summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 36d0e60082896e81fb8a16908edc208f74362869 (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki::UserInfo;
  5. package IkiWiki;
  6. sub page_locked ($$;$) { #{{{
  7. my $page=shift;
  8. my $session=shift;
  9. my $nonfatal=shift;
  10. my $user=$session->param("name");
  11. return if length $user && is_admin($user);
  12. foreach my $admin (@{$config{adminuser}}) {
  13. my $locked_pages=userinfo_get($admin, "locked_pages");
  14. if (globlist_match($page, userinfo_get($admin, "locked_pages"))) {
  15. return 1 if $nonfatal;
  16. error(htmllink("", $page, 1)." is locked by ".
  17. htmllink("", $admin, 1)." and cannot be edited.");
  18. }
  19. }
  20. return 0;
  21. } #}}}
  22. sub cgi_recentchanges ($) { #{{{
  23. my $q=shift;
  24. unlockwiki();
  25. my $template=HTML::Template->new(
  26. filename => "$config{templatedir}/recentchanges.tmpl"
  27. );
  28. $template->param(
  29. title => "RecentChanges",
  30. indexlink => indexlink(),
  31. wikiname => $config{wikiname},
  32. changelog => [rcs_recentchanges(100)],
  33. styleurl => styleurl(),
  34. baseurl => "$config{url}/",
  35. );
  36. print $q->header, $template->output;
  37. } #}}}
  38. sub cgi_signin ($$) { #{{{
  39. my $q=shift;
  40. my $session=shift;
  41. eval q{use CGI::FormBuilder};
  42. my $form = CGI::FormBuilder->new(
  43. title => "signin",
  44. fields => [qw(do title page subpage from name password confirm_password email)],
  45. header => 1,
  46. method => 'POST',
  47. validate => {
  48. confirm_password => {
  49. perl => q{eq $form->field("password")},
  50. },
  51. email => 'EMAIL',
  52. },
  53. required => 'NONE',
  54. javascript => 0,
  55. params => $q,
  56. action => $config{cgiurl},
  57. header => 0,
  58. template => (-e "$config{templatedir}/signin.tmpl" ?
  59. "$config{templatedir}/signin.tmpl" : ""),
  60. stylesheet => styleurl(),
  61. );
  62. $form->field(name => "name", required => 0);
  63. $form->field(name => "do", type => "hidden");
  64. $form->field(name => "page", type => "hidden");
  65. $form->field(name => "title", type => "hidden");
  66. $form->field(name => "from", type => "hidden");
  67. $form->field(name => "subpage", type => "hidden");
  68. $form->field(name => "password", type => "password", required => 0);
  69. $form->field(name => "confirm_password", type => "password", required => 0);
  70. $form->field(name => "email", required => 0);
  71. if ($q->param("do") ne "signin") {
  72. $form->text("You need to log in first.");
  73. }
  74. if ($form->submitted) {
  75. # Set required fields based on how form was submitted.
  76. my %required=(
  77. "Login" => [qw(name password)],
  78. "Register" => [qw(name password confirm_password email)],
  79. "Mail Password" => [qw(name)],
  80. );
  81. foreach my $opt (@{$required{$form->submitted}}) {
  82. $form->field(name => $opt, required => 1);
  83. }
  84. # Validate password differently depending on how
  85. # form was submitted.
  86. if ($form->submitted eq 'Login') {
  87. $form->field(
  88. name => "password",
  89. validate => sub {
  90. length $form->field("name") &&
  91. shift eq userinfo_get($form->field("name"), 'password');
  92. },
  93. );
  94. $form->field(name => "name", validate => '/^\w+$/');
  95. }
  96. else {
  97. $form->field(name => "password", validate => 'VALUE');
  98. }
  99. # And make sure the entered name exists when logging
  100. # in or sending email, and does not when registering.
  101. if ($form->submitted eq 'Register') {
  102. $form->field(
  103. name => "name",
  104. validate => sub {
  105. my $name=shift;
  106. length $name &&
  107. ! userinfo_get($name, "regdate");
  108. },
  109. );
  110. }
  111. else {
  112. $form->field(
  113. name => "name",
  114. validate => sub {
  115. my $name=shift;
  116. length $name &&
  117. userinfo_get($name, "regdate");
  118. },
  119. );
  120. }
  121. }
  122. else {
  123. # First time settings.
