summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: cfb2c0b1d8e39447581d0fb16606c8ff3fac7243 (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub printheader ($) { #{{{
  10. my $session=shift;
  11. if ($config{sslcookie}) {
  12. print $session->header(-charset => 'utf-8',
  13. -cookie => $session->cookie(-secure => 1));
  14. } else {
  15. print $session->header(-charset => 'utf-8');
  16. }
  17. } #}}}
  18. sub showform ($$$$) { #{{{
  19. my $form=shift;
  20. my $buttons=shift;
  21. my $session=shift;
  22. my $cgi=shift;
  23. if (exists $hooks{formbuilder}) {
  24. run_hooks(formbuilder => sub {
  25. shift->(form => $form, cgi => $cgi, session => $session,
  26. buttons => $buttons);
  27. });
  28. }
  29. printheader($session);
  30. print misctemplate($form->title, $form->render(submit => $buttons));
  31. }
  32. sub redirect ($$) { #{{{
  33. my $q=shift;
  34. my $url=shift;
  35. if (! $config{w3mmode}) {
  36. print $q->redirect($url);
  37. }
  38. else {
  39. print "Content-type: text/plain\n";
  40. print "W3m-control: GOTO $url\n\n";
  41. }
  42. } #}}}
  43. sub check_canedit ($$$;$) { #{{{
  44. my $page=shift;
  45. my $q=shift;
  46. my $session=shift;
  47. my $nonfatal=shift;
  48. my $canedit;
  49. run_hooks(canedit => sub {
  50. return if defined $canedit;
  51. my $ret=shift->($page, $q, $session);
  52. if (defined $ret) {
  53. if ($ret eq "") {
  54. $canedit=1;
  55. }
  56. elsif (ref $ret eq 'CODE') {
  57. $ret->() unless $nonfatal;
  58. $canedit=0;
  59. }
  60. elsif (defined $ret) {
  61. error($ret) unless $nonfatal;
  62. $canedit=0;
  63. }
  64. }
  65. });
  66. return $canedit;
  67. } #}}}
  68. sub decode_cgi_utf8 ($) { #{{{
  69. my $cgi = shift;
  70. foreach my $f ($cgi->param) {
  71. $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
  72. }
  73. } #}}}
  74. # Check if the user is signed in. If not, redirect to the signin form and
  75. # save their place to return to later.
  76. sub needsignin ($$) { #{{{
  77. my $q=shift;
  78. my $session=shift;
  79. if (! defined $session->param("name") ||
  80. ! userinfo_get($session->param("name"), "regdate")) {
  81. $session->param(postsignin => $ENV{QUERY_STRING});
  82. cgi_signin($q, $session);
  83. cgi_savesession($session);
  84. exit;
  85. }
  86. } #}}}
  87. sub cgi_signin ($$) { #{{{
  88. my $q=shift;
  89. my $session=shift;
  90. decode_cgi_utf8($q);
  91. eval q{use CGI::FormBuilder};
  92. error($@) if $@;
  93. my $form = CGI::FormBuilder->new(
  94. title => "signin",
  95. name => "signin",
  96. charset => "utf-8",
  97. method => 'POST',
  98. required => 'NONE',
  99. javascript => 0,
  100. params => $q,
  101. action => $config{cgiurl},
  102. header => 0,
  103. template => {type => 'div'},
  104. stylesheet => baseurl()."style.css",
  105. );
  106. my $buttons=["Login"];
  107. if ($q->param("do") ne "signin" && !$form->submitted) {
  108. $form->text(gettext("You need to log in first."));
  109. }
  110. $form->field(name => "do", type => "hidden", value => "signin",
  111. force => 1);
  112. run_hooks(formbuilder_setup => sub {
  113. shift->(form => $form, cgi => $q, session => $session,
  114. buttons => $buttons);
  115. });
  116. if ($form->submitted) {
  117. $form->validate;
  118. }
  119. showform($form, $buttons, $session, $q);
  120. } #}}}
  121. sub cgi_postsignin ($$) { #{{{
  122. my $q=shift;
  123. my $session=shift;
  124. # Continue with whatever was being done before the signin process.
