summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 074971be1d19e4710ba953ab39003fab1de96094 (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub printheader ($) { #{{{
  10. my $session=shift;
  11. if ($config{sslcookie}) {
  12. print $session->header(-charset => 'utf-8',
  13. -cookie => $session->cookie(-secure => 1));
  14. } else {
  15. print $session->header(-charset => 'utf-8');
  16. }
  17. } #}}}
  18. sub redirect ($$) { #{{{
  19. my $q=shift;
  20. my $url=shift;
  21. if (! $config{w3mmode}) {
  22. print $q->redirect($url);
  23. }
  24. else {
  25. print "Content-type: text/plain\n";
  26. print "W3m-control: GOTO $url\n\n";
  27. }
  28. } #}}}
  29. sub page_locked ($$;$) { #{{{
  30. my $page=shift;
  31. my $session=shift;
  32. my $nonfatal=shift;
  33. my $user=$session->param("name");
  34. return if defined $user && is_admin($user);
  35. foreach my $admin (@{$config{adminuser}}) {
  36. my $locked_pages=userinfo_get($admin, "locked_pages");
  37. if (pagespec_match($page, userinfo_get($admin, "locked_pages"))) {
  38. return 1 if $nonfatal;
  39. error(htmllink("", "", $page, 1)." is locked by ".
  40. htmllink("", "", $admin, 1)." and cannot be edited.");
  41. }
  42. }
  43. return 0;
  44. } #}}}
  45. sub decode_form_utf8 ($) { #{{{
  46. my $form = shift;
  47. foreach my $f ($form->field) {
  48. next if Encode::is_utf8(scalar $form->field($f));
  49. $form->field(name => $f,
  50. value => decode_utf8($form->field($f)),
  51. force => 1,
  52. );
  53. }
  54. } #}}}
  55. sub cgi_recentchanges ($) { #{{{
  56. my $q=shift;
  57. unlockwiki();
  58. # Optimisation: building recentchanges means calculating lots of
  59. # links. Memoizing htmllink speeds it up a lot (can't be memoized
  60. # during page builds as the return values may change, but they
  61. # won't here.)
  62. eval q{use Memoize};
  63. memoize("htmllink");
  64. eval q{use Time::Duration};
  65. eval q{use CGI 'escapeHTML'};
  66. my $changelog=[rcs_recentchanges(100)];
  67. foreach my $change (@$changelog) {
  68. $change->{when} = concise(ago($change->{when}));
  69. $change->{user} = htmllink("", "", escapeHTML($change->{user}), 1);
  70. $change->{pages} = [
  71. map {
  72. $_->{link} = htmllink("", "", $_->{page}, 1);
  73. $_;
  74. } @{$change->{pages}}
  75. ];
  76. }
  77. my $template=template("recentchanges.tmpl");
  78. $template->param(
  79. title => "RecentChanges",
  80. indexlink => indexlink(),
  81. wikiname => $config{wikiname},
  82. changelog => $changelog,
  83. baseurl => baseurl(),
  84. );
  85. print $q->header(-charset => 'utf-8'), $template->output;
  86. } #}}}
  87. sub cgi_signin ($$) { #{{{
  88. my $q=shift;
  89. my $session=shift;
  90. eval q{use CGI::FormBuilder};
  91. my $form = CGI::FormBuilder->new(
  92. title => "signin",
  93. fields => [qw(do title page subpage from name password confirm_password email)],
  94. header => 1,
  95. charset => "utf-8",
  96. method => 'POST',
  97. validate => {
  98. confirm_password => {
  99. perl => q{eq $form->field("password")},
  100. },
  101. email => 'EMAIL',
  102. },
  103. required => 'NONE',
  104. javascript => 0,
  105. params => $q,
  106. action => $config{cgiurl},
  107. header => 0,
  108. template => (-e "$config{templatedir}/signin.tmpl" ?
  109. {template_params("signin.tmpl")} : ""),
  110. stylesheet => baseurl()."style.css",
  111. );
  112. decode_form_utf8($form);
  113. $form->field(name => "name", required => 0);
  114. $form->field(name => "do", type => "hidden");
  115. $form->field(name => "page", type => "hidden");
  116. $form->field(name => "title", type => "hidden");
  117. $form->field(name => "from", type => "hidden");
  118. $form->field(name => "subpage", type => "hidden");
  119. $form->field(name => "password", type => "password", required => 0);
  120. $form->field(name => "confirm_password", type => "password", required => 0);
  121. $form->field(name => "email", required => 0);
  122. if ($q->param("do") ne "signin" && !$form->submitted) {
  123. $form->text("You need to log in first.");
  124. }
  125. if ($form->submitted) {
  126. # Set required fields based on how form was submitted.
