summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: b424892101fbf1fdba85ea6235b1c2f3b0a32de0 (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub printheader ($) { #{{{
  10. my $session=shift;
  11. if ($config{sslcookie}) {
  12. print $session->header(-charset => 'utf-8',
  13. -cookie => $session->cookie(-secure => 1));
  14. } else {
  15. print $session->header(-charset => 'utf-8');
  16. }
  17. } #}}}
  18. sub redirect ($$) { #{{{
  19. my $q=shift;
  20. my $url=shift;
  21. if (! $config{w3mmode}) {
  22. print $q->redirect($url);
  23. }
  24. else {
  25. print "Content-type: text/plain\n";
  26. print "W3m-control: GOTO $url\n\n";
  27. }
  28. } #}}}
  29. sub page_locked ($$;$) { #{{{
  30. my $page=shift;
  31. my $session=shift;
  32. my $nonfatal=shift;
  33. my $user=$session->param("name");
  34. return if defined $user && is_admin($user);
  35. foreach my $admin (@{$config{adminuser}}) {
  36. my $locked_pages=userinfo_get($admin, "locked_pages");
  37. if (pagespec_match($page, userinfo_get($admin, "locked_pages"))) {
  38. return 1 if $nonfatal;
  39. error(htmllink("", "", $page, 1)." is locked by ".
  40. htmllink("", "", $admin, 1)." and cannot be edited.");
  41. }
  42. }
  43. return 0;
  44. } #}}}
  45. sub decode_form_utf8 ($) { #{{{
  46. my $form = shift;
  47. foreach my $f ($form->field) {
  48. next if Encode::is_utf8(scalar $form->field($f));
  49. $form->field(name => $f,
  50. value => decode_utf8($form->field($f)),
  51. force => 1,
  52. );
  53. }
  54. } #}}}
  55. sub cgi_recentchanges ($) { #{{{
  56. my $q=shift;
  57. unlockwiki();
  58. # Optimisation: building recentchanges means calculating lots of
  59. # links. Memoizing htmllink speeds it up a lot (can't be memoized
  60. # during page builds as the return values may change, but they
  61. # won't here.)
  62. eval q{use Memoize};
  63. memoize("htmllink");
  64. eval q{use Time::Duration};
  65. eval q{use CGI 'escapeHTML'};
  66. my $changelog=[rcs_recentchanges(100)];
  67. foreach my $change (@$changelog) {
  68. $change->{when} = concise(ago($change->{when}));
  69. $change->{user} = htmllink("", "", escapeHTML($change->{user}), 1);
  70. $change->{pages} = [
  71. map {
  72. $_->{link} = htmllink("", "", $_->{page}, 1);
  73. $_;
  74. } @{$change->{pages}}
  75. ];
  76. }
  77. my $template=template("recentchanges.tmpl");
  78. $template->param(
  79. title => "RecentChanges",
  80. indexlink => indexlink(),
  81. wikiname => $config{wikiname},
  82. changelog => $changelog,
  83. baseurl => baseurl(),
  84. );
  85. run_hooks(pagetemplate => sub {
  86. shift->(page => "", destpage => "", template => $template);
  87. });
  88. print $q->header(-charset => 'utf-8'), $template->output;
  89. } #}}}
  90. sub cgi_signin ($$) { #{{{
  91. my $q=shift;
  92. my $session=shift;
  93. eval q{use CGI::FormBuilder};
  94. my $form = CGI::FormBuilder->new(
  95. title => "signin",
  96. fields => [qw(do title page subpage from name password confirm_password email)],
  97. header => 1,
  98. charset => "utf-8",
  99. method => 'POST',
  100. validate => {
  101. confirm_password => {
  102. perl => q{eq $form->field("password")},
  103. },
  104. email => 'EMAIL',
  105. },
  106. required => 'NONE',
  107. javascript => 0,
  108. params => $q,
  109. action => $config{cgiurl},
  110. header => 0,
  111. template => (-e "$config{templatedir}/signin.tmpl" ?
  112. {template_params("signin.tmpl")} : ""),
  113. stylesheet => baseurl()."style.css",
  114. );
  115. decode_form_utf8($form);
  116. $form->field(name => "name", required => 0);
  117. $form->field(name => "do", type => "hidden");
  118. $form->field(name => "page", type => "hidden");
  119. $form->field(name => "title", type => "hidden");
  120. $form->field(name => "from", type => "hidden");
  121. $form->field(name => "subpage", type => "hidden");
  122. $form->field(name => "password", type => "password", required => 0);
  123. $form->field(name => "confirm_password", type => "password", required => 0);
  124. $form->field(name => "email", required => 0);
  125. if ($q->param("do") ne "signin" && !$form->submitted) {
  126. $form->text("You need to log in first.");
  127. }
  128. if ($form->submitted) {
  129. # Set required fields based on how form was submitted.