  125. if (defined $session->param("postsignin")) {
  126. my $postsignin=CGI->new($session->param("postsignin"));
  127. $session->clear("postsignin");
  128. cgi($postsignin, $session);
  129. cgi_savesession($session);
  130. exit;
  131. }
  132. else {
  133. error(gettext("login failed, perhaps you need to turn on cookies?"));
  134. }
  135. } #}}}
  136. sub cgi_prefs ($$) { #{{{
  137. my $q=shift;
  138. my $session=shift;
  139. needsignin($q, $session);
  140. decode_cgi_utf8($q);
  141. eval q{use CGI::FormBuilder};
  142. error($@) if $@;
  143. my $form = CGI::FormBuilder->new(
  144. title => "preferences",
  145. name => "preferences",
  146. header => 0,
  147. charset => "utf-8",
  148. method => 'POST',
  149. validate => {
  150. email => 'EMAIL',
  151. },
  152. required => 'NONE',
  153. javascript => 0,
  154. params => $q,
  155. action => $config{cgiurl},
  156. template => {type => 'div'},
  157. stylesheet => baseurl()."style.css",
  158. fieldsets => [
  159. [login => gettext("Login")],
  160. [preferences => gettext("Preferences")],
  161. [admin => gettext("Admin")]
  162. ],
  163. );
  164. my $buttons=["Save Preferences", "Logout", "Cancel"];
  165. run_hooks(formbuilder_setup => sub {
  166. shift->(form => $form, cgi => $q, session => $session,
  167. buttons => $buttons);
  168. });
  169. $form->field(name => "do", type => "hidden");
  170. $form->field(name => "email", size => 50, fieldset => "preferences");
  171. $form->field(name => "banned_users", size => 50,
  172. fieldset => "admin");
  173. my $user_name=$session->param("name");
  174. if (! is_admin($user_name)) {
  175. $form->field(name => "banned_users", type => "hidden");
  176. }
  177. if (! $form->submitted) {
  178. $form->field(name => "email", force => 1,
  179. value => userinfo_get($user_name, "email"));
  180. if (is_admin($user_name)) {
  181. $form->field(name => "banned_users", force => 1,
  182. value => join(" ", get_banned_users()));
  183. }
  184. }
  185. if ($form->submitted eq 'Logout') {
  186. $session->delete();
  187. redirect($q, $config{url});
  188. return;
  189. }
  190. elsif ($form->submitted eq 'Cancel') {
  191. redirect($q, $config{url});
  192. return;
  193. }
  194. elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
  195. if (defined $form->field('email')) {
  196. userinfo_set($user_name, 'email', $form->field('email')) ||
  197. error("failed to set email");
  198. }
  199. if (is_admin($user_name)) {
  200. set_banned_users(grep { ! is_admin($_) }
  201. split(' ',
  202. $form->field("banned_users"))) ||
  203. error("failed saving changes");
  204. }
  205. $form->text(gettext("Preferences saved."));
  206. }
  207. showform($form, $buttons, $session, $q);
  208. } #}}}
  209. sub cgi_editpage ($$) { #{{{
  210. my $q=shift;
  211. my $session=shift;
  212. my @fields=qw(do rcsinfo subpage from page type editcontent comments);
  213. my @buttons=("Save Page", "Preview", "Cancel");
  214. decode_cgi_utf8($q);
  215. eval q{use CGI::FormBuilder};
  216. error($@) if $@;
  217. my $form = CGI::FormBuilder->new(
  218. title => "editpage",
  219. fields => \@fields,
  220. charset => "utf-8",
  221. method => 'POST',
  222. required => [qw{editcontent}],
  223. javascript => 0,
  224. params => $q,
  225. action => $config{cgiurl},
  226. header => 0,
  227. table => 0,
  228. template => scalar template_params("editpage.tmpl"),
  229. wikiname => $config{wikiname},
  230. );
  231. run_hooks(formbuilder_setup => sub {
  232. shift->(form => $form, cgi => $q, session => $session,
  233. buttons => \@buttons);
  234. });
  235. # This untaint is safe because titlepage removes any problematic
  236. # characters.