  127. my %required=(
  128. "Login" => [qw(name password)],
  129. "Register" => [qw(name password confirm_password email)],
  130. "Mail Password" => [qw(name)],
  131. );
  132. foreach my $opt (@{$required{$form->submitted}}) {
  133. $form->field(name => $opt, required => 1);
  134. }
  135. # Validate password differently depending on how
  136. # form was submitted.
  137. if ($form->submitted eq 'Login') {
  138. $form->field(
  139. name => "password",
  140. validate => sub {
  141. length $form->field("name") &&
  142. shift eq userinfo_get($form->field("name"), 'password');
  143. },
  144. );
  145. $form->field(name => "name", validate => '/^\w+$/');
  146. }
  147. else {
  148. $form->field(name => "password", validate => 'VALUE');
  149. }
  150. # And make sure the entered name exists when logging
  151. # in or sending email, and does not when registering.
  152. if ($form->submitted eq 'Register') {
  153. $form->field(
  154. name => "name",
  155. validate => sub {
  156. my $name=shift;
  157. length $name &&
  158. $name=~/$config{wiki_file_regexp}/ &&
  159. ! userinfo_get($name, "regdate");
  160. },
  161. );
  162. }
  163. else {
  164. $form->field(
  165. name => "name",
  166. validate => sub {
  167. my $name=shift;
  168. length $name &&
  169. userinfo_get($name, "regdate");
  170. },
  171. );
  172. }
  173. }
  174. else {
  175. # First time settings.
  176. $form->field(name => "name", comment => "use FirstnameLastName");
  177. $form->field(name => "confirm_password", comment => "(only needed");
  178. $form->field(name => "email", comment => "for registration)");
  179. if ($session->param("name")) {
  180. $form->field(name => "name", value => $session->param("name"));
  181. }
  182. }
  183. if ($form->submitted && $form->validate) {
  184. if ($form->submitted eq 'Login') {
  185. $session->param("name", $form->field("name"));
  186. if (defined $form->field("do") &&
  187. $form->field("do") ne 'signin') {
  188. redirect($q, cgiurl(
  189. do => $form->field("do"),
  190. page => $form->field("page"),
  191. title => $form->field("title"),
  192. subpage => $form->field("subpage"),
  193. from => $form->field("from"),
  194. ));
  195. }
  196. else {
  197. redirect($q, $config{url});
  198. }
  199. }
  200. elsif ($form->submitted eq 'Register') {
  201. my $user_name=$form->field('name');
  202. if (userinfo_setall($user_name, {
  203. 'email' => $form->field('email'),
  204. 'password' => $form->field('password'),
  205. 'regdate' => time
  206. })) {
  207. $form->field(name => "confirm_password", type => "hidden");
  208. $form->field(name => "email", type => "hidden");
  209. $form->text("Registration successful. Now you can Login.");
  210. printheader($session);
  211. print misctemplate($form->title, $form->render(submit => ["Login"]));
  212. }
  213. else {
  214. error("Error saving registration.");
  215. }
  216. }
  217. elsif ($form->submitted eq 'Mail Password') {
  218. my $user_name=$form->field("name");
  219. my $template=template("passwordmail.tmpl");
  220. $template->param(
  221. user_name => $user_name,
  222. user_password => userinfo_get($user_name, "password"),
  223. wikiurl => $config{url},
  224. wikiname => $config{wikiname},
  225. REMOTE_ADDR => $ENV{REMOTE_ADDR},
  226. );
  227. eval q{use Mail::Sendmail};
  228. sendmail(
  229. To => userinfo_get($user_name, "email"),
  230. From => "$config{wikiname} admin <$config{adminemail}>",
  231. Subject => "$config{wikiname} information",
  232. Message => $template->output,
  233. ) or error("Failed to send mail");
  234. $form->text("Your password has been emailed to you.");
  235. $form->field(name => "name", required => 0);
  236. printheader($session);
  237. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  238. }
  239. }
  240. else {
  241. printheader($session);
  242. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  243. }
  244. } #}}}
  245. sub cgi_prefs ($$) { #{{{
  246. my $q=shift;
  247. my $session=shift;
  248. eval q{use CGI::FormBuilder};
  249. my $form = CGI::FormBuilder->new(
  250. title => "preferences",
  251. fields => [qw(do name password confirm_password email
  252. subscriptions locked_pages)],
  253. header => 0,
  254. charset => "utf-8",
  255. method => 'POST',
  256. validate => {
  257. confirm_password => {
  258. perl => q{eq $form->field("password")},
  259. },
  260. email => 'EMAIL',
  261. },
  262. required => 'NONE',
  263. javascript => 0,
  264. params => $q,
  265. action => $config{cgiurl},
  266. template => (-e "$config{templatedir}/prefs.tmpl" ?
