(self, answers=False):
         """Return a dict packaging of the puzzle."""
-        
+
         files = [fn for fn,f in self.files.items() if f.visible]
         return {
             'authors': self.authors,
diff --git a/devel/mothballer.py b/devel/mothballer.py
index 19bd46d..135034b 100755
--- a/devel/mothballer.py
+++ b/devel/mothballer.py
@@ -59,6 +59,9 @@ def build_category(categorydir, outdir):
     mothball = package(categoryname, categorydir, category_seed)
     shutil.copyfileobj(mothball, zipfileraw)
     zipfileraw.close()
+    zipfiledir = os.path.dirname(zipfilename)
+    if not os.path.exists(zipfiledir):
+        os.makedirs(zipfiledir)
     shutil.move(zipfileraw.name, zipfilename)
 
 
diff --git a/docs/CREDITS.md b/docs/CREDITS.md
index ada9f18..367b28c 100644
--- a/docs/CREDITS.md
+++ b/docs/CREDITS.md
@@ -5,6 +5,7 @@ Being in this list is voluntary. Add your name when you contribute code.
 * Paul Ferrell
 * Shannon Steinfadt
 * John Donaldson
+* 3ch01c
 
 Word List
 ---------

From 62a69520910551f9aec5e41d1fbfaa9a22258643 Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@lanl.gov>
Date: Wed, 10 Apr 2019 19:56:17 +0000
Subject: [PATCH 02/18] Expand helpers.js to have an extendible list of inputs,
 and allow puzzle author to have them be sorted

---
 example-puzzles/example/5/helpers.js  | 29 +++++++++++++++++++++++++++
 example-puzzles/example/5/puzzle.moth |  6 ++++++
 2 files changed, 35 insertions(+)

diff --git a/example-puzzles/example/5/helpers.js b/example-puzzles/example/5/helpers.js
index 3c566bc..0f7a677 100644
--- a/example-puzzles/example/5/helpers.js
+++ b/example-puzzles/example/5/helpers.js
@@ -17,6 +17,9 @@ function helperUpdateAnswer(event) {
         values.push(c.value)
       }
     }
+    if (e.classList.contains("sort")) {
+      values.sort()
+    }
     value = values.join(",")
   }
 
@@ -33,8 +36,34 @@ function helperUpdateAnswer(event) {
   answer.dispatchEvent(new InputEvent("input"))
 }
 
+function helperRemoveInput(e) {
+  let item = e.target.parentElement
+  item.remove()
+}
+
+function helperExpandInputs(e) {
+  let item = e.target.parentElement
+  let container = item.parentElement
+  let template = container.firstElementChild
+  let newElement = template.cloneNode(true)
+
+  // Add remove button
+  let remove = document.createElement("button")
+  remove.innerText = "➖"
+  remove.addEventListener("click", helperRemoveInput)
+  newElement.appendChild(remove)
+
+  // Zero it out, otherwise whatever's in first element is copied too
+  newElement.querySelector("input").value = ""
+
+  container.insertBefore(newElement, item)
+}
+
 function helperActivate(e) {
   e.addEventListener("input", helperUpdateAnswer)
+  if (e.classList.contains("expand")) {
+    e.addEventListener("click", helperExpandInputs)
+  }
 }
 
 function helperInit(event) {
diff --git a/example-puzzles/example/5/puzzle.moth b/example-puzzles/example/5/puzzle.moth
index 9c3be6b..63cd4e2 100644
--- a/example-puzzles/example/5/puzzle.moth
+++ b/example-puzzles/example/5/puzzle.moth
@@ -31,6 +31,12 @@ Multiple concatenated values
   <input>
 </div>
 
+Free input, sorted, concatenated values
+<ul class="answer lower sort">
+  <li><input></li>
+  <li><button class="answer expand" data-tag="input">➕</button><li>
+</ul>
+
 Select from an ordered list of options
 <ul class="answer">
   <li><input type="checkbox" value="horn">Horns</li>

