Don't leak team tokens in summary web pages

Dockerfile

@@ -1,9 +1,21 @@
-FROM alpine AS builder
+FROM docker.io/library/httpd:2.4-alpine3.18 AS builder
+
+RUN apk --no-cache add \
+    build-base \
+    m4 \
+    markdown
 
-RUN apk --no-cache add build-base m4 markdown
 COPY . /src
-RUN make -C /src DESTDIR=/tanks install
+RUN make -C /src DESTDIR=/tanks && \ 
+    make -C /src DESTDIR=/tanks install
 
-FROM neale/eris
+#    dos2unix src/go.sh src/rank.awk src/round.sh src/summary.awk && \
-COPY --from=builder /tanks /tanks
+
-CMD [ "/tanks/bin/go.sh" ]
+
+FROM docker.io/library/httpd:2.4-alpine3.18
+COPY --from=builder /tanks/bin /tanks/bin
+COPY --from=builder /tanks/www /tanks/www-orig
+COPY httpd.conf /usr/local/apache2/conf/httpd.conf
+#RUN sed -i 's/\/usr\/local\/apache2\/htdocs/\/tanks\/www/' /usr/local/apache2/conf/httpd.conf && \
+#    sed -i 's/Options Indexes FollowSymLinks/Options Indexes FollowSymLinks ExecCGI\n    AddHandler cgi-script .cgi\n    SetEnv BASE_PATH \/tanks\/tanks\//' /usr/local/apache2/conf/httpd.conf
+CMD [ "sh", "-c", "if [[ ! -d /tanks/www/ ]]; then mkdir /tanks/www/; fi && cp -ru /tanks/www-orig/* /tanks/www/ & /tanks/bin/go.sh" ]

Makefile

@@ -17,7 +17,7 @@ install: $(BINARIES) $(HTML)
 	install summary.awk $(DESTDIR)/bin
 	install forftanks $(DESTDIR)/bin
 
-	install -d -o $(id -u www) -g $(id -g www) $(DESTDIR)/www
+	install -d -o $(shell id -u www-data) -g $(shell id -g www-data) $(DESTDIR)/www
 	install upload.cgi $(DESTDIR)/www
 	install -m 0644 $(HTML) $(DESTDIR)/www
 	install -m 0644 $(WWW) $(DESTDIR)/www

go.sh

@@ -2,13 +2,15 @@
 
 cd $(dirname $0)/../www
 
+export BASE_PATH=/tanks/www/state/
+
 (
-  s6-tcpserver -u $(id -u www) -g $(id -g www) 0.0.0.0 80 /usr/bin/eris -c -.
+  httpd-foreground
 ) &
 
 (
   while true; do
-    ../bin/round.sh */
+    ../bin/round.sh /tanks/www/state/*
     sleep 60
   done
 ) &

httpd.conf

@@ -0,0 +1,38 @@
+ServerRoot "/usr/local/apache2"
+
+Listen 80
+
+LoadModule mpm_event_module modules/mod_mpm_event.so
+LoadModule unixd_module modules/mod_unixd.so
+LoadModule authz_core_module modules/mod_authz_core.so
+LoadModule mime_module modules/mod_mime.so
+LoadModule env_module modules/mod_env.so
+LoadModule cgid_module modules/mod_cgid.so
+LoadModule log_config_module modules/mod_log_config.so
+
+<IfModule unixd_module>
+    User www-data
+    Group www-data
+</IfModule>
+
+<Directory />
+    AllowOverride none
+    Require all denied
+</Directory>
+
+DocumentRoot "/tanks/www"
+<Directory "/tanks/www">
+    Options Indexes FollowSymLinks ExecCGI
+    AddHandler cgi-script .cgi
+    PassEnv BASE_PATH
+
+    Require all granted
+</Directory>
+
+<IfModule log_config_module>
+    LogFormat "%h %l %u %t \"%r\" %>s %b" common
+    CustomLog /dev/stdout common
+</IfModule>
+
+LogLevel warn
+ErrorLog /dev/stderr

rank.awk

@@ -75,7 +75,6 @@ END {
                 printf("<td>" reason[me] "</td>");
                 printf("<td>" lasterr[me] "</td>");
                 printf("</tr>\n");
-				printf("<!-- score " path[me] " " i " -->\n");
             }
         }
     }

upload.cgi.c

@@ -285,7 +285,8 @@ main(int argc, char *argv[])
 
 		snprintf(path, sizeof(path), "%s%s/", BASE_PATH, token);
 		if (-1 == stat(path, &st))
-			return croak(422, "Invalid token");
+			//return croak(422, "Invalid token");
+			return croak(422, path);
 		if (!S_ISDIR(st.st_mode))
 			return croak(422, "Invalid token");
 		for (i = 0; entries[i].name; i += 1) {