  267. {template_params("prefs.tmpl")} : ""),
  268. stylesheet => baseurl()."style.css",
  269. );
  270. my @buttons=("Save Preferences", "Logout", "Cancel");
  271. my $user_name=$session->param("name");
  272. $form->field(name => "do", type => "hidden");
  273. $form->field(name => "name", disabled => 1,
  274. value => $user_name, force => 1);
  275. $form->field(name => "password", type => "password");
  276. $form->field(name => "confirm_password", type => "password");
  277. $form->field(name => "subscriptions", size => 50,
  278. comment => "(".htmllink("", "", "PageSpec", 1).")");
  279. $form->field(name => "locked_pages", size => 50,
  280. comment => "(".htmllink("", "", "PageSpec", 1).")");
  281. if (! is_admin($user_name)) {
  282. $form->field(name => "locked_pages", type => "hidden");
  283. }
  284. if (! $form->submitted) {
  285. $form->field(name => "email", force => 1,
  286. value => userinfo_get($user_name, "email"));
  287. $form->field(name => "subscriptions", force => 1,
  288. value => userinfo_get($user_name, "subscriptions"));
  289. $form->field(name => "locked_pages", force => 1,
  290. value => userinfo_get($user_name, "locked_pages"));
  291. }
  292. decode_form_utf8($form);
  293. if ($form->submitted eq 'Logout') {
  294. $session->delete();
  295. redirect($q, $config{url});
  296. return;
  297. }
  298. elsif ($form->submitted eq 'Cancel') {
  299. redirect($q, $config{url});
  300. return;
  301. }
  302. elsif ($form->submitted eq "Save Preferences" && $form->validate) {
  303. foreach my $field (qw(password email subscriptions locked_pages)) {
  304. if (length $form->field($field)) {
  305. userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field");
  306. }
  307. }
  308. $form->text("Preferences saved.");
  309. }
  310. printheader($session);
  311. print misctemplate($form->title, $form->render(submit => \@buttons));
  312. } #}}}
  313. sub cgi_editpage ($$) { #{{{
  314. my $q=shift;
  315. my $session=shift;
  316. eval q{use CGI::FormBuilder};
  317. my $form = CGI::FormBuilder->new(
  318. fields => [qw(do rcsinfo subpage from page type editcontent comments)],
  319. header => 1,
  320. charset => "utf-8",
  321. method => 'POST',
  322. validate => {
  323. editcontent => '/.+/',
  324. },
  325. required => [qw{editcontent}],
  326. javascript => 0,
  327. params => $q,
  328. action => $config{cgiurl},
  329. table => 0,
  330. template => {template_params("editpage.tmpl")},
  331. );
  332. my @buttons=("Save Page", "Preview", "Cancel");
  333. decode_form_utf8($form);
  334. # This untaint is safe because titlepage removes any problematic
  335. # characters.
