summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 4c15be0aeecb09221d27863ceb580d55f759d66e (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub redirect ($$) { #{{{
  10. my $q=shift;
  11. my $url=shift;
  12. if (! $config{w3mmode}) {
  13. print $q->redirect($url);
  14. }
  15. else {
  16. print "Content-type: text/plain\n";
  17. print "W3m-control: GOTO $url\n\n";
  18. }
  19. } #}}}
  20. sub page_locked ($$;$) { #{{{
  21. my $page=shift;
  22. my $session=shift;
  23. my $nonfatal=shift;
  24. my $user=$session->param("name");
  25. return if defined $user && is_admin($user);
  26. foreach my $admin (@{$config{adminuser}}) {
  27. my $locked_pages=userinfo_get($admin, "locked_pages");
  28. if (pagespec_match($page, userinfo_get($admin, "locked_pages"))) {
  29. return 1 if $nonfatal;
  30. error(htmllink("", "", $page, 1)." is locked by ".
  31. htmllink("", "", $admin, 1)." and cannot be edited.");
  32. }
  33. }
  34. return 0;
  35. } #}}}
  36. sub decode_form_utf8 ($) { #{{{
  37. my $form = shift;
  38. foreach my $f ($form->field) {
  39. next if Encode::is_utf8(scalar $form->field($f));
  40. $form->field(name => $f,
  41. value => decode_utf8($form->field($f)),
  42. force => 1,
  43. );
  44. }
  45. } #}}}
  46. sub cgi_recentchanges ($) { #{{{
  47. my $q=shift;
  48. unlockwiki();
  49. # Optimisation: building recentchanges means calculating lots of
  50. # links. Memoizing htmllink speeds it up a lot (can't be memoized
  51. # during page builds as the return values may change, but they
  52. # won't here.)
  53. eval q{use Memoize};
  54. memoize("htmllink");
  55. my $template=template("recentchanges.tmpl");
  56. $template->param(
  57. title => "RecentChanges",
  58. indexlink => indexlink(),
  59. wikiname => $config{wikiname},
  60. changelog => [rcs_recentchanges(100)],
  61. styleurl => styleurl(),
  62. baseurl => "$config{url}/",
  63. );
  64. print $q->header(-charset=>'utf-8'), $template->output;
  65. } #}}}
  66. sub cgi_signin ($$) { #{{{
  67. my $q=shift;
  68. my $session=shift;
  69. eval q{use CGI::FormBuilder};
  70. my $form = CGI::FormBuilder->new(
  71. title => "signin",
  72. fields => [qw(do title page subpage from name password confirm_password email)],
  73. header => 1,
  74. charset => "utf-8",
  75. method => 'POST',
  76. validate => {
  77. confirm_password => {
  78. perl => q{eq $form->field("password")},
  79. },
  80. email => 'EMAIL',
  81. },
  82. required => 'NONE',
  83. javascript => 0,
  84. params => $q,
  85. action => $config{cgiurl},
  86. header => 0,
  87. template => (-e "$config{templatedir}/signin.tmpl" ?
  88. {template_params("signin.tmpl")} : ""),
  89. stylesheet => styleurl(),
  90. );
  91. decode_form_utf8($form);
  92. $form->field(name => "name", required => 0);
  93. $form->field(name => "do", type => "hidden");
  94. $form->field(name => "page", type => "hidden");
  95. $form->field(name => "title", type => "hidden");
  96. $form->field(name => "from", type => "hidden");
  97. $form->field(name => "subpage", type => "hidden");
  98. $form->field(name => "password", type => "password", required => 0);
  99. $form->field(name => "confirm_password", type => "password", required => 0);
  100. $form->field(name => "email", required => 0);
  101. if ($q->param("do") ne "signin" && !$form->submitted) {
  102. $form->text("You need to log in first.");
  103. }
  104. if ($form->submitted) {
  105. # Set required fields based on how form was submitted.
  106. my %required=(
  107. "Login" => [qw(name password)],
  108. "Register" => [qw(name password confirm_password email)],
  109. "Mail Password" => [qw(name)],
  110. );
  111. foreach my $opt (@{$required{$form->submitted}}) {
  112. $form->field(name => $opt, required => 1);
  113. }
  114. # Validate password differently depending on how
  115. # form was submitted.