From c04651db90a058aa240094db5d9a30ec91da23c2 Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@lanl.gov>
Date: Wed, 10 Apr 2019 20:00:22 +0000
Subject: [PATCH 03/18] Remove legacy technique for new inputs

---
 example-puzzles/example/5/puzzle.moth | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/example-puzzles/example/5/puzzle.moth b/example-puzzles/example/5/puzzle.moth
index 63cd4e2..e82f789 100644
--- a/example-puzzles/example/5/puzzle.moth
+++ b/example-puzzles/example/5/puzzle.moth
@@ -34,7 +34,7 @@ Multiple concatenated values
 Free input, sorted, concatenated values
 <ul class="answer lower sort">
   <li><input></li>
-  <li><button class="answer expand" data-tag="input">➕</button><li>
+  <li><button class="answer expand">➕</button><li>
 </ul>
 
 Select from an ordered list of options

From dd0d9cadf5334d316b47c5883c091fc2fc5fc678 Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@lanl.gov>
Date: Wed, 10 Apr 2019 20:03:12 +0000
Subject: [PATCH 04/18] Make it a little cleaner for the puzzle writer

---
 example-puzzles/example/5/helpers.js  | 4 ++--
 example-puzzles/example/5/puzzle.moth | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/example-puzzles/example/5/helpers.js b/example-puzzles/example/5/helpers.js
index 0f7a677..c68b5f3 100644
--- a/example-puzzles/example/5/helpers.js
+++ b/example-puzzles/example/5/helpers.js
@@ -61,8 +61,8 @@ function helperExpandInputs(e) {
 
 function helperActivate(e) {
   e.addEventListener("input", helperUpdateAnswer)
-  if (e.classList.contains("expand")) {
-    e.addEventListener("click", helperExpandInputs)
+  for (let exp of e.querySelectorAll(".expand")) {
+    exp.addEventListener("click", helperExpandInputs)
   }
 }
 
diff --git a/example-puzzles/example/5/puzzle.moth b/example-puzzles/example/5/puzzle.moth
index e82f789..1000bfd 100644
--- a/example-puzzles/example/5/puzzle.moth
+++ b/example-puzzles/example/5/puzzle.moth
@@ -34,7 +34,7 @@ Multiple concatenated values
 Free input, sorted, concatenated values
 <ul class="answer lower sort">
   <li><input></li>
-  <li><button class="answer expand">➕</button><li>
+  <li><button class="expand">➕</button><li>
 </ul>
 
 Select from an ordered list of options

From 53a299d6354918cbdfdf87f124671398810e41b2 Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@lanl.gov>
Date: Wed, 10 Apr 2019 20:04:04 +0000
Subject: [PATCH 05/18] Make it a little cleaner for the puzzle writer

---
 example-puzzles/example/5/helpers.js  | 1 +
 example-puzzles/example/5/puzzle.moth | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/example-puzzles/example/5/helpers.js b/example-puzzles/example/5/helpers.js
index c68b5f3..946e8e2 100644
--- a/example-puzzles/example/5/helpers.js
+++ b/example-puzzles/example/5/helpers.js
@@ -50,6 +50,7 @@ function helperExpandInputs(e) {
   // Add remove button
   let remove = document.createElement("button")
   remove.innerText = "➖"
+  remove.title = "Remove this input"
   remove.addEventListener("click", helperRemoveInput)
   newElement.appendChild(remove)
 
diff --git a/example-puzzles/example/5/puzzle.moth b/example-puzzles/example/5/puzzle.moth
index 1000bfd..46dfff2 100644
--- a/example-puzzles/example/5/puzzle.moth
+++ b/example-puzzles/example/5/puzzle.moth
@@ -34,7 +34,7 @@ Multiple concatenated values
 Free input, sorted, concatenated values
 <ul class="answer lower sort">
   <li><input></li>
-  <li><button class="expand">➕</button><li>
+  <li><button class="expand" title="Add another input">➕</button><l/i>
 </ul>
 