  237. my ($page)=$form->field('page');
  238. $page=titlepage(possibly_foolish_untaint($page));
  239. if (! defined $page || ! length $page ||
  240. file_pruned($page, $config{srcdir}) || $page=~/^\//) {
  241. error("bad page name");
  242. }
  243. my $from;
  244. if (defined $form->field('from')) {
  245. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  246. }
  247. my $file;
  248. my $type;
  249. if (exists $pagesources{$page} && $form->field("do") ne "create") {
  250. $file=$pagesources{$page};
  251. $type=pagetype($file);
  252. if (! defined $type || $type=~/^_/) {
  253. error(sprintf(gettext("%s is not an editable page"), $page));
  254. }
  255. if (! $form->submitted) {
  256. $form->field(name => "rcsinfo",
  257. value => rcs_prepedit($file), force => 1);
  258. }
  259. $form->field(name => "editcontent", validate => '/.*/');
  260. }
  261. else {
  262. $type=$form->param('type');
  263. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  264. $type=possibly_foolish_untaint($type);
  265. }
  266. elsif (defined $from && exists $pagesources{$from}) {
  267. # favor the type of linking page
  268. $type=pagetype($pagesources{$from});
  269. }
  270. $type=$config{default_pageext} unless defined $type;
  271. $file=$page.".".$type;
  272. if (! $form->submitted) {
  273. $form->field(name => "rcsinfo", value => "", force => 1);
  274. }
  275. $form->field(name => "editcontent", validate => '/.+/');
  276. }
  277. $form->field(name => "do", type => 'hidden');
  278. $form->field(name => "from", type => 'hidden');
  279. $form->field(name => "rcsinfo", type => 'hidden');
  280. $form->field(name => "subpage", type => 'hidden');
  281. $form->field(name => "page", value => pagetitle($page, 1), force => 1);
  282. $form->field(name => "type", value => $type, force => 1);
  283. $form->field(name => "comments", type => "text", size => 80);
  284. $form->field(name => "editcontent", type => "textarea", rows => 20,
  285. cols => 80);
  286. $form->tmpl_param("can_commit", $config{rcs});
  287. $form->tmpl_param("indexlink", indexlink());
  288. $form->tmpl_param("helponformattinglink",
  289. htmllink("", "", "ikiwiki/formatting",
  290. noimageinline => 1,
  291. linktext => "FormattingHelp"));
  292. $form->tmpl_param("baseurl", baseurl());
  293. if ($form->submitted eq "Cancel") {
  294. if ($form->field("do") eq "create" && defined $from) {
  295. redirect($q, "$config{url}/".htmlpage($from));
  296. }
  297. elsif ($form->field("do") eq "create") {
  298. redirect($q, $config{url});
  299. }
  300. else {
  301. redirect($q, "$config{url}/".htmlpage($page));
  302. }
  303. return;
  304. }
  305. elsif ($form->submitted eq "Preview") {
  306. my $content=$form->field('editcontent');
  307. run_hooks(editcontent => sub {
  308. $content=shift->(
  309. content => $content,
  310. page => $page,
  311. cgi => $q,
  312. session => $session,
  313. );
  314. });
  315. $form->tmpl_param("page_preview",
  316. htmlize($page, $type,
  317. linkify($page, "",
  318. preprocess($page, $page,
  319. filter($page, $page, $content), 0, 1))));
  320. # previewing may have created files on disk
  321. saveindex();
  322. }
  323. elsif ($form->submitted eq "Save Page") {
  324. $form->tmpl_param("page_preview", "");
  325. }
  326. $form->tmpl_param("page_conflict", "");
  327. if ($form->submitted ne "Save Page" || ! $form->validate) {
  328. if ($form->field("do") eq "create") {
  329. my @page_locs;
  330. my $best_loc;
  331. if (! defined $from || ! length $from ||
  332. $from ne $form->field('from') ||
  333. file_pruned($from, $config{srcdir}) ||
  334. $from=~/^\// ||
  335. $form->submitted eq "Preview") {
  336. @page_locs=$best_loc=$page;
  337. }
  338. else {
  339. my $dir=$from."/";
  340. $dir=~s![^/]+/+$!!;
  341. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  342. $page eq gettext('discussion')) {
  343. $best_loc="$from/$page";
  344. }
  345. else {
  346. $best_loc=$dir.$page;
  347. }
  348. push @page_locs, $dir.$page;
  349. push @page_locs, "$from/$page";
  350. while (length $dir) {
  351. $dir=~s![^/]+/+$!!;
  352. push @page_locs, $dir.$page;
  353. }
  354. push @page_locs, "$config{userdir}/$page"
  355. if length $config{userdir};
  356. }
  357. @page_locs = grep {
  358. ! exists $pagecase{lc $_}
  359. } @page_locs;
  360. if (! @page_locs) {
  361. # hmm, someone else made the page in the
  362. # meantime?