  336. my ($page)=$form->field('page');
  337. $page=titlepage(possibly_foolish_untaint($page));
  338. if (! defined $page || ! length $page ||
  339. $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) {
  340. error("bad page name");
  341. }
  342. my $from;
  343. if (defined $form->field('from')) {
  344. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  345. }
  346. my $file;
  347. my $type;
  348. if (exists $pagesources{$page}) {
  349. $file=$pagesources{$page};
  350. $type=pagetype($file);
  351. }
  352. else {
  353. $type=$form->param('type');
  354. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  355. $type=possibly_foolish_untaint($type);
  356. }
  357. elsif (defined $from) {
  358. # favor the type of linking page
  359. $type=pagetype($pagesources{$from});
  360. }
  361. $type=$config{default_pageext} unless defined $type;
  362. $file=$page.".".$type;
  363. }
  364. my $newfile=0;
  365. if (! -e "$config{srcdir}/$file") {
  366. $newfile=1;
  367. }
  368. $form->field(name => "do", type => 'hidden');
  369. $form->field(name => "from", type => 'hidden');
  370. $form->field(name => "rcsinfo", type => 'hidden');
  371. $form->field(name => "subpage", type => 'hidden');
  372. $form->field(name => "page", value => $page, force => 1);
  373. $form->field(name => "type", value => $type, force => 1);
  374. $form->field(name => "comments", type => "text", size => 80);
  375. $form->field(name => "editcontent", type => "textarea", rows => 20,
  376. cols => 80);
  377. $form->tmpl_param("can_commit", $config{rcs});
  378. $form->tmpl_param("indexlink", indexlink());
  379. $form->tmpl_param("helponformattinglink",
  380. htmllink("", "", "HelpOnFormatting", 1));
  381. $form->tmpl_param("baseurl", baseurl());
  382. if (! $form->submitted) {
  383. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  384. force => 1);
  385. }
  386. if ($form->submitted eq "Cancel") {
  387. redirect($q, "$config{url}/".htmlpage($page));
  388. return;
  389. }
  390. elsif ($form->submitted eq "Preview") {
  391. my $content=$form->field('editcontent');
  392. my $comments=$form->field('comments');
  393. $form->field(name => "editcontent",
  394. value => $content, force => 1);
  395. $form->field(name => "comments",
  396. value => $comments, force => 1);
  397. $config{rss}=0; # avoid preview writing an rss feed!
  398. $form->tmpl_param("page_preview",
  399. htmlize($page, $type,
  400. linkify($page, "",
  401. preprocess($page, $page,
  402. filter($page, $content)))));
  403. }
  404. else {
  405. $form->tmpl_param("page_preview", "");
  406. }
  407. $form->tmpl_param("page_conflict", "");
  408. if (! $form->submitted || $form->submitted eq "Preview" ||
  409. ! $form->validate) {
  410. if ($form->field("do") eq "create") {
  411. my @page_locs;
  412. my $best_loc;
  413. if (! defined $from || ! length $from ||
  414. $from ne $form->field('from') ||
  415. $from=~/$config{wiki_file_prune_regexp}/ ||
  416. $from=~/^\// ||
  417. $form->submitted eq "Preview") {
  418. @page_locs=$best_loc=$page;
  419. }
  420. else {
  421. my $dir=$from."/";
  422. $dir=~s![^/]+/+$!!;
  423. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  424. $page eq 'discussion') {
  425. $best_loc="$from/$page";
  426. }
  427. else {
  428. $best_loc=$dir.$page;
  429. }
  430. push @page_locs, $dir.$page;
  431. push @page_locs, "$from/$page";
  432. while (length $dir) {
  433. $dir=~s![^/]+/+$!!;
  434. push @page_locs, $dir.$page;
  435. }
  436. }
  437. @page_locs = grep {
  438. ! exists $pagecase{lc $_} &&
  439. ! page_locked($_, $session, 1)
  440. } @page_locs;
  441. if (! @page_locs) {
  442. # hmm, someone else made the page in the
  443. # meantime?