 Select from an ordered list of options

From d7c1da6c2b5970aff18a31dd468ab4ae7a27232f Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@lanl.gov>
Date: Wed, 10 Apr 2019 20:08:33 +0000
Subject: [PATCH 06/18] Adding/removing inputs updates answer

---
 example-puzzles/example/5/helpers.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/example-puzzles/example/5/helpers.js b/example-puzzles/example/5/helpers.js
index 946e8e2..603b92e 100644
--- a/example-puzzles/example/5/helpers.js
+++ b/example-puzzles/example/5/helpers.js
@@ -38,7 +38,11 @@ function helperUpdateAnswer(event) {
 
 function helperRemoveInput(e) {
   let item = e.target.parentElement
+  let container = item.parentElement
   item.remove()
+  
+  var event = new Event("input")
+  container.dispatchEvent(event)
 }
 
 function helperExpandInputs(e) {
@@ -58,6 +62,9 @@ function helperExpandInputs(e) {
   newElement.querySelector("input").value = ""
 
   container.insertBefore(newElement, item)
+  
+  var event = new Event("input")
+  container.dispatchEvent(event)
 }
 
 function helperActivate(e) {

From fec41324715a2130cc2890357479e15e7fed68b0 Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@woozle.org>
Date: Thu, 11 Apr 2019 02:33:18 +0000
Subject: [PATCH 07/18] Backport to Python 3.5 (debian stretch)

---
 devel/devel-server.py | 50 +++++++++++++++++++++++++++++++++++++------
 1 file changed, 43 insertions(+), 7 deletions(-)

diff --git a/devel/devel-server.py b/devel/devel-server.py
index 6a8e6d6..79e1ce3 100755
--- a/devel/devel-server.py
+++ b/devel/devel-server.py
@@ -14,18 +14,25 @@ import os
 import pathlib
 import random
 import shutil
-import socketserver
 import sys
 import traceback
 import mothballer
 import parse
+import urllib.parse
+import posixpath
 from http import HTTPStatus
 
 
 sys.dont_write_bytecode = True  # Don't write .pyc files
 
+try:
+    ThreadingHTTPServer = http.server.ThreadingHTTPServer
+except AttributeError:
+    import socketserver
+    class ThreadingHTTPServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
+        daemon_threads = True
 
-class MothServer(http.server.ThreadingHTTPServer):
+class MothServer(ThreadingHTTPServer):
     def __init__(self, server_address, RequestHandlerClass):
         super().__init__(server_address, RequestHandlerClass)
         self.args = {}
@@ -35,13 +42,44 @@ class MothRequestHandler(http.server.SimpleHTTPRequestHandler):
     endpoints = []
     
     def __init__(self, request, client_address, server):
-        super().__init__(request, client_address, server, directory=server.args["theme_dir"])
+        self.directory = str(server.args["theme_dir"])
+        super().__init__(request, client_address, server)
+
+    # Backport from Python 3.7
+    def translate_path(self, path):
+        """Translate a /-separated PATH to the local filename syntax.
+        Components that mean special things to the local file system
+        (e.g. drive or directory names) are ignored.  (XXX They should
+        probably be diagnosed.)
+        """
+        # abandon query parameters
+        path = path.split('?',1)[0]
+        path = path.split('#',1)[0]
+        # Don't forget explicit trailing slash when normalizing. Issue17324
+        trailing_slash = path.rstrip().endswith('/')
+        try:
+            path = urllib.parse.unquote(path, errors='surrogatepass')
+        except UnicodeDecodeError:
+            path = urllib.parse.unquote(path)
+        path = posixpath.normpath(path)
+        words = path.split('/')
+        words = filter(None, words)
+        path = self.directory
+        for word in words:
+            if os.path.dirname(word) or word in (os.curdir, os.pardir):
+                # Ignore components that are not a simple file/directory name
+                continue
+            path = os.path.join(path, word)
+        if trailing_slash:
+            path += '/'
+        return path
 
 
     def get_puzzle(self):
         category = self.req.get("cat")
         points = int(self.req.get("points"))
-        cat = moth.Category(self.server.args["puzzles_dir"].joinpath(category), self.seed)
+        catpath = str(self.server.args["puzzles_dir"].joinpath(category))
+        cat = moth.Category(catpath, self.seed)
         puzzle = cat.puzzle(points)
         return puzzle
 