  124. $form->field(name => "name", comment => "use FirstnameLastName");
  125. $form->field(name => "confirm_password", comment => "(only needed");
  126. $form->field(name => "email", comment => "for registration)");
  127. if ($session->param("name")) {
  128. $form->field(name => "name", value => $session->param("name"));
  129. }
  130. }
  131. if ($form->submitted && $form->validate) {
  132. if ($form->submitted eq 'Login') {
  133. $session->param("name", $form->field("name"));
  134. if (defined $form->field("do") &&
  135. $form->field("do") ne 'signin') {
  136. print $q->redirect(cgiurl(
  137. do => $form->field("do"),
  138. page => $form->field("page"),
  139. title => $form->field("title"),
  140. subpage => $form->field("subpage"),
  141. from => $form->field("from"),
  142. ));
  143. }
  144. else {
  145. print $q->redirect($config{url});
  146. }
  147. }
  148. elsif ($form->submitted eq 'Register') {
  149. my $user_name=$form->field('name');
  150. if (userinfo_setall($user_name, {
  151. 'email' => $form->field('email'),
  152. 'password' => $form->field('password'),
  153. 'regdate' => time
  154. })) {
  155. $form->field(name => "confirm_password", type => "hidden");
  156. $form->field(name => "email", type => "hidden");
  157. $form->text("Registration successful. Now you can Login.");
  158. print $session->header();
  159. print misctemplate($form->title, $form->render(submit => ["Login"]));
  160. }
  161. else {
  162. error("Error saving registration.");
  163. }
  164. }
  165. elsif ($form->submitted eq 'Mail Password') {
  166. my $user_name=$form->field("name");
  167. my $template=HTML::Template->new(
  168. filename => "$config{templatedir}/passwordmail.tmpl"
  169. );
  170. $template->param(
  171. user_name => $user_name,
  172. user_password => userinfo_get($user_name, "password"),
  173. wikiurl => $config{url},
  174. wikiname => $config{wikiname},
  175. REMOTE_ADDR => $ENV{REMOTE_ADDR},
  176. );
  177. eval q{use Mail::Sendmail};
  178. sendmail(
  179. To => userinfo_get($user_name, "email"),
  180. From => "$config{wikiname} admin <$config{adminemail}>",
  181. Subject => "$config{wikiname} information",
  182. Message => $template->output,
  183. ) or error("Failed to send mail");
  184. $form->text("Your password has been emailed to you.");
  185. $form->field(name => "name", required => 0);
  186. print $session->header();
  187. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  188. }
  189. }
  190. else {
  191. print $session->header();
  192. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  193. }
  194. } #}}}
  195. sub cgi_prefs ($$) { #{{{
  196. my $q=shift;
  197. my $session=shift;
  198. eval q{use CGI::FormBuilder};
  199. my $form = CGI::FormBuilder->new(
  200. title => "preferences",
  201. fields => [qw(do name password confirm_password email
  202. subscriptions locked_pages)],
  203. header => 0,
  204. method => 'POST',
  205. validate => {
  206. confirm_password => {
  207. perl => q{eq $form->field("password")},
  208. },
  209. email => 'EMAIL',
  210. },
  211. required => 'NONE',
  212. javascript => 0,
  213. params => $q,
  214. action => $config{cgiurl},
  215. template => (-e "$config{templatedir}/prefs.tmpl" ?
  216. "$config{templatedir}/prefs.tmpl" : ""),
  217. stylesheet => styleurl(),
  218. );
  219. my @buttons=("Save Preferences", "Logout", "Cancel");
  220. my $user_name=$session->param("name");
  221. $form->field(name => "do", type => "hidden");
  222. $form->field(name => "name", disabled => 1,
  223. value => $user_name, force => 1);
  224. $form->field(name => "password", type => "password");
  225. $form->field(name => "confirm_password", type => "password");
  226. $form->field(name => "subscriptions", size => 50,
  227. comment => "(".htmllink("", "GlobList", 1).")");
  228. $form->field(name => "locked_pages", size => 50,
  229. comment => "(".htmllink("", "GlobList", 1).")");
  230. if (! is_admin($user_name)) {
  231. $form->field(name => "locked_pages", type => "hidden");
  232. }
  233. if (! $form->submitted) {
  234. $form->field(name => "email", force => 1,
  235. value => userinfo_get($user_name, "email"));
  236. $form->field(name => "subscriptions", force => 1,
  237. value => userinfo_get($user_name, "subscriptions"));
  238. $form->field(name => "locked_pages", force => 1,
  239. value => userinfo_get($user_name, "locked_pages"));
  240. }
  241. if ($form->submitted eq 'Logout') {
  242. $session->delete();
  243. print $q->redirect($config{url});
  244. return;
  245. }
  246. elsif ($form->submitted eq 'Cancel') {
  247. print $q->redirect($config{url});
  248. return;
  249. }
  250. elsif ($form->submitted eq "Save Preferences" && $form->validate) {
  251. foreach my $field (qw(password email subscriptions locked_pages)) {
  252. if (length $form->field($field)) {
  253. userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field");
  254. }
  255. }
  256. $form->text("Preferences saved.");
  257. }
  258. print $session->header();
  259. print misctemplate($form->title, $form->render(submit => \@buttons));
  260. } #}}}
  261. sub cgi_editpage ($$) { #{{{
  262. my $q=shift;
  263. my $session=shift;
  264. eval q{use CGI::FormBuilder};
  265. my $form = CGI::FormBuilder->new(
  266. fields => [qw(do rcsinfo subpage from page content comments)],
  267. header => 1,
  268. method => 'POST',
  269. validate => {
  270. content => '/.+/',
  271. },
  272. required => [qw{content}],
  273. javascript => 0,
  274. params => $q,
  275. action => $config{cgiurl},
  276. table => 0,
  277. template => "$config{templatedir}/editpage.tmpl"
  278. );
  279. my @buttons=("Save Page", "Preview", "Cancel");
  280. # This untaint is safe because titlepage removes any problimatic
  281. # characters.