  130. my %required=(
  131. "Login" => [qw(name password)],
  132. "Register" => [qw(name password confirm_password email)],
  133. "Mail Password" => [qw(name)],
  134. );
  135. foreach my $opt (@{$required{$form->submitted}}) {
  136. $form->field(name => $opt, required => 1);
  137. }
  138. # Validate password differently depending on how
  139. # form was submitted.
  140. if ($form->submitted eq 'Login') {
  141. $form->field(
  142. name => "password",
  143. validate => sub {
  144. length $form->field("name") &&
  145. shift eq userinfo_get($form->field("name"), 'password');
  146. },
  147. );
  148. $form->field(name => "name", validate => '/^\w+$/');
  149. }
  150. else {
  151. $form->field(name => "password", validate => 'VALUE');
  152. }
  153. # And make sure the entered name exists when logging
  154. # in or sending email, and does not when registering.
  155. if ($form->submitted eq 'Register') {
  156. $form->field(
  157. name => "name",
  158. validate => sub {
  159. my $name=shift;
  160. length $name &&
  161. $name=~/$config{wiki_file_regexp}/ &&
  162. ! userinfo_get($name, "regdate");
  163. },
  164. );
  165. }
  166. else {
  167. $form->field(
  168. name => "name",
  169. validate => sub {
  170. my $name=shift;
  171. length $name &&
  172. userinfo_get($name, "regdate");
  173. },
  174. );
  175. }
  176. }
  177. else {
  178. # First time settings.
  179. $form->field(name => "name", comment => "use FirstnameLastName");
  180. $form->field(name => "confirm_password", comment => "(only needed");
  181. $form->field(name => "email", comment => "for registration)");
  182. if ($session->param("name")) {
  183. $form->field(name => "name", value => $session->param("name"));
  184. }
  185. }
  186. if ($form->submitted && $form->validate) {
  187. if ($form->submitted eq 'Login') {
  188. $session->param("name", $form->field("name"));
  189. if (defined $form->field("do") &&
  190. $form->field("do") ne 'signin') {
  191. redirect($q, cgiurl(
  192. do => $form->field("do"),
  193. page => $form->field("page"),
  194. title => $form->field("title"),
  195. subpage => $form->field("subpage"),
  196. from => $form->field("from"),
  197. ));
  198. }
  199. else {
  200. redirect($q, $config{url});
  201. }
  202. }
  203. elsif ($form->submitted eq 'Register') {
  204. my $user_name=$form->field('name');
  205. if (userinfo_setall($user_name, {
  206. 'email' => $form->field('email'),
  207. 'password' => $form->field('password'),
  208. 'regdate' => time
  209. })) {
  210. $form->field(name => "confirm_password", type => "hidden");
  211. $form->field(name => "email", type => "hidden");
  212. $form->text("Registration successful. Now you can Login.");
  213. printheader($session);
  214. print misctemplate($form->title, $form->render(submit => ["Login"]));
  215. }
  216. else {
  217. error("Error saving registration.");
  218. }
  219. }
  220. elsif ($form->submitted eq 'Mail Password') {
  221. my $user_name=$form->field("name");
  222. my $template=template("passwordmail.tmpl");
  223. $template->param(
  224. user_name => $user_name,
  225. user_password => userinfo_get($user_name, "password"),
  226. wikiurl => $config{url},
  227. wikiname => $config{wikiname},
  228. REMOTE_ADDR => $ENV{REMOTE_ADDR},
  229. );
  230. eval q{use Mail::Sendmail};
  231. sendmail(
  232. To => userinfo_get($user_name, "email"),
  233. From => "$config{wikiname} admin <$config{adminemail}>",
  234. Subject => "$config{wikiname} information",
  235. Message => $template->output,
  236. ) or error("Failed to send mail");
  237. $form->text("Your password has been emailed to you.");
  238. $form->field(name => "name", required => 0);
  239. printheader($session);
  240. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  241. }
  242. }
  243. else {
  244. printheader($session);
  245. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  246. }
  247. } #}}}
  248. sub cgi_prefs ($$) { #{{{
  249. my $q=shift;
  250. my $session=shift;
  251. eval q{use CGI::FormBuilder};
  252. my $form = CGI::FormBuilder->new(
  253. title => "preferences",
  254. fields => [qw(do name password confirm_password email
  255. subscriptions locked_pages)],
  256. header => 0,
  257. charset => "utf-8",
  258. method => 'POST',
  259. validate => {
  260. confirm_password => {
  261. perl => q{eq $form->field("password")},
  262. },
  263. email => 'EMAIL',
  264. },
  265. required => 'NONE',
  266. javascript => 0,
  267. params => $q,
  268. action => $config{cgiurl},
  269. template => (-e "$config{templatedir}/prefs.tmpl" ?
