summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 7360ca998f29757032955d343122ab2cf32002e8 (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub redirect ($$) { #{{{
  10. my $q=shift;
  11. my $url=shift;
  12. if (! $config{w3mmode}) {
  13. print $q->redirect($url);
  14. }
  15. else {
  16. print "Content-type: text/plain\n";
  17. print "W3m-control: GOTO $url\n\n";
  18. }
  19. } #}}}
  20. sub page_locked ($$;$) { #{{{
  21. my $page=shift;
  22. my $session=shift;
  23. my $nonfatal=shift;
  24. my $user=$session->param("name");
  25. return if defined $user && is_admin($user);
  26. foreach my $admin (@{$config{adminuser}}) {
  27. my $locked_pages=userinfo_get($admin, "locked_pages");
  28. if (globlist_match($page, userinfo_get($admin, "locked_pages"))) {
  29. return 1 if $nonfatal;
  30. error(htmllink("", "", $page, 1)." is locked by ".
  31. htmllink("", "", $admin, 1)." and cannot be edited.");
  32. }
  33. }
  34. return 0;
  35. } #}}}
  36. sub decode_form_utf8 ($) { #{{{
  37. my $form = shift;
  38. foreach my $f ($form->field) {
  39. next if Encode::is_utf8(scalar $form->field($f));
  40. $form->field(name => $f,
  41. value => decode_utf8($form->field($f)),
  42. force => 1,
  43. );
  44. }
  45. } #}}}
  46. sub cgi_recentchanges ($) { #{{{
  47. my $q=shift;
  48. unlockwiki();
  49. # Optimisation: building recentchanges means calculating lots of
  50. # links. Memoizing htmllink speeds it up a lot (can't be memoized
  51. # during page builds as the return values may change, but they
  52. # won't here.)
  53. eval q{use Memoize};
  54. memoize("htmllink");
  55. my $template=template("recentchanges.tmpl");
  56. $template->param(
  57. title => "RecentChanges",
  58. indexlink => indexlink(),
  59. wikiname => $config{wikiname},
  60. changelog => [rcs_recentchanges(100)],
  61. styleurl => styleurl(),
  62. baseurl => "$config{url}/",
  63. );
  64. print $q->header(-charset=>'utf-8'), $template->output;
  65. } #}}}
  66. sub cgi_signin ($$) { #{{{
  67. my $q=shift;
  68. my $session=shift;
  69. eval q{use CGI::FormBuilder};
  70. my $form = CGI::FormBuilder->new(
  71. title => "signin",
  72. fields => [qw(do title page subpage from name password confirm_password email)],
  73. header => 1,
  74. charset => "utf-8",
  75. method => 'POST',
  76. validate => {
  77. confirm_password => {
  78. perl => q{eq $form->field("password")},
  79. },
  80. email => 'EMAIL',
  81. },
  82. required => 'NONE',
  83. javascript => 0,
  84. params => $q,
  85. action => $config{cgiurl},
  86. header => 0,
  87. template => (-e "$config{templatedir}/signin.tmpl" ?
  88. {template_params("signin.tmpl")} : ""),
  89. stylesheet => styleurl(),
  90. );
  91. decode_form_utf8($form);
  92. $form->field(name => "name", required => 0);
  93. $form->field(name => "do", type => "hidden");
  94. $form->field(name => "page", type => "hidden");
  95. $form->field(name => "title", type => "hidden");
  96. $form->field(name => "from", type => "hidden");
  97. $form->field(name => "subpage", type => "hidden");
  98. $form->field(name => "password", type => "password", required => 0);
  99. $form->field(name => "confirm_password", type => "password", required => 0);
  100. $form->field(name => "email", required => 0);
  101. if ($q->param("do") ne "signin") {
  102. $form->text("You need to log in first.");
  103. }
  104. if ($form->submitted) {
  105. # Set required fields based on how form was submitted.
  106. my %required=(
  107. "Login" => [qw(name password)],
  108. "Register" => [qw(name password confirm_password email)],
  109. "Mail Password" => [qw(name)],
  110. );
  111. foreach my $opt (@{$required{$form->submitted}}) {
  112. $form->field(name => $opt, required => 1);
  113. }
  114. # Validate password differently depending on how
  115. # form was submitted.
