From dd4c6b30b602e485714342169113413ea6c88e2a Mon Sep 17 00:00:00 2001
From: Neale Pickett <neale@woozle.org>
Date: Wed, 3 Jun 2015 15:31:26 -0600
Subject: [PATCH] Token submission

---
 www/cgi-bin/puzzles.cgi |  8 ++++++++
 www/cgi-bin/token.cgi   | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)
 create mode 100755 www/cgi-bin/token.cgi

diff --git a/www/cgi-bin/puzzles.cgi b/www/cgi-bin/puzzles.cgi
index 1e0b199..052d0bc 100755
--- a/www/cgi-bin/puzzles.cgi
+++ b/www/cgi-bin/puzzles.cgi
@@ -44,6 +44,14 @@ for cat, biggest in pairs(max_by_cat) do
 	body = body .. "</dd>\n"
 end
 body = body .. "</dl>\n"
+body = body .. "<fieldset><legend>Sandia Token:</legend>"
+body = body .. "<p>Example: <samp>sandia:5:xylep-radar-nanox</samp></p>"
+body = body .. "<form action='cgi-bin/token.cgi'>"
+body = body .. "Team Hash: <input name='t'><br>"
+body = body .. "Token: <input name='k'>"
+body = body .. "<input type='submit'>"
+body = body .. "</form>"
+body = body .. "</fieldset>"
 body = body .. "<p>Reloading this page periodically may yield updated puzzle lists.</p>"
 
 koth.page("Open Puzzles", body)
diff --git a/www/cgi-bin/token.cgi b/www/cgi-bin/token.cgi
new file mode 100755
index 0000000..8d8ea39
--- /dev/null
+++ b/www/cgi-bin/token.cgi
@@ -0,0 +1,38 @@
+#! /usr/bin/env lua
+
+package.path = "?.lua;cgi-bin/?.lua;www/cgi-bin/?.lua"
+
+local cgi = require "cgi"
+local koth = require "koth"
+
+local team = cgi.fields['t'] or ""
+local token = cgi.fields['k'] or ""
+
+-- Defang category name; prevent directory traversal
+category = category:gsub("[^A-Za-z0-9]", "-")
+
+-- Check answer
+local needle = token
+local haystack = koth.path("tokens.txt")
+local found, err = koth.anchored_search(haystack, needle)
+
+if (not found) then
+	koth.page("Unrecognized token", err)
+end
+
+local category, points = token.match("^(.*):(.*):")
+if ((category == nil) || (points == nil)) then
+	koth.page("Unrecognized token", "Something doesn't look right about that token")
+end
+points = tonumber(points)
+
+local ok, err = koth.award_points(team, category, points, token)
+if (not ok) then
+	koth.page("Error awarding points",
+	"<p>You entered a valid token, but there was a problem trying to give you points:</p>" ..
+	"<p>" .. err .. "</p>")
+end
+
+koth.page("Points awarded",
+	"<p>" .. points .. " points for " .. team .. "!</p>" ..
+	"<p><a href=\"../puzzles.html\">Back to puzzles</a></p>")