@@ -75,7 +113,7 @@ class MothRequestHandler(http.server.SimpleHTTPRequestHandler):
             if not p.is_dir() or p.match(".*"):
                 continue
             catName = p.parts[-1]
-            cat = moth.Category(p, self.seed)
+            cat = moth.Category(str(p), self.seed)
             puzzles[catName] = [[i, str(i)] for i in cat.pointvals()]
             puzzles[catName].append([0, ""])
         if len(puzzles) <= 1:
@@ -254,8 +292,6 @@ if __name__ == '__main__':
     
     logging.basicConfig(level=logging.INFO)
     
-    mydir = os.path.dirname(os.path.dirname(os.path.realpath(sys.argv[0])))
-    
     server = MothServer((addr, port), MothRequestHandler)
     server.args["base_url"] = args.base
     server.args["puzzles_dir"] = pathlib.Path(args.puzzles)

From e4fae16023ed4975cf3529c6f5e30641c4e2aa1f Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@woozle.org>
Date: Thu, 11 Apr 2019 02:41:13 +0000
Subject: [PATCH 08/18] There's a simpler way to do it

---
 devel/devel-server.py | 32 ++++++--------------------------
 1 file changed, 6 insertions(+), 26 deletions(-)

diff --git a/devel/devel-server.py b/devel/devel-server.py
index 79e1ce3..1a6167d 100755
--- a/devel/devel-server.py
+++ b/devel/devel-server.py
@@ -47,32 +47,12 @@ class MothRequestHandler(http.server.SimpleHTTPRequestHandler):
 
     # Backport from Python 3.7
     def translate_path(self, path):
-        """Translate a /-separated PATH to the local filename syntax.
-        Components that mean special things to the local file system
-        (e.g. drive or directory names) are ignored.  (XXX They should
-        probably be diagnosed.)
-        """
-        # abandon query parameters
-        path = path.split('?',1)[0]
-        path = path.split('#',1)[0]
-        # Don't forget explicit trailing slash when normalizing. Issue17324
-        trailing_slash = path.rstrip().endswith('/')
-        try:
-            path = urllib.parse.unquote(path, errors='surrogatepass')
-        except UnicodeDecodeError:
-            path = urllib.parse.unquote(path)
-        path = posixpath.normpath(path)
-        words = path.split('/')
-        words = filter(None, words)
-        path = self.directory
-        for word in words:
-            if os.path.dirname(word) or word in (os.curdir, os.pardir):
-                # Ignore components that are not a simple file/directory name
-                continue
-            path = os.path.join(path, word)
-        if trailing_slash:
-            path += '/'
-        return path
+        # I guess we just hope that some other thread doesn't call getcwd
+        getcwd = os.getcwd
+        os.getcwd = lambda: self.directory
+        ret = super().translate_path(path)
+        os.getcwd = getcwd
+        return ret
 
 
     def get_puzzle(self):

From dce5d5f0acedf2ed673147304f941eec1bdae2df Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@woozle.org>
Date: Fri, 19 Apr 2019 03:58:34 +0000
Subject: [PATCH 09/18] Work around lack of `datetime-local` input support in
 2019

---
 example-puzzles/example/5/helpers.js  | 6 +++++-
 example-puzzles/example/5/puzzle.moth | 9 +++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/example-puzzles/example/5/helpers.js b/example-puzzles/example/5/helpers.js
index 3c566bc..c5f2388 100644
--- a/example-puzzles/example/5/helpers.js
+++ b/example-puzzles/example/5/helpers.js
@@ -17,7 +17,11 @@ function helperUpdateAnswer(event) {
         values.push(c.value)
       }
     }
-    value = values.join(",")
+    let join = e.dataset.join
+    if (join === undefined) {
+      join = ","
+    }
+    value = values.join(join)
   }
 
   // First make any adjustments to the value
diff --git a/example-puzzles/example/5/puzzle.moth b/example-puzzles/example/5/puzzle.moth
index 9c3be6b..b714a91 100644
--- a/example-puzzles/example/5/puzzle.moth
+++ b/example-puzzles/example/5/puzzle.moth
@@ -17,8 +17,13 @@ This is just a demonstration page.
 You will probably only want one of these in a page,
 to avoid confusing people.
 