  116. if ($form->submitted eq 'Login') {
  117. $form->field(
  118. name => "password",
  119. validate => sub {
  120. length $form->field("name") &&
  121. shift eq userinfo_get($form->field("name"), 'password');
  122. },
  123. );
  124. $form->field(name => "name", validate => '/^\w+$/');
  125. }
  126. else {
  127. $form->field(name => "password", validate => 'VALUE');
  128. }
  129. # And make sure the entered name exists when logging
  130. # in or sending email, and does not when registering.
  131. if ($form->submitted eq 'Register') {
  132. $form->field(
  133. name => "name",
  134. validate => sub {
  135. my $name=shift;
  136. length $name &&
  137. $name=~/$config{wiki_file_regexp}/ &&
  138. ! userinfo_get($name, "regdate");
  139. },
  140. );
  141. }
  142. else {
  143. $form->field(
  144. name => "name",
  145. validate => sub {
  146. my $name=shift;
  147. length $name &&
  148. userinfo_get($name, "regdate");
  149. },
  150. );
  151. }
  152. }
  153. else {
  154. # First time settings.
  155. $form->field(name => "name", comment => "use FirstnameLastName");
  156. $form->field(name => "confirm_password", comment => "(only needed");
  157. $form->field(name => "email", comment => "for registration)");
  158. if ($session->param("name")) {
  159. $form->field(name => "name", value => $session->param("name"));
  160. }
  161. }
  162. if ($form->submitted && $form->validate) {
  163. if ($form->submitted eq 'Login') {
  164. $session->param("name", $form->field("name"));
  165. if (defined $form->field("do") &&
  166. $form->field("do") ne 'signin') {
  167. redirect($q, cgiurl(
  168. do => $form->field("do"),
  169. page => $form->field("page"),
  170. title => $form->field("title"),
  171. subpage => $form->field("subpage"),
  172. from => $form->field("from"),
  173. ));
  174. }
  175. else {
  176. redirect($q, $config{url});
  177. }
  178. }
  179. elsif ($form->submitted eq 'Register') {
  180. my $user_name=$form->field('name');
  181. if (userinfo_setall($user_name, {
  182. 'email' => $form->field('email'),
  183. 'password' => $form->field('password'),
  184. 'regdate' => time
  185. })) {
  186. $form->field(name => "confirm_password", type => "hidden");
  187. $form->field(name => "email", type => "hidden");
  188. $form->text("Registration successful. Now you can Login.");
  189. print $session->header(-charset=>'utf-8');
  190. print misctemplate($form->title, $form->render(submit => ["Login"]));
  191. }
  192. else {
  193. error("Error saving registration.");
  194. }
  195. }
  196. elsif ($form->submitted eq 'Mail Password') {
  197. my $user_name=$form->field("name");
  198. my $template=template("passwordmail.tmpl");
  199. $template->param(
  200. user_name => $user_name,
  201. user_password => userinfo_get($user_name, "password"),
  202. wikiurl => $config{url},
  203. wikiname => $config{wikiname},
  204. REMOTE_ADDR => $ENV{REMOTE_ADDR},
  205. );
  206. eval q{use Mail::Sendmail};
  207. sendmail(
  208. To => userinfo_get($user_name, "email"),
  209. From => "$config{wikiname} admin <$config{adminemail}>",
  210. Subject => "$config{wikiname} information",
  211. Message => $template->output,
  212. ) or error("Failed to send mail");
  213. $form->text("Your password has been emailed to you.");
  214. $form->field(name => "name", required => 0);
  215. print $session->header(-charset=>'utf-8');
  216. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  217. }
  218. }
  219. else {
  220. print $session->header(-charset=>'utf-8');
  221. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  222. }
  223. } #}}}
  224. sub cgi_prefs ($$) { #{{{
  225. my $q=shift;
  226. my $session=shift;
  227. eval q{use CGI::FormBuilder};
  228. my $form = CGI::FormBuilder->new(
  229. title => "preferences",
  230. fields => [qw(do name password confirm_password email
  231. subscriptions locked_pages)],
  232. header => 0,
  233. charset => "utf-8",
  234. method => 'POST',
  235. validate => {
  236. confirm_password => {
  237. perl => q{eq $form->field("password")},
  238. },
  239. email => 'EMAIL',
  240. },
  241. required => 'NONE',
  242. javascript => 0,
  243. params => $q,
  244. action => $config{cgiurl},
  245. template => (-e "$config{templatedir}/prefs.tmpl" ?
