#include #include "common.h" int main(int argc, char *argv[]) { char team[TEAM_MAX] = {0}; char category[CAT_MAX] = {0}; char points_str[11] = {0}; char answer[500] = {0}; long points = 0; if (-1 == cgi_init(argv)) { return 0; } /* Read in team and answer */ while (1) { size_t len; char key[20]; len = cgi_item(key, sizeof(key)); if (0 == len) break; switch (key[0]) { case 't': cgi_item(team, sizeof(team)); break; case 'c': cgi_item(category, sizeof(category)); break; case 'p': cgi_item(points_str, sizeof(points_str)); points = atol(points_str); break; case 'a': cgi_item(answer, sizeof(answer)); break; } } /* Check to see if team exists */ if (! team_exists(team)) { cgi_page("No such team", ""); } /* Validate category name (prevent directory traversal) */ { char *p; for (p = category; *p; p += 1) { if (! isalnum(*p)) { cgi_page("Invalid category", ""); } } } /* Check answer (also assures category exists) */ { char needle[400]; my_snprintf(needle, sizeof(needle), "%ld %s", points, answer); if (! fgrepx(needle, srv_path("packages/%s/answers.txt", category))) { cgi_page("Wrong answer", ""); } } { char line[TEAM_MAX + CAT_MAX + sizeof(points_str) + 2]; my_snprintf(line, sizeof(line), "%s %s %ld", team, category, points); award_and_log_uniquely(team, category, points, "puzzler.db", line); } cgi_page("Points awarded", ("

%d points for %s.

" ""), points, team, points); return 0; }