-Timestamp
-<input type="datetime-local" class="answer">
+RFC3339 Timestamp
+<div class="answer" data-join="">
+  <input type="date">
+  <input type="hidden" value="T">
+  <input type="time" step="1">
+  <input type="hidden" value="Z">
+</div>
 
 All lower-case letters
 <input class="answer lower">

From e01e0fc2b3a073b0548745a4adce5209b4c61813 Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@woozle.org>
Date: Fri, 19 Apr 2019 15:01:28 +0000
Subject: [PATCH 10/18] Bump version

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 0ff4b45..fd2a018 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1.0

From a9146dc93602c36482c4fcc7b9a182d746d88a5a Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@woozle.org>
Date: Fri, 19 Apr 2019 15:01:42 +0000
Subject: [PATCH 11/18] Bump version a better awy

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index fd2a018..a3ec5a4 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.1.0
+3.2

From 15ee01b69df567d781e0adb5e8e4fd13894043a3 Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@woozle.org>
Date: Fri, 19 Apr 2019 16:18:08 +0000
Subject: [PATCH 12/18] Back out a change I disagree with

---
 devel/mothballer.py | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/devel/mothballer.py b/devel/mothballer.py
index 135034b..19bd46d 100755
--- a/devel/mothballer.py
+++ b/devel/mothballer.py
@@ -59,9 +59,6 @@ def build_category(categorydir, outdir):
     mothball = package(categoryname, categorydir, category_seed)
     shutil.copyfileobj(mothball, zipfileraw)
     zipfileraw.close()
-    zipfiledir = os.path.dirname(zipfilename)
-    if not os.path.exists(zipfiledir):
-        os.makedirs(zipfiledir)
     shutil.move(zipfileraw.name, zipfilename)
 
 

From 96835d650486977b4e2fb1d324c9894836a49f69 Mon Sep 17 00:00:00 2001
From: John Donaldson <donaldson8@llnl.gov>
Date: Mon, 29 Apr 2019 19:26:55 +0100
Subject: [PATCH 13/18] Adding more information about running devel server

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 58f5d7d..74c6d44 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,7 @@ and comes with a JavaScript-based scoreboard to display team rankings.
 Running a Development Server
 ============================
 
-    docker run --rm -it -p 8080:8080 dirtbags/moth-devel
+    docker run --rm -it -p 8080:8080 -v /path/to/puzzles:/puzzles:ro dirtbags/moth-devel
 
 And point a browser to http://localhost:8080/ (or whatever host is running the server).
 

From e3309902117008a93c32e54548a3aef2713db7d7 Mon Sep 17 00:00:00 2001
From: John Donaldson <donaldson8@llnl.gov>
Date: Mon, 29 Apr 2019 20:31:16 +0100
Subject: [PATCH 14/18] Fixing some Python 3.5 vs 3.7 compatibility issues

---
 Dockerfile.moth-devel | 1 -
 devel/devel-server.py | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/Dockerfile.moth-devel b/Dockerfile.moth-devel
index 20c659a..6e8466a 100644
--- a/Dockerfile.moth-devel
+++ b/Dockerfile.moth-devel
@@ -16,6 +16,5 @@ COPY devel /app/
 COPY example-puzzles /puzzles/
 COPY theme /theme/
 