  444. redirect($q, "$config{url}/".htmlpage($page));
  445. return;
  446. }
  447. my @page_types;
  448. if (exists $hooks{htmlize}) {
  449. @page_types=keys %{$hooks{htmlize}};
  450. }
  451. $form->tmpl_param("page_select", 1);
  452. $form->field(name => "page", type => 'select',
  453. options => \@page_locs, value => $best_loc);
  454. $form->field(name => "type", type => 'select',
  455. options => \@page_types);
  456. $form->title("creating ".pagetitle($page));
  457. }
  458. elsif ($form->field("do") eq "edit") {
  459. page_locked($page, $session);
  460. if (! defined $form->field('editcontent') ||
  461. ! length $form->field('editcontent')) {
  462. my $content="";
  463. if (exists $pagesources{$page}) {
  464. $content=readfile(srcfile($pagesources{$page}));
  465. $content=~s/\n/\r\n/g;
  466. }
  467. $form->field(name => "editcontent", value => $content,
  468. force => 1);
  469. }
  470. $form->tmpl_param("page_select", 0);
  471. $form->field(name => "page", type => 'hidden');
  472. $form->field(name => "type", type => 'hidden');
  473. $form->title("editing ".pagetitle($page));
  474. }
  475. print $form->render(submit => \@buttons);
  476. }
  477. else {
  478. # save page
  479. page_locked($page, $session);
  480. my $content=$form->field('editcontent');
  481. $content=~s/\r\n/\n/g;
  482. $content=~s/\r/\n/g;
  483. writefile($file, $config{srcdir}, $content);
  484. my $message="web commit ";
  485. if (defined $session->param("name") &&
  486. length $session->param("name")) {
  487. $message.="by ".$session->param("name");
  488. }
  489. else {
  490. $message.="from $ENV{REMOTE_ADDR}";
  491. }
  492. if (defined $form->field('comments') &&
  493. length $form->field('comments')) {
  494. $message.=": ".$form->field('comments');
  495. }
  496. if ($config{rcs}) {
  497. if ($newfile) {
  498. rcs_add($file);
  499. }
  500. # prevent deadlock with post-commit hook
  501. unlockwiki();
  502. # presumably the commit will trigger an update
  503. # of the wiki
  504. my $conflict=rcs_commit($file, $message,
  505. $form->field("rcsinfo"));
  506. if (defined $conflict) {
  507. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  508. force => 1);
  509. $form->tmpl_param("page_conflict", 1);
  510. $form->field("editcontent", value => $conflict, force => 1);
  511. $form->field(name => "comments", value => $form->field('comments'), force => 1);
  512. $form->field("do", "edit)");
  513. $form->tmpl_param("page_select", 0);
  514. $form->field(name => "page", type => 'hidden');
  515. $form->field(name => "type", type => 'hidden');
  516. $form->title("editing $page");
  517. print $form->render(submit => \@buttons);
  518. return;
  519. }
  520. }
  521. else {
  522. require IkiWiki::Render;
  523. refresh();
  524. saveindex();
  525. }
  526. # The trailing question mark tries to avoid broken
  527. # caches and get the most recent version of the page.
  528. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  529. }
  530. } #}}}
  531. sub cgi () { #{{{
  532. eval q{use CGI};
  533. eval q{use CGI::Session};
  534. my $q=CGI->new;
  535. run_hooks(cgi => sub { shift->($q) });
  536. my $do=$q->param('do');
  537. if (! defined $do || ! length $do) {
  538. my $error = $q->cgi_error;
  539. if ($error) {
  540. error("Request not processed: $error");
  541. }
  542. else {
  543. error("\"do\" parameter missing");
  544. }
  545. }
  546. # Things that do not need a session.
  547. if ($do eq 'recentchanges') {
  548. cgi_recentchanges($q);
  549. return;
  550. }
  551. elsif ($do eq 'hyperestraier') {
  552. cgi_hyperestraier();
  553. }
  554. CGI::Session->name("ikiwiki_session_$config{wikiname}");
  555. my $oldmask=umask(077);
  556. my $session = CGI::Session->new("driver:DB_File", $q,
  557. { FileName => "$config{wikistatedir}/sessions.db" });
  558. umask($oldmask);
  559. # Everything below this point needs the user to be signed in.
  560. if (((! $config{anonok} || $do eq 'prefs') &&
  561. (! defined $session->param("name") ||
  562. ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
  563. cgi_signin($q, $session);
  564. # Force session flush with safe umask.
  565. my $oldmask=umask(077);
  566. $session->flush;
  567. umask($oldmask);
  568. return;
  569. }
  570. if ($do eq 'create' || $do eq 'edit') {
  571. cgi_editpage($q, $session);
  572. }
  573. elsif ($do eq 'prefs') {
  574. cgi_prefs($q, $session);
  575. }
  576. elsif ($do eq 'blog') {
  577. my $page=titlepage(decode_utf8($q->param('title')));
  578. # if the page already exists, munge it to be unique
  579. my $from=$q->param('from');
  580. my $add="";
  581. while (exists $pagecase{lc "$from/$page$add"}) {
  582. $add=1 unless length $add;
  583. $add++;
  584. }
  585. $q->param('page', $page.$add);
  586. # now run same as create
  587. $q->param('do', 'create');
  588. cgi_editpage($q, $session);
  589. }
  590. else {
  591. error("unknown do parameter");
  592. }
  593. } #}}}
  594. 1