  116. if ($form->submitted eq 'Login') {
  117. $form->field(
  118. name => "password",
  119. validate => sub {
  120. length $form->field("name") &&
  121. shift eq userinfo_get($form->field("name"), 'password');
  122. },
  123. );
  124. $form->field(name => "name", validate => '/^\w+$/');
  125. }
  126. else {
  127. $form->field(name => "password", validate => 'VALUE');
  128. }
  129. # And make sure the entered name exists when logging
  130. # in or sending email, and does not when registering.
  131. if ($form->submitted eq 'Register') {
  132. $form->field(
  133. name => "name",
  134. validate => sub {
  135. my $name=shift;
  136. length $name &&
  137. $name=~/$config{wiki_file_regexp}/ &&
  138. ! userinfo_get($name, "regdate");
  139. },
  140. );
  141. }
  142. else {
  143. $form->field(
  144. name => "name",
  145. validate => sub {
  146. my $name=shift;
  147. length $name &&
  148. userinfo_get($name, "regdate");
  149. },
  150. );
  151. }
  152. }
  153. else {
  154. # First time settings.
  155. $form->field(name => "name", comment => "use FirstnameLastName");
  156. $form->field(name => "confirm_password", comment => "(only needed");
  157. $form->field(name => "email", comment => "for registration)");
  158. if ($session->param("name")) {
  159. $form->field(name => "name", value => $session->param("name"));
  160. }
  161. }
  162. if ($form->submitted && $form->validate) {
  163. if ($form->submitted eq 'Login') {
  164. $session->param("name", $form->field("name"));
  165. if (defined $form->field("do") &&
  166. $form->field("do") ne 'signin') {
  167. redirect($q, cgiurl(
  168. do => $form->field("do"),
  169. page => $form->field("page"),
  170. title => $form->field("title"),
  171. subpage => $form->field("subpage"),
  172. from => $form->field("from"),
  173. ));
  174. }
  175. else {
  176. redirect($q, $config{url});
  177. }
  178. }
  179. elsif ($form->submitted eq 'Register') {
  180. my $user_name=$form->field('name');
  181. if (userinfo_setall($user_name, {
  182. 'email' => $form->field('email'),
  183. 'password' => $form->field('password'),
  184. 'regdate' => time
  185. })) {
  186. $form->field(name => "confirm_password", type => "hidden");
  187. $form->field(name => "email", type => "hidden");
  188. $form->text("Registration successful. Now you can Login.");
  189. print $session->header(-charset=>'utf-8');
  190. print misctemplate($form->title, $form->render(submit => ["Login"]));
  191. }
  192. else {
  193. error("Error saving registration.");
  194. }
  195. }
  196. elsif ($form->submitted eq 'Mail Password') {
  197. my $user_name=$form->field("name");
  198. my $template=template("passwordmail.tmpl");
  199. $template->param(
  200. user_name => $user_name,
  201. user_password => userinfo_get($user_name, "password"),
  202. wikiurl => $config{url},
  203. wikiname => $config{wikiname},
  204. REMOTE_ADDR => $ENV{REMOTE_ADDR},
  205. );
  206. eval q{use Mail::Sendmail};
  207. sendmail(
  208. To => userinfo_get($user_name, "email"),
  209. From => "$config{wikiname} admin <$config{adminemail}>",
  210. Subject => "$config{wikiname} information",
  211. Message => $template->output,
  212. ) or error("Failed to send mail");
  213. $form->text("Your password has been emailed to you.");
  214. $form->field(name => "name", required => 0);
  215. print $session->header(-charset=>'utf-8');
  216. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  217. }
  218. }
  219. else {
  220. print $session->header(-charset=>'utf-8');
  221. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  222. }
  223. } #}}}
  224. sub cgi_prefs ($$) { #{{{
  225. my $q=shift;
  226. my $session=shift;
  227. eval q{use CGI::FormBuilder};
  228. my $form = CGI::FormBuilder->new(
  229. title => "preferences",
  230. fields => [qw(do name password confirm_password email
  231. subscriptions locked_pages)],
  232. header => 0,
  233. charset => "utf-8",
  234. method => 'POST',
  235. validate => {
  236. confirm_password => {
  237. perl => q{eq $form->field("password")},
  238. },
  239. email => 'EMAIL',
  240. },
  241. required => 'NONE',
  242. javascript => 0,
  243. params => $q,
  244. action => $config{cgiurl},
  245. template => (-e "$config{templatedir}/prefs.tmpl" ?