-WORKDIR /moth/
 ENTRYPOINT [ "python3", "/app/devel-server.py" ]
 CMD [ "--bind", "0.0.0.0:8080", "--puzzles", "/puzzles", "--theme", "/theme" ]
diff --git a/devel/devel-server.py b/devel/devel-server.py
index 1a6167d..37fda8c 100755
--- a/devel/devel-server.py
+++ b/devel/devel-server.py
@@ -43,7 +43,11 @@ class MothRequestHandler(http.server.SimpleHTTPRequestHandler):
     
     def __init__(self, request, client_address, server):
         self.directory = str(server.args["theme_dir"])
-        super().__init__(request, client_address, server)
+        try:
+            super().__init__(request, client_address, server, directory=server.args["theme_dir"])
+        except TypeError:
+            super().__init__(request, client_address, server)
+
 
     # Backport from Python 3.7
     def translate_path(self, path):

From 03247983bbc97716c4ff1c13a43f39f6ca0d837d Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@woozle.org>
Date: Tue, 30 Apr 2019 03:31:16 +0000
Subject: [PATCH 15/18] Possibly fix race condition in rate limiting

---
 contrib/smash      | 26 ++++++++++++++++++++++++++
 src/instance.go    | 25 +++++++++++++++++++------
 src/maintenance.go | 11 ++++++++++-
 3 files changed, 55 insertions(+), 7 deletions(-)
 create mode 100755 contrib/smash

diff --git a/contrib/smash b/contrib/smash
new file mode 100755
index 0000000..9a743c0
--- /dev/null
+++ b/contrib/smash
@@ -0,0 +1,26 @@
+#! /bin/sh
+
+BASEURL=http://localhost:8080
+
+case "$1" in
+  a)
+    URL=$BASEURL/answer
+    ;;
+  b)
+    URL=$BASEURL/puzzles.json
+    ;;
+  *)
+    echo "Usage: $0 a|b" 1>&2
+    exit 1
+    ;;
+esac
+
+while true; do
+  curl \
+    -X POST \
+    -F "cat=base" \
+    -F "points=1" \
+    -F "id=test" \
+    -F "answer=moo" \
+    $URL
+done
diff --git a/src/instance.go b/src/instance.go
index 968e70a..1d3a26f 100644
--- a/src/instance.go
+++ b/src/instance.go
@@ -11,6 +11,7 @@ import (
 	"os"
 	"path"
 	"strings"
+	"sync"
 	"time"
 )
 
@@ -21,12 +22,13 @@ type Instance struct {
 	ThemeDir        string
 	AttemptInterval time.Duration
 
-	categories  map[string]*Mothball
-	update      chan bool
-	jPuzzleList []byte
-	jPointsLog  []byte
-	nextAttempt map[string]time.Time
-	mux         *http.ServeMux
+	categories       map[string]*Mothball
+	update           chan bool
+	jPuzzleList      []byte
+	jPointsLog       []byte
+	nextAttempt      map[string]time.Time
+	nextAttemptMutex *sync.RWMutex
+	mux             *http.ServeMux
 }
 
 func (ctx *Instance) Initialize() error {
@@ -42,6 +44,7 @@ func (ctx *Instance) Initialize() error {
 	ctx.categories = map[string]*Mothball{}
 	ctx.update = make(chan bool, 10)
 	ctx.nextAttempt = map[string]time.Time{}
+	ctx.nextAttemptMutex = new(sync.RWMutex)
 	ctx.mux = http.NewServeMux()
 
 	ctx.BindHandlers()
@@ -129,8 +132,15 @@ func (ctx *Instance) ThemePath(parts ...string) string {
 
 func (ctx *Instance) TooFast(teamId string) bool {
 	now := time.Now()
+	
+	ctx.nextAttemptMutex.RLock()
 	next, _ := ctx.nextAttempt[teamId]
+	ctx.nextAttemptMutex.RUnlock()
+	
+	ctx.nextAttemptMutex.Lock()
 	ctx.nextAttempt[teamId] = now.Add(ctx.AttemptInterval)
+	ctx.nextAttemptMutex.Unlock()
+	
 	return now.Before(next)
 }
 