  246. {template_params("prefs.tmpl")} : ""),
  247. stylesheet => styleurl(),
  248. );
  249. my @buttons=("Save Preferences", "Logout", "Cancel");
  250. my $user_name=$session->param("name");
  251. $form->field(name => "do", type => "hidden");
  252. $form->field(name => "name", disabled => 1,
  253. value => $user_name, force => 1);
  254. $form->field(name => "password", type => "password");
  255. $form->field(name => "confirm_password", type => "password");
  256. $form->field(name => "subscriptions", size => 50,
  257. comment => "(".htmllink("", "", "GlobList", 1).")");
  258. $form->field(name => "locked_pages", size => 50,
  259. comment => "(".htmllink("", "", "GlobList", 1).")");
  260. if (! is_admin($user_name)) {
  261. $form->field(name => "locked_pages", type => "hidden");
  262. }
  263. if (! $form->submitted) {
  264. $form->field(name => "email", force => 1,
  265. value => userinfo_get($user_name, "email"));
  266. $form->field(name => "subscriptions", force => 1,
  267. value => userinfo_get($user_name, "subscriptions"));
  268. $form->field(name => "locked_pages", force => 1,
  269. value => userinfo_get($user_name, "locked_pages"));
  270. }
  271. decode_form_utf8($form);
  272. if ($form->submitted eq 'Logout') {
  273. $session->delete();
  274. redirect($q, $config{url});
  275. return;
  276. }
  277. elsif ($form->submitted eq 'Cancel') {
  278. redirect($q, $config{url});
  279. return;
  280. }
  281. elsif ($form->submitted eq "Save Preferences" && $form->validate) {
  282. foreach my $field (qw(password email subscriptions locked_pages)) {
  283. if (length $form->field($field)) {
  284. userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field");
  285. }
  286. }
  287. $form->text("Preferences saved.");
  288. }
  289. print $session->header(-charset=>'utf-8');
  290. print misctemplate($form->title, $form->render(submit => \@buttons));
  291. } #}}}
  292. sub cgi_editpage ($$) { #{{{
  293. my $q=shift;
  294. my $session=shift;
  295. eval q{use CGI::FormBuilder};
  296. my $form = CGI::FormBuilder->new(
  297. fields => [qw(do rcsinfo subpage from page type editcontent comments)],
  298. header => 1,
  299. charset => "utf-8",
  300. method => 'POST',
  301. validate => {
  302. editcontent => '/.+/',
  303. },
  304. required => [qw{editcontent}],
  305. javascript => 0,
  306. params => $q,
  307. action => $config{cgiurl},
  308. table => 0,
  309. template => {template_params("editpage.tmpl")},
  310. );
  311. my @buttons=("Save Page", "Preview", "Cancel");
  312. decode_form_utf8($form);
  313. # This untaint is safe because titlepage removes any problematic
  314. # characters.