  246. {template_params("prefs.tmpl")} : ""),
  247. stylesheet => styleurl(),
  248. );
  249. my @buttons=("Save Preferences", "Logout", "Cancel");
  250. my $user_name=$session->param("name");
  251. $form->field(name => "do", type => "hidden");
  252. $form->field(name => "name", disabled => 1,
  253. value => $user_name, force => 1);
  254. $form->field(name => "password", type => "password");
  255. $form->field(name => "confirm_password", type => "password");
  256. $form->field(name => "subscriptions", size => 50,
  257. comment => "(".htmllink("", "", "PageSpec", 1).")");
  258. $form->field(name => "locked_pages", size => 50,
  259. comment => "(".htmllink("", "", "PageSpec", 1).")");
  260. if (! is_admin($user_name)) {
  261. $form->field(name => "locked_pages", type => "hidden");
  262. }
  263. if (! $form->submitted) {
  264. $form->field(name => "email", force => 1,
  265. value => userinfo_get($user_name, "email"));
  266. $form->field(name => "subscriptions", force => 1,
  267. value => userinfo_get($user_name, "subscriptions"));
  268. $form->field(name => "locked_pages", force => 1,
  269. value => userinfo_get($user_name, "locked_pages"));
  270. }
  271. decode_form_utf8($form);
  272. if ($form->submitted eq 'Logout') {
  273. $session->delete();
  274. redirect($q, $config{url});
  275. return;
  276. }
  277. elsif ($form->submitted eq 'Cancel') {
  278. redirect($q, $config{url});
  279. return;
  280. }
  281. elsif ($form->submitted eq "Save Preferences" && $form->validate) {
  282. foreach my $field (qw(password email subscriptions locked_pages)) {
  283. if (length $form->field($field)) {
  284. userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field");
  285. }
  286. }
  287. $form->text("Preferences saved.");
  288. }
  289. print $session->header(-charset=>'utf-8');
  290. print misctemplate($form->title, $form->render(submit => \@buttons));
  291. } #}}}
  292. sub cgi_editpage ($$) { #{{{
  293. my $q=shift;
  294. my $session=shift;
  295. eval q{use CGI::FormBuilder};
  296. my $form = CGI::FormBuilder->new(
  297. fields => [qw(do rcsinfo subpage from page type editcontent comments)],
  298. header => 1,
  299. charset => "utf-8",
  300. method => 'POST',
  301. validate => {
  302. editcontent => '/.+/',
  303. },
  304. required => [qw{editcontent}],
  305. javascript => 0,
  306. params => $q,
  307. action => $config{cgiurl},
  308. table => 0,
  309. template => {template_params("editpage.tmpl")},
  310. );
  311. my @buttons=("Save Page", "Preview", "Cancel");
  312. decode_form_utf8($form);
  313. # This untaint is safe because titlepage removes any problematic
  314. # characters.