  270. {template_params("prefs.tmpl")} : ""),
  271. stylesheet => baseurl()."style.css",
  272. );
  273. my @buttons=("Save Preferences", "Logout", "Cancel");
  274. my $user_name=$session->param("name");
  275. $form->field(name => "do", type => "hidden");
  276. $form->field(name => "name", disabled => 1,
  277. value => $user_name, force => 1);
  278. $form->field(name => "password", type => "password");
  279. $form->field(name => "confirm_password", type => "password");
  280. $form->field(name => "subscriptions", size => 50,
  281. comment => "(".htmllink("", "", "PageSpec", 1).")");
  282. $form->field(name => "locked_pages", size => 50,
  283. comment => "(".htmllink("", "", "PageSpec", 1).")");
  284. if (! is_admin($user_name)) {
  285. $form->field(name => "locked_pages", type => "hidden");
  286. }
  287. if ($config{httpauth}) {
  288. $form->field(name => "password", type => "hidden");
  289. $form->field(name => "confirm_password", type => "hidden");
  290. }
  291. if (! $form->submitted) {
  292. $form->field(name => "email", force => 1,
  293. value => userinfo_get($user_name, "email"));
  294. $form->field(name => "subscriptions", force => 1,
  295. value => userinfo_get($user_name, "subscriptions"));
  296. $form->field(name => "locked_pages", force => 1,
  297. value => userinfo_get($user_name, "locked_pages"));
  298. }
  299. decode_form_utf8($form);
  300. if ($form->submitted eq 'Logout') {
  301. $session->delete();
  302. redirect($q, $config{url});
  303. return;
  304. }
  305. elsif ($form->submitted eq 'Cancel') {
  306. redirect($q, $config{url});
  307. return;
  308. }
  309. elsif ($form->submitted eq "Save Preferences" && $form->validate) {
  310. foreach my $field (qw(password email subscriptions locked_pages)) {
  311. if (length $form->field($field)) {
  312. userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field");
  313. }
  314. }
  315. $form->text("Preferences saved.");
  316. }
  317. printheader($session);
  318. print misctemplate($form->title, $form->render(submit => \@buttons));
  319. } #}}}
  320. sub cgi_editpage ($$) { #{{{
  321. my $q=shift;
  322. my $session=shift;
  323. my @fields=qw(do rcsinfo subpage from page type editcontent comments);
  324. my @buttons=("Save Page", "Preview", "Cancel");
  325. eval q{use CGI::FormBuilder; use CGI::FormBuilder::Template::HTML};
  326. my $renderer=CGI::FormBuilder::Template::HTML->new(
  327. fields => \@fields,
  328. template_params("editpage.tmpl"),
  329. );
  330. run_hooks(pagetemplate => sub {
  331. shift->(page => "", destpage => "", template => $renderer->engine);
  332. });
  333. my $form = CGI::FormBuilder->new(
  334. fields => \@fields,
  335. header => 1,
  336. charset => "utf-8",
  337. method => 'POST',
  338. validate => {
  339. editcontent => '/.+/',
  340. },
  341. required => [qw{editcontent}],
  342. javascript => 0,
  343. params => $q,
  344. action => $config{cgiurl},
  345. table => 0,
  346. template => $renderer,
  347. );
  348. decode_form_utf8($form);
  349. # This untaint is safe because titlepage removes any problematic
  350. # characters.