  282. my ($page)=titlepage(possibly_foolish_untaint(lc($form->param('page'))));
  283. if (! defined $page || ! length $page ||
  284. $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) {
  285. error("bad page name");
  286. }
  287. $page=lc($page);
  288. my $file=$page.$config{default_pageext};
  289. if (exists $pagesources{lc($page)}) {
  290. $file=$pagesources{lc($page)};
  291. }
  292. my $newfile=0;
  293. if (! -e "$config{srcdir}/$file") {
  294. $newfile=1;
  295. }
  296. $form->field(name => "do", type => 'hidden');
  297. $form->field(name => "from", type => 'hidden');
  298. $form->field(name => "rcsinfo", type => 'hidden');
  299. $form->field(name => "subpage", type => 'hidden');
  300. $form->field(name => "page", value => "$page", force => 1);
  301. $form->field(name => "comments", type => "text", size => 80);
  302. $form->field(name => "content", type => "textarea", rows => 20,
  303. cols => 80);
  304. $form->tmpl_param("can_commit", $config{rcs});
  305. $form->tmpl_param("indexlink", indexlink());
  306. $form->tmpl_param("helponformattinglink",
  307. htmllink("", "HelpOnFormatting", 1));
  308. $form->tmpl_param("styleurl", styleurl());
  309. $form->tmpl_param("baseurl", "$config{url}/");
  310. if (! $form->submitted) {
  311. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  312. force => 1);
  313. }
  314. if ($form->submitted eq "Cancel") {
  315. print $q->redirect("$config{url}/".htmlpage($page));
  316. return;
  317. }
  318. elsif ($form->submitted eq "Preview") {
  319. require IkiWiki::Render;
  320. $form->tmpl_param("page_preview",
  321. htmlize($config{default_pageext},
  322. linkify($form->field('content'), $page)));
  323. }
  324. else {
  325. $form->tmpl_param("page_preview", "");
  326. }
  327. $form->tmpl_param("page_conflict", "");
  328. if (! $form->submitted || $form->submitted eq "Preview" ||
  329. ! $form->validate) {
  330. if ($form->field("do") eq "create") {
  331. if (exists $pagesources{lc($page)}) {
  332. # hmm, someone else made the page in the
  333. # meantime?
  334. print $q->redirect("$config{url}/".htmlpage($page));
  335. return;
  336. }
  337. my @page_locs;
  338. my $best_loc;
  339. my ($from)=$form->param('from')=~/$config{wiki_file_regexp}/;
  340. if (! defined $from || ! length $from ||
  341. $from ne $form->param('from') ||
  342. $from=~/$config{wiki_file_prune_regexp}/ ||
  343. $from=~/^\// ||
  344. $form->submitted eq "Preview") {
  345. @page_locs=$best_loc=$page;
  346. }
  347. else {
  348. my $dir=$from."/";
  349. $dir=~s![^/]+/+$!!;
  350. if ((defined $form->param('subpage') && length $form->param('subpage')) ||
  351. $page eq 'discussion') {
  352. $best_loc="$from/$page";
  353. }
  354. else {
  355. $best_loc=$dir.$page;
  356. }
  357. push @page_locs, $dir.$page;
  358. push @page_locs, "$from/$page";
  359. while (length $dir) {
  360. $dir=~s![^/]+/+$!!;
  361. push @page_locs, $dir.$page;
  362. }
  363. @page_locs = grep {
  364. ! exists $pagesources{lc($_)} &&
  365. ! page_locked($_, $session, 1)
  366. } @page_locs;
  367. }
  368. $form->tmpl_param("page_select", 1);
  369. $form->field(name => "page", type => 'select',
  370. options => \@page_locs, value => $best_loc);
  371. $form->title("creating ".pagetitle($page));
  372. }
  373. elsif ($form->field("do") eq "edit") {
  374. page_locked($page, $session);
  375. if (! defined $form->field('content') ||
  376. ! length $form->field('content')) {
  377. my $content="";
  378. if (exists $pagesources{lc($page)}) {
  379. $content=readfile(srcfile($pagesources{lc($page)}));
  380. $content=~s/\n/\r\n/g;
  381. }
  382. $form->field(name => "content", value => $content,
  383. force => 1);
  384. }
  385. $form->tmpl_param("page_select", 0);
  386. $form->field(name => "page", type => 'hidden');
  387. $form->title("editing ".pagetitle($page));