  315. my ($page)=$form->field('page');
  316. $page=titlepage(possibly_foolish_untaint($page));
  317. if (! defined $page || ! length $page ||
  318. $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) {
  319. error("bad page name");
  320. }
  321. my $from;
  322. if (defined $form->field('from')) {
  323. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  324. }
  325. my $file;
  326. my $type;
  327. if (exists $pagesources{$page}) {
  328. $file=$pagesources{$page};
  329. $type=pagetype($file);
  330. }
  331. else {
  332. $type=$form->param('type');
  333. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  334. $type=possibly_foolish_untaint($type);
  335. }
  336. elsif (defined $from) {
  337. # favor the type of linking page
  338. $type=pagetype($pagesources{$from});
  339. }
  340. $type=$config{default_pageext} unless defined $type;
  341. $file=$page.".".$type;
  342. }
  343. my $newfile=0;
  344. if (! -e "$config{srcdir}/$file") {
  345. $newfile=1;
  346. }
  347. $form->field(name => "do", type => 'hidden');
  348. $form->field(name => "from", type => 'hidden');
  349. $form->field(name => "rcsinfo", type => 'hidden');
  350. $form->field(name => "subpage", type => 'hidden');
  351. $form->field(name => "page", value => $page, force => 1);
  352. $form->field(name => "type", value => $type, force => 1);
  353. $form->field(name => "comments", type => "text", size => 80);
  354. $form->field(name => "editcontent", type => "textarea", rows => 20,
  355. cols => 80);
  356. $form->tmpl_param("can_commit", $config{rcs});
  357. $form->tmpl_param("indexlink", indexlink());
  358. $form->tmpl_param("helponformattinglink",
  359. htmllink("", "", "HelpOnFormatting", 1));
  360. $form->tmpl_param("styleurl", styleurl());
  361. $form->tmpl_param("baseurl", "$config{url}/");
  362. if (! $form->submitted) {
  363. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  364. force => 1);
  365. }
  366. if ($form->submitted eq "Cancel") {
  367. redirect($q, "$config{url}/".htmlpage($page));
  368. return;
  369. }
  370. elsif ($form->submitted eq "Preview") {
  371. require IkiWiki::Render;
  372. my $content=$form->field('editcontent');
  373. my $comments=$form->field('comments');
  374. $form->field(name => "editcontent",
  375. value => $content, force => 1);
  376. $form->field(name => "comments",
  377. value => $comments, force => 1);
  378. $form->tmpl_param("page_preview",
  379. htmlize($type, linkify($page, $page, filter($page, $content))));
  380. }
  381. else {
  382. $form->tmpl_param("page_preview", "");
  383. }
  384. $form->tmpl_param("page_conflict", "");
  385. if (! $form->submitted || $form->submitted eq "Preview" ||
  386. ! $form->validate) {
  387. if ($form->field("do") eq "create") {
  388. my @page_locs;
  389. my $best_loc;
  390. if (! defined $from || ! length $from ||
  391. $from ne $form->field('from') ||
  392. $from=~/$config{wiki_file_prune_regexp}/ ||
  393. $from=~/^\// ||
  394. $form->submitted eq "Preview") {
  395. @page_locs=$best_loc=$page;
  396. }
  397. else {
  398. my $dir=$from."/";
  399. $dir=~s![^/]+/+$!!;
  400. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  401. $page eq 'discussion') {
  402. $best_loc="$from/$page";
  403. }
  404. else {
  405. $best_loc=$dir.$page;
  406. }
  407. push @page_locs, $dir.$page;
  408. push @page_locs, "$from/$page";
  409. while (length $dir) {
  410. $dir=~s![^/]+/+$!!;
  411. push @page_locs, $dir.$page;
  412. }
  413. }
  414. @page_locs = grep {
  415. ! exists $pagecase{lc $_} &&
  416. ! page_locked($_, $session, 1)
  417. } @page_locs;
  418. if (! @page_locs) {
  419. # hmm, someone else made the page in the
  420. # meantime?