  315. my ($page)=$form->field('page');
  316. $page=titlepage(possibly_foolish_untaint(lc($page)));
  317. if (! defined $page || ! length $page ||
  318. $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) {
  319. error("bad page name");
  320. }
  321. $page=lc($page);
  322. my $from;
  323. if (defined $form->field('from')) {
  324. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  325. }
  326. my $file;
  327. my $type;
  328. if (exists $pagesources{$page}) {
  329. $file=$pagesources{$page};
  330. $type=pagetype($file);
  331. }
  332. else {
  333. $type=$form->param('type');
  334. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  335. $type=possibly_foolish_untaint($type);
  336. }
  337. elsif (defined $from) {
  338. # favor the type of linking page
  339. $type=pagetype($pagesources{$from});
  340. }
  341. else {
  342. $type=$config{default_pageext};
  343. }
  344. $file=$page.".".$type;
  345. }
  346. my $newfile=0;
  347. if (! -e "$config{srcdir}/$file") {
  348. $newfile=1;
  349. }
  350. $form->field(name => "do", type => 'hidden');
  351. $form->field(name => "from", type => 'hidden');
  352. $form->field(name => "rcsinfo", type => 'hidden');
  353. $form->field(name => "subpage", type => 'hidden');
  354. $form->field(name => "page", value => $page, force => 1);
  355. $form->field(name => "type", value => $type, force => 1);
  356. $form->field(name => "comments", type => "text", size => 80);
  357. $form->field(name => "editcontent", type => "textarea", rows => 20,
  358. cols => 80);
  359. $form->tmpl_param("can_commit", $config{rcs});
  360. $form->tmpl_param("indexlink", indexlink());
  361. $form->tmpl_param("helponformattinglink",
  362. htmllink("", "", "HelpOnFormatting", 1));
  363. $form->tmpl_param("styleurl", styleurl());
  364. $form->tmpl_param("baseurl", "$config{url}/");
  365. if (! $form->submitted) {
  366. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  367. force => 1);
  368. }
  369. if ($form->submitted eq "Cancel") {
  370. redirect($q, "$config{url}/".htmlpage($page));
  371. return;
  372. }
  373. elsif ($form->submitted eq "Preview") {
  374. require IkiWiki::Render;
  375. my $content=$form->field('editcontent');
  376. my $comments=$form->field('comments');
  377. $form->field(name => "editcontent",
  378. value => $content, force => 1);
  379. $form->field(name => "comments",
  380. value => $comments, force => 1);
  381. $form->tmpl_param("page_preview",
  382. htmlize($type, linkify($page, $page, filter($page, $content))));
  383. }
  384. else {
  385. $form->tmpl_param("page_preview", "");
  386. }
  387. $form->tmpl_param("page_conflict", "");
  388. if (! $form->submitted || $form->submitted eq "Preview" ||
  389. ! $form->validate) {
  390. if ($form->field("do") eq "create") {
  391. my @page_locs;
  392. my $best_loc;
  393. if (! defined $from || ! length $from ||
  394. $from ne $form->field('from') ||
  395. $from=~/$config{wiki_file_prune_regexp}/ ||
  396. $from=~/^\// ||
  397. $form->submitted eq "Preview") {
  398. @page_locs=$best_loc=$page;
  399. }
  400. else {
  401. my $dir=$from."/";
  402. $dir=~s![^/]+/+$!!;
  403. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  404. $page eq 'discussion') {
  405. $best_loc="$from/$page";
  406. }
  407. else {
  408. $best_loc=$dir.$page;
  409. }
  410. push @page_locs, $dir.$page;
  411. push @page_locs, "$from/$page";
  412. while (length $dir) {
  413. $dir=~s![^/]+/+$!!;
  414. push @page_locs, $dir.$page;
  415. }
  416. }
  417. @page_locs = grep {
  418. ! exists $pagesources{lc($_)} &&
  419. ! page_locked($_, $session, 1)
  420. } @page_locs;
  421. if (! @page_locs) {
  422. # hmm, someone else made the page in the
  423. # meantime?