  351. my ($page)=$form->field('page');
  352. $page=titlepage(possibly_foolish_untaint($page));
  353. if (! defined $page || ! length $page ||
  354. $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) {
  355. error("bad page name");
  356. }
  357. my $from;
  358. if (defined $form->field('from')) {
  359. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  360. }
  361. my $file;
  362. my $type;
  363. if (exists $pagesources{$page}) {
  364. $file=$pagesources{$page};
  365. $type=pagetype($file);
  366. }
  367. else {
  368. $type=$form->param('type');
  369. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  370. $type=possibly_foolish_untaint($type);
  371. }
  372. elsif (defined $from) {
  373. # favor the type of linking page
  374. $type=pagetype($pagesources{$from});
  375. }
  376. $type=$config{default_pageext} unless defined $type;
  377. $file=$page.".".$type;
  378. }
  379. my $newfile=0;
  380. if (! -e "$config{srcdir}/$file") {
  381. $newfile=1;
  382. }
  383. $form->field(name => "do", type => 'hidden');
  384. $form->field(name => "from", type => 'hidden');
  385. $form->field(name => "rcsinfo", type => 'hidden');
  386. $form->field(name => "subpage", type => 'hidden');
  387. $form->field(name => "page", value => $page, force => 1);
  388. $form->field(name => "type", value => $type, force => 1);
  389. $form->field(name => "comments", type => "text", size => 80);
  390. $form->field(name => "editcontent", type => "textarea", rows => 20,
  391. cols => 80);
  392. $form->tmpl_param("can_commit", $config{rcs});
  393. $form->tmpl_param("indexlink", indexlink());
  394. $form->tmpl_param("helponformattinglink",
  395. htmllink("", "", "HelpOnFormatting", 1));
  396. $form->tmpl_param("baseurl", baseurl());
  397. if (! $form->submitted) {
  398. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  399. force => 1);
  400. }
  401. if ($form->submitted eq "Cancel") {
  402. if ($newfile && defined $from) {
  403. redirect($q, "$config{url}/".htmlpage($from));
  404. }
  405. elsif ($newfile) {
  406. redirect($q, $config{url});
  407. }
  408. else {
  409. redirect($q, "$config{url}/".htmlpage($page));
  410. }
  411. return;
  412. }
  413. elsif ($form->submitted eq "Preview") {
  414. my $content=$form->field('editcontent');
  415. my $comments=$form->field('comments');
  416. $form->field(name => "editcontent",
  417. value => $content, force => 1);
  418. $form->field(name => "comments",
  419. value => $comments, force => 1);
  420. $config{rss}=0; # avoid preview writing an rss feed!
  421. $form->tmpl_param("page_preview",
  422. htmlize($page, $type,
  423. linkify($page, "",
  424. preprocess($page, $page,
  425. filter($page, $content)))));
  426. }
  427. else {
  428. $form->tmpl_param("page_preview", "");
  429. }
  430. $form->tmpl_param("page_conflict", "");
  431. if (! $form->submitted || $form->submitted eq "Preview" ||
  432. ! $form->validate) {
  433. if ($form->field("do") eq "create") {
  434. my @page_locs;
  435. my $best_loc;
  436. if (! defined $from || ! length $from ||
  437. $from ne $form->field('from') ||
  438. $from=~/$config{wiki_file_prune_regexp}/ ||
  439. $from=~/^\// ||
  440. $form->submitted eq "Preview") {
  441. @page_locs=$best_loc=$page;
  442. }
  443. else {
  444. my $dir=$from."/";
  445. $dir=~s![^/]+/+$!!;
  446. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  447. $page eq 'discussion') {
  448. $best_loc="$from/$page";
  449. }
  450. else {
  451. $best_loc=$dir.$page;
  452. }
  453. push @page_locs, $dir.$page;
  454. push @page_locs, "$from/$page";
  455. while (length $dir) {
  456. $dir=~s![^/]+/+$!!;
  457. push @page_locs, $dir.$page;
  458. }
  459. }
  460. @page_locs = grep {
  461. ! exists $pagecase{lc $_} &&
  462. ! page_locked($_, $session, 1)
  463. } @page_locs;
  464. if (! @page_locs) {
  465. # hmm, someone else made the page in the
  466. # meantime?