@@ -212,7 +222,10 @@ func (ctx *Instance) OpenCategoryFile(category string, parts ...string) (io.Read
 }
 
 func (ctx *Instance) ValidTeamId(teamId string) bool {
+	ctx.nextAttemptMutex.RLock()
 	_, ok := ctx.nextAttempt[teamId]
+	ctx.nextAttemptMutex.RUnlock()
+
 	return ok
 }
 
diff --git a/src/maintenance.go b/src/maintenance.go
index 3152c28..abd51e0 100644
--- a/src/maintenance.go
+++ b/src/maintenance.go
@@ -186,19 +186,28 @@ func (ctx *Instance) readTeams() {
 	now := time.Now()
 	added := 0
 	for k, _ := range newList {
-		if _, ok := ctx.nextAttempt[k]; !ok {
+		ctx.nextAttemptMutex.RLock()
+		_, ok := ctx.nextAttempt[k]
+		ctx.nextAttemptMutex.RUnlock()
+
+		if !ok {
+			ctx.nextAttemptMutex.Lock()
 			ctx.nextAttempt[k] = now
+			ctx.nextAttemptMutex.Unlock()
+
 			added += 1
 		}
 	}
 
 	// For any removed team IDs, remove them
 	removed := 0
+	ctx.nextAttemptMutex.Lock() // XXX: This could be less of a cludgel
 	for k, _ := range ctx.nextAttempt {
 		if _, ok := newList[k]; !ok {
 			delete(ctx.nextAttempt, k)
 		}
 	}
+	ctx.nextAttemptMutex.Unlock()
 
 	if (added > 0) || (removed > 0) {
 		log.Printf("Team IDs updated: %d added, %d removed", added, removed)

From cf79c8ec5ab22cc501bac92734d7fd9aed717ecb Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@woozle.org>
Date: Tue, 30 Apr 2019 03:49:59 +0000
Subject: [PATCH 16/18] Modify smash script to trigger the bug

---
 contrib/smash | 22 ++++++----------------
 1 file changed, 6 insertions(+), 16 deletions(-)

diff --git a/contrib/smash b/contrib/smash
index 9a743c0..0e958f0 100755
--- a/contrib/smash
+++ b/contrib/smash
@@ -1,26 +1,16 @@
 #! /bin/sh
 
-BASEURL=http://localhost:8080
+## Run two of these to trigger the race condition from
 
-case "$1" in
-  a)
-    URL=$BASEURL/answer
-    ;;
-  b)
-    URL=$BASEURL/puzzles.json
-    ;;
-  *)
-    echo "Usage: $0 a|b" 1>&2
-    exit 1
-    ;;
-esac
+BASEURL=http://localhost:8080
+URL=$BASEURL/answer
 
 while true; do
   curl \
     -X POST \
-    -F "cat=base" \
-    -F "points=1" \
+    -F "cat=byobf" \
+    -F "points=10" \
     -F "id=test" \
-    -F "answer=moo" \
+    -F "answer=6" \
     $URL
 done

From 0198d242574b4bee48b3eeb14b9be63d89a64975 Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@woozle.org>
Date: Tue, 30 Apr 2019 03:50:31 +0000
Subject: [PATCH 17/18] Bump version

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index a3ec5a4..eb39e53 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.2
+3.3

From acafeebcd99701d5ef0802f1270bf8d106982292 Mon Sep 17 00:00:00 2001
From: Donaldson <donaldson8@llnl.gov>
Date: Tue, 11 Jun 2019 17:58:15 -0500
Subject: [PATCH 18/18] Adding devel server instructions

---
 README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/README.md b/README.md
index 74c6d44..9d9d9c9 100644
--- a/README.md
+++ b/README.md
@@ -23,6 +23,12 @@ and comes with a JavaScript-based scoreboard to display team rankings.
 Running a Development Server
 ============================
 
+To use example puzzles
+
+    docker run --rm -it -p 8080:8080 dirtbags/moth-devel
+
+or, to use your own puzzles
+
     docker run --rm -it -p 8080:8080 -v /path/to/puzzles:/puzzles:ro dirtbags/moth-devel
 
 And point a browser to http://localhost:8080/ (or whatever host is running the server).