  388. }
  389. print $form->render(submit => \@buttons);
  390. }
  391. else {
  392. # save page
  393. page_locked($page, $session);
  394. my $content=$form->field('content');
  395. $content=~s/\r\n/\n/g;
  396. $content=~s/\r/\n/g;
  397. writefile($file, $config{srcdir}, $content);
  398. my $message="web commit ";
  399. if (length $session->param("name")) {
  400. $message.="by ".$session->param("name");
  401. }
  402. else {
  403. $message.="from $ENV{REMOTE_ADDR}";
  404. }
  405. if (defined $form->field('comments') &&
  406. length $form->field('comments')) {
  407. $message.=": ".$form->field('comments');
  408. }
  409. if ($config{rcs}) {
  410. if ($newfile) {
  411. rcs_add($file);
  412. }
  413. # prevent deadlock with post-commit hook
  414. unlockwiki();
  415. # presumably the commit will trigger an update
  416. # of the wiki
  417. my $conflict=rcs_commit($file, $message,
  418. $form->field("rcsinfo"));
  419. if (defined $conflict) {
  420. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  421. force => 1);
  422. $form->tmpl_param("page_conflict", 1);
  423. $form->field("content", value => $conflict, force => 1);
  424. $form->field("do", "edit)");
  425. $form->tmpl_param("page_select", 0);
  426. $form->field(name => "page", type => 'hidden');
  427. $form->title("editing $page");
  428. print $form->render(submit => \@buttons);
  429. return;
  430. }
  431. }
  432. else {
  433. require IkiWiki::Render;
  434. refresh();
  435. saveindex();
  436. }
  437. # The trailing question mark tries to avoid broken
  438. # caches and get the most recent version of the page.
  439. print $q->redirect("$config{url}/".htmlpage($page)."?updated");
  440. }
  441. } #}}}
  442. sub cgi_hyperestraier () { #{{{
  443. # only works for GET requests
  444. chdir("$config{wikistatedir}/hyperestraier") || error("chdir: $!");
  445. exec("./".basename($config{cgiurl})) || error("estseek.cgi failed");
  446. } #}}}
  447. sub cgi () { #{{{
  448. eval q{use CGI};
  449. eval q{use CGI::Session};
  450. my $q=CGI->new;
  451. my $do=$q->param('do');
  452. if (! defined $do || ! length $do) {
  453. if (defined $q->param('phrase')) {
  454. cgi_hyperestraier();
  455. }
  456. else {
  457. error("\"do\" parameter missing");
  458. }
  459. }
  460. # Things that do not need a session.
  461. if ($do eq 'recentchanges') {
  462. cgi_recentchanges($q);
  463. return;
  464. }
  465. elsif ($do eq 'hyperestraier') {
  466. cgi_hyperestraier();
  467. }
  468. CGI::Session->name("ikiwiki_session_$config{wikiname}");
  469. my $oldmask=umask(077);
  470. my $session = CGI::Session->new("driver:DB_File", $q,
  471. { FileName => "$config{wikistatedir}/sessions.db" });
  472. umask($oldmask);
  473. # Everything below this point needs the user to be signed in.
  474. if ((! $config{anonok} &&
  475. (! defined $session->param("name") ||
  476. ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
  477. cgi_signin($q, $session);
  478. # Force session flush with safe umask.
  479. my $oldmask=umask(077);
  480. $session->flush;
  481. umask($oldmask);
  482. return;
  483. }
  484. if ($do eq 'create' || $do eq 'edit') {
  485. cgi_editpage($q, $session);
  486. }
  487. elsif ($do eq 'prefs') {
  488. cgi_prefs($q, $session);
  489. }
  490. elsif ($do eq 'blog') {
  491. my $page=titlepage(lc($q->param('title')));
  492. # if the page already exists, munge it to be unique
  493. my $from=$q->param('from');
  494. my $add="";
  495. while (exists $oldpagemtime{"$from/$page$add"}) {
  496. $add=1 unless length $add;
  497. $add++;
  498. }
  499. $q->param('page', $page.$add);
  500. # now run same as create
  501. $q->param('do', 'create');
  502. cgi_editpage($q, $session);
  503. }
  504. else {
  505. error("unknown do parameter");
  506. }
  507. } #}}}
  508. 1