  467. redirect($q, "$config{url}/".htmlpage($page));
  468. return;
  469. }
  470. my @page_types;
  471. if (exists $hooks{htmlize}) {
  472. @page_types=keys %{$hooks{htmlize}};
  473. }
  474. $form->tmpl_param("page_select", 1);
  475. $form->field(name => "page", type => 'select',
  476. options => \@page_locs, value => $best_loc);
  477. $form->field(name => "type", type => 'select',
  478. options => \@page_types);
  479. $form->title("creating ".pagetitle($page));
  480. }
  481. elsif ($form->field("do") eq "edit") {
  482. page_locked($page, $session);
  483. if (! defined $form->field('editcontent') ||
  484. ! length $form->field('editcontent')) {
  485. my $content="";
  486. if (exists $pagesources{$page}) {
  487. $content=readfile(srcfile($pagesources{$page}));
  488. $content=~s/\n/\r\n/g;
  489. }
  490. $form->field(name => "editcontent", value => $content,
  491. force => 1);
  492. }
  493. $form->tmpl_param("page_select", 0);
  494. $form->field(name => "page", type => 'hidden');
  495. $form->field(name => "type", type => 'hidden');
  496. $form->title("editing ".pagetitle($page));
  497. }
  498. print $form->render(submit => \@buttons);
  499. }
  500. else {
  501. # save page
  502. page_locked($page, $session);
  503. my $content=$form->field('editcontent');
  504. $content=~s/\r\n/\n/g;
  505. $content=~s/\r/\n/g;
  506. writefile($file, $config{srcdir}, $content);
  507. my $message="web commit ";
  508. if (defined $session->param("name") &&
  509. length $session->param("name")) {
  510. $message.="by ".$session->param("name");
  511. }
  512. else {
  513. $message.="from $ENV{REMOTE_ADDR}";
  514. }
  515. if (defined $form->field('comments') &&
  516. length $form->field('comments')) {
  517. $message.=": ".$form->field('comments');
  518. }
  519. if ($config{rcs}) {
  520. if ($newfile) {
  521. rcs_add($file);
  522. }
  523. # prevent deadlock with post-commit hook
  524. unlockwiki();
  525. # presumably the commit will trigger an update
  526. # of the wiki
  527. my $conflict=rcs_commit($file, $message,
  528. $form->field("rcsinfo"));
  529. if (defined $conflict) {
  530. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  531. force => 1);
  532. $form->tmpl_param("page_conflict", 1);
  533. $form->field("editcontent", value => $conflict, force => 1);
  534. $form->field(name => "comments", value => $form->field('comments'), force => 1);
  535. $form->field("do", "edit)");
  536. $form->tmpl_param("page_select", 0);
  537. $form->field(name => "page", type => 'hidden');
  538. $form->field(name => "type", type => 'hidden');
  539. $form->title("editing $page");
  540. print $form->render(submit => \@buttons);
  541. return;
  542. }
  543. }
  544. else {
  545. require IkiWiki::Render;
  546. refresh();
  547. saveindex();
  548. }
  549. # The trailing question mark tries to avoid broken
  550. # caches and get the most recent version of the page.
  551. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  552. }
  553. } #}}}
  554. sub cgi () { #{{{
  555. eval q{use CGI};
  556. eval q{use CGI::Session};
  557. my $q=CGI->new;
  558. run_hooks(cgi => sub { shift->($q) });
  559. my $do=$q->param('do');
  560. if (! defined $do || ! length $do) {
  561. my $error = $q->cgi_error;
  562. if ($error) {
  563. error("Request not processed: $error");
  564. }
  565. else {
  566. error("\"do\" parameter missing");
  567. }
  568. }
  569. # Things that do not need a session.
  570. if ($do eq 'recentchanges') {
  571. cgi_recentchanges($q);
  572. return;
  573. }
  574. elsif ($do eq 'hyperestraier') {
  575. cgi_hyperestraier();
  576. }
  577. CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname}));
  578. my $oldmask=umask(077);
  579. my $session = CGI::Session->new("driver:DB_File", $q,
  580. { FileName => "$config{wikistatedir}/sessions.db" });
  581. umask($oldmask);
  582. # Everything below this point needs the user to be signed in.
  583. if (((! $config{anonok} || $do eq 'prefs') &&
  584. (! $config{httpauth}) &&
  585. (! defined $session->param("name") ||
  586. ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
  587. cgi_signin($q, $session);
  588. # Force session flush with safe umask.
  589. my $oldmask=umask(077);
  590. $session->flush;
  591. umask($oldmask);
  592. return;
  593. }
  594. if ($config{httpauth} && (! defined $session->param("name"))) {
  595. if (! defined $q->remote_user()) {
  596. error("Could not determine authenticated username.");
  597. }
  598. else {
  599. $session->param("name", $q->remote_user());
  600. if (!userinfo_get($session->param("name"),"regdate")) {
  601. userinfo_setall($session->param("name"), {
  602. email => "",
  603. password => "",
  604. regdate=>time,
  605. });
  606. }
  607. }
  608. }
  609. if ($do eq 'create' || $do eq 'edit') {
  610. cgi_editpage($q, $session);
  611. }
  612. elsif ($do eq 'prefs') {
  613. cgi_prefs($q, $session);
  614. }
  615. elsif ($do eq 'blog') {
  616. my $page=titlepage(decode_utf8($q->param('title')));
  617. # if the page already exists, munge it to be unique
  618. my $from=$q->param('from');
  619. my $add="";
  620. while (exists $pagecase{lc "$from/$page$add"}) {
  621. $add=1 unless length $add;
  622. $add++;
  623. }
  624. $q->param('page', $page.$add);
  625. # now run same as create
  626. $q->param('do', 'create');
  627. cgi_editpage($q, $session);
  628. }
  629. else {
  630. error("unknown do parameter");
  631. }
  632. } #}}}
  633. 1