  363. if ($form->submitted eq "Preview") {
  364. # let them go ahead with the edit
  365. # and resolve the conflict at save
  366. # time
  367. @page_locs=$page;
  368. }
  369. else {
  370. redirect($q, "$config{url}/".htmlpage($page));
  371. return;
  372. }
  373. }
  374. my @editable_locs = grep {
  375. check_canedit($_, $q, $session, 1)
  376. } @page_locs;
  377. if (! @editable_locs) {
  378. # let it throw an error this time
  379. map { check_canedit($_, $q, $session) } @page_locs;
  380. }
  381. my @page_types;
  382. if (exists $hooks{htmlize}) {
  383. @page_types=grep { !/^_/ }
  384. keys %{$hooks{htmlize}};
  385. }
  386. $form->tmpl_param("page_select", 1);
  387. $form->field(name => "page", type => 'select',
  388. options => [ map { pagetitle($_, 1) } @editable_locs ],
  389. value => pagetitle($best_loc, 1));
  390. $form->field(name => "type", type => 'select',
  391. options => \@page_types);
  392. $form->title(sprintf(gettext("creating %s"), pagetitle($page)));
  393. }
  394. elsif ($form->field("do") eq "edit") {
  395. check_canedit($page, $q, $session);
  396. if (! defined $form->field('editcontent') ||
  397. ! length $form->field('editcontent')) {
  398. my $content="";
  399. if (exists $pagesources{$page}) {
  400. $content=readfile(srcfile($pagesources{$page}));
  401. $content=~s/\n/\r\n/g;
  402. }
  403. $form->field(name => "editcontent", value => $content,
  404. force => 1);
  405. }
  406. $form->tmpl_param("page_select", 0);
  407. $form->field(name => "page", type => 'hidden');
  408. $form->field(name => "type", type => 'hidden');
  409. $form->title(sprintf(gettext("editing %s"), pagetitle($page)));
  410. }
  411. showform($form, \@buttons, $session, $q);
  412. }
  413. else {
  414. # save page
  415. check_canedit($page, $q, $session);
  416. my $exists=-e "$config{srcdir}/$file";
  417. if ($form->field("do") ne "create" && ! $exists &&
  418. ! eval { srcfile($file) }) {
  419. $form->tmpl_param("page_gone", 1);
  420. $form->field(name => "do", value => "create", force => 1);
  421. $form->tmpl_param("page_select", 0);
  422. $form->field(name => "page", type => 'hidden');
  423. $form->field(name => "type", type => 'hidden');
  424. $form->title(sprintf(gettext("editing %s"), $page));
  425. showform($form, \@buttons, $session, $q);
  426. return;
  427. }
  428. elsif ($form->field("do") eq "create" && $exists) {
  429. $form->tmpl_param("creation_conflict", 1);
  430. $form->field(name => "do", value => "edit", force => 1);
  431. $form->tmpl_param("page_select", 0);
  432. $form->field(name => "page", type => 'hidden');
  433. $form->field(name => "type", type => 'hidden');
  434. $form->title(sprintf(gettext("editing %s"), $page));
  435. $form->field("editcontent",
  436. value => readfile("$config{srcdir}/$file").
  437. "\n\n\n".$form->field("editcontent"),
  438. force => 1);
  439. showform($form, \@buttons, $session, $q);
  440. return;
  441. }
  442. my $content=$form->field('editcontent');
  443. run_hooks(editcontent => sub {
  444. $content=shift->(
  445. content => $content,
  446. page => $page,
  447. cgi => $q,
  448. session => $session,
  449. );
  450. });
  451. $content=~s/\r\n/\n/g;
  452. $content=~s/\r/\n/g;
  453. $content.="\n" if $content !~ /\n$/;
  454. $config{cgi}=0; # avoid cgi error message
  455. eval { writefile($file, $config{srcdir}, $content) };
  456. $config{cgi}=1;
  457. if ($@) {
  458. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  459. force => 1);
  460. $form->tmpl_param("failed_save", 1);
  461. $form->tmpl_param("error_message", $@);
  462. $form->field("editcontent", value => $content, force => 1);
  463. $form->tmpl_param("page_select", 0);
  464. $form->field(name => "page", type => 'hidden');
  465. $form->field(name => "type", type => 'hidden');
  466. $form->title(sprintf(gettext("editing %s"), $page));
  467. showform($form, \@buttons, $session, $q);
  468. return;
  469. }
  470. my $conflict;
  471. if ($config{rcs}) {
  472. my $message="";
  473. if (defined $form->field('comments') &&
  474. length $form->field('comments')) {
  475. $message=$form->field('comments');
  476. }
  477. if (! $exists) {
  478. rcs_add($file);
  479. }
  480. # Prevent deadlock with post-commit hook by
  481. # signaling to it that it should not try to
  482. # do anything.