  421. redirect($q, "$config{url}/".htmlpage($page));
  422. return;
  423. }
  424. my @page_types;
  425. if (exists $hooks{htmlize}) {
  426. @page_types=keys %{$hooks{htmlize}};
  427. }
  428. $form->tmpl_param("page_select", 1);
  429. $form->field(name => "page", type => 'select',
  430. options => \@page_locs, value => $best_loc);
  431. $form->field(name => "type", type => 'select',
  432. options => \@page_types);
  433. $form->title("creating ".pagetitle($page));
  434. }
  435. elsif ($form->field("do") eq "edit") {
  436. page_locked($page, $session);
  437. if (! defined $form->field('editcontent') ||
  438. ! length $form->field('editcontent')) {
  439. my $content="";
  440. if (exists $pagesources{$page}) {
  441. $content=readfile(srcfile($pagesources{$page}));
  442. $content=~s/\n/\r\n/g;
  443. }
  444. $form->field(name => "editcontent", value => $content,
  445. force => 1);
  446. }
  447. $form->tmpl_param("page_select", 0);
  448. $form->field(name => "page", type => 'hidden');
  449. $form->field(name => "type", type => 'hidden');
  450. $form->title("editing ".pagetitle($page));
  451. }
  452. print $form->render(submit => \@buttons);
  453. }
  454. else {
  455. # save page
  456. page_locked($page, $session);
  457. my $content=$form->field('editcontent');
  458. $content=~s/\r\n/\n/g;
  459. $content=~s/\r/\n/g;
  460. writefile($file, $config{srcdir}, $content);
  461. my $message="web commit ";
  462. if (defined $session->param("name") &&
  463. length $session->param("name")) {
  464. $message.="by ".$session->param("name");
  465. }
  466. else {
  467. $message.="from $ENV{REMOTE_ADDR}";
  468. }
  469. if (defined $form->field('comments') &&
  470. length $form->field('comments')) {
  471. $message.=": ".$form->field('comments');
  472. }
  473. if ($config{rcs}) {
  474. if ($newfile) {
  475. rcs_add($file);
  476. }
  477. # prevent deadlock with post-commit hook
  478. unlockwiki();
  479. # presumably the commit will trigger an update
  480. # of the wiki
  481. my $conflict=rcs_commit($file, $message,
  482. $form->field("rcsinfo"));
  483. if (defined $conflict) {
  484. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  485. force => 1);
  486. $form->tmpl_param("page_conflict", 1);
  487. $form->field("editcontent", value => $conflict, force => 1);
  488. $form->field(name => "comments", value => $form->field('comments'), force => 1);
  489. $form->field("do", "edit)");
  490. $form->tmpl_param("page_select", 0);
  491. $form->field(name => "page", type => 'hidden');
  492. $form->field(name => "type", type => 'hidden');
  493. $form->title("editing $page");
  494. print $form->render(submit => \@buttons);
  495. return;
  496. }
  497. }
  498. else {
  499. require IkiWiki::Render;
  500. refresh();
  501. saveindex();
  502. }
  503. # The trailing question mark tries to avoid broken
  504. # caches and get the most recent version of the page.
  505. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  506. }
  507. } #}}}
  508. sub cgi () { #{{{
  509. eval q{use CGI};
  510. eval q{use CGI::Session};
  511. my $q=CGI->new;
  512. run_hooks(cgi => sub { shift->($q) });
  513. my $do=$q->param('do');
  514. if (! defined $do || ! length $do) {
  515. my $error = $q->cgi_error;
  516. if ($error) {
  517. error("Request not processed: $error");
  518. }
  519. else {
  520. error("\"do\" parameter missing");
  521. }
  522. }
  523. # Things that do not need a session.
  524. if ($do eq 'recentchanges') {
  525. cgi_recentchanges($q);
  526. return;
  527. }
  528. elsif ($do eq 'hyperestraier') {
  529. cgi_hyperestraier();
  530. }
  531. CGI::Session->name("ikiwiki_session_$config{wikiname}");
  532. my $oldmask=umask(077);
  533. my $session = CGI::Session->new("driver:DB_File", $q,
  534. { FileName => "$config{wikistatedir}/sessions.db" });
  535. umask($oldmask);
  536. # Everything below this point needs the user to be signed in.
  537. if ((! $config{anonok} &&
  538. (! defined $session->param("name") ||
  539. ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
  540. cgi_signin($q, $session);
  541. # Force session flush with safe umask.
  542. my $oldmask=umask(077);
  543. $session->flush;
  544. umask($oldmask);
  545. return;
  546. }
  547. if ($do eq 'create' || $do eq 'edit') {
  548. cgi_editpage($q, $session);
  549. }
  550. elsif ($do eq 'prefs') {
  551. cgi_prefs($q, $session);
  552. }
  553. elsif ($do eq 'blog') {
  554. my $page=titlepage(decode_utf8($q->param('title')));
  555. # if the page already exists, munge it to be unique
  556. my $from=$q->param('from');
  557. my $add="";
  558. while (exists $pagecase{lc "$from/$page$add"}) {
  559. $add=1 unless length $add;
  560. $add++;
  561. }
  562. $q->param('page', $page.$add);
  563. # now run same as create
  564. $q->param('do', 'create');
  565. cgi_editpage($q, $session);
  566. }
  567. else {
  568. error("unknown do parameter");
  569. }
  570. } #}}}
  571. 1