  483. disable_commit_hook();
  484. $conflict=rcs_commit($file, $message,
  485. $form->field("rcsinfo"),
  486. $session->param("name"), $ENV{REMOTE_ADDR});
  487. enable_commit_hook();
  488. rcs_update();
  489. }
  490. # Refresh even if there was a conflict, since other changes
  491. # may have been committed while the post-commit hook was
  492. # disabled.
  493. require IkiWiki::Render;
  494. refresh();
  495. saveindex();
  496. if (defined $conflict) {
  497. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  498. force => 1);
  499. $form->tmpl_param("page_conflict", 1);
  500. $form->field("editcontent", value => $conflict, force => 1);
  501. $form->field("do", "edit", force => 1);
  502. $form->tmpl_param("page_select", 0);
  503. $form->field(name => "page", type => 'hidden');
  504. $form->field(name => "type", type => 'hidden');
  505. $form->title(sprintf(gettext("editing %s"), $page));
  506. showform($form, \@buttons, $session, $q);
  507. return;
  508. }
  509. else {
  510. # The trailing question mark tries to avoid broken
  511. # caches and get the most recent version of the page.
  512. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  513. }
  514. }
  515. } #}}}
  516. sub cgi_getsession ($) { #{{{
  517. my $q=shift;
  518. eval q{use CGI::Session};
  519. CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname}));
  520. my $oldmask=umask(077);
  521. my $session = CGI::Session->new("driver:DB_File", $q,
  522. { FileName => "$config{wikistatedir}/sessions.db" });
  523. umask($oldmask);
  524. return $session;
  525. } #}}}
  526. sub cgi_savesession ($) { #{{{
  527. my $session=shift;
  528. # Force session flush with safe umask.
  529. my $oldmask=umask(077);
  530. $session->flush;
  531. umask($oldmask);
  532. } #}}}
  533. sub cgi (;$$) { #{{{
  534. my $q=shift;
  535. my $session=shift;
  536. if (! $q) {
  537. eval q{use CGI};
  538. error($@) if $@;
  539. $q=CGI->new;
  540. run_hooks(cgi => sub { shift->($q) });
  541. }
  542. my $do=$q->param('do');
  543. if (! defined $do || ! length $do) {
  544. my $error = $q->cgi_error;
  545. if ($error) {
  546. error("Request not processed: $error");
  547. }
  548. else {
  549. error("\"do\" parameter missing");
  550. }
  551. }
  552. # Need to lock the wiki before getting a session.
  553. lockwiki();
  554. loadindex();
  555. if (! $session) {
  556. $session=cgi_getsession($q);
  557. }
  558. # Auth hooks can sign a user in.
  559. if ($do ne 'signin' && ! defined $session->param("name")) {
  560. run_hooks(auth => sub {
  561. shift->($q, $session)
  562. });
  563. if (defined $session->param("name")) {
  564. # Make sure whatever user was authed is in the
  565. # userinfo db.
  566. if (! userinfo_get($session->param("name"), "regdate")) {
  567. userinfo_setall($session->param("name"), {
  568. email => "",
  569. password => "",
  570. regdate => time,
  571. }) || error("failed adding user");
  572. }
  573. }
  574. }
  575. if (defined $session->param("name") &&
  576. userinfo_get($session->param("name"), "banned")) {
  577. print $q->header(-status => "403 Forbidden");
  578. $session->delete();
  579. print gettext("You are banned.");
  580. cgi_savesession($session);
  581. }
  582. run_hooks(sessioncgi => sub { shift->($q, $session) });
  583. if ($do eq 'signin') {
  584. cgi_signin($q, $session);
  585. cgi_savesession($session);
  586. }
  587. elsif ($do eq 'prefs') {
  588. cgi_prefs($q, $session);
  589. }
  590. elsif ($do eq 'create' || $do eq 'edit') {
  591. cgi_editpage($q, $session);
  592. }
  593. elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
  594. cgi_postsignin($q, $session);
  595. }
  596. else {
  597. error("unknown do parameter");
  598. }
  599. } #}}}
  600. 1