  424. redirect($q, "$config{url}/".htmlpage($page));
  425. return;
  426. }
  427. my @page_types;
  428. if (exists $hooks{htmlize}) {
  429. @page_types=keys %{$hooks{htmlize}};
  430. }
  431. $form->tmpl_param("page_select", 1);
  432. $form->field(name => "page", type => 'select',
  433. options => \@page_locs, value => $best_loc);
  434. $form->field(name => "type", type => 'select',
  435. options => \@page_types);
  436. $form->title("creating ".pagetitle($page));
  437. }
  438. elsif ($form->field("do") eq "edit") {
  439. page_locked($page, $session);
  440. if (! defined $form->field('editcontent') ||
  441. ! length $form->field('editcontent')) {
  442. my $content="";
  443. if (exists $pagesources{lc($page)}) {
  444. $content=readfile(srcfile($pagesources{lc($page)}));
  445. $content=~s/\n/\r\n/g;
  446. }
  447. $form->field(name => "editcontent", value => $content,
  448. force => 1);
  449. }
  450. $form->tmpl_param("page_select", 0);
  451. $form->field(name => "page", type => 'hidden');
  452. $form->field(name => "type", type => 'hidden');
  453. $form->title("editing ".pagetitle($page));
  454. }
  455. print $form->render(submit => \@buttons);
  456. }
  457. else {
  458. # save page
  459. page_locked($page, $session);
  460. my $content=$form->field('editcontent');
  461. $content=~s/\r\n/\n/g;
  462. $content=~s/\r/\n/g;
  463. writefile($file, $config{srcdir}, $content);
  464. my $message="web commit ";
  465. if (defined $session->param("name") &&
  466. length $session->param("name")) {
  467. $message.="by ".$session->param("name");
  468. }
  469. else {
  470. $message.="from $ENV{REMOTE_ADDR}";
  471. }
  472. if (defined $form->field('comments') &&
  473. length $form->field('comments')) {
  474. $message.=": ".$form->field('comments');
  475. }
  476. if ($config{rcs}) {
  477. if ($newfile) {
  478. rcs_add($file);
  479. }
  480. # prevent deadlock with post-commit hook
  481. unlockwiki();
  482. # presumably the commit will trigger an update
  483. # of the wiki
  484. my $conflict=rcs_commit($file, $message,
  485. $form->field("rcsinfo"));
  486. if (defined $conflict) {
  487. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  488. force => 1);
  489. $form->tmpl_param("page_conflict", 1);
  490. $form->field("editcontent", value => $conflict, force => 1);
  491. $form->field(name => "comments", value => $form->field('comments'), force => 1);
  492. $form->field("do", "edit)");
  493. $form->tmpl_param("page_select", 0);
  494. $form->field(name => "page", type => 'hidden');
  495. $form->field(name => "type", type => 'hidden');
  496. $form->title("editing $page");
  497. print $form->render(submit => \@buttons);
  498. return;
  499. }
  500. }
  501. else {
  502. require IkiWiki::Render;
  503. refresh();
  504. saveindex();
  505. }
  506. # The trailing question mark tries to avoid broken
  507. # caches and get the most recent version of the page.
  508. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  509. }
  510. } #}}}
  511. sub cgi () { #{{{
  512. eval q{use CGI};
  513. eval q{use CGI::Session};
  514. my $q=CGI->new;
  515. if (exists $hooks{cgi}) {
  516. foreach my $id (keys %{$hooks{cgi}}) {
  517. $hooks{cgi}{$id}{call}->($q);
  518. }
  519. }
  520. my $do=$q->param('do');
  521. if (! defined $do || ! length $do) {
  522. my $error = $q->cgi_error;
  523. if ($error) {
  524. error("Request not processed: $error");
  525. }
  526. else {
  527. error("\"do\" parameter missing");
  528. }
  529. }
  530. # Things that do not need a session.
  531. if ($do eq 'recentchanges') {
  532. cgi_recentchanges($q);
  533. return;
  534. }
  535. elsif ($do eq 'hyperestraier') {
  536. cgi_hyperestraier();
  537. }
  538. CGI::Session->name("ikiwiki_session_$config{wikiname}");
  539. my $oldmask=umask(077);
  540. my $session = CGI::Session->new("driver:DB_File", $q,
  541. { FileName => "$config{wikistatedir}/sessions.db" });
  542. umask($oldmask);
  543. # Everything below this point needs the user to be signed in.
  544. if ((! $config{anonok} &&
  545. (! defined $session->param("name") ||
  546. ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
  547. cgi_signin($q, $session);
  548. # Force session flush with safe umask.
  549. my $oldmask=umask(077);
  550. $session->flush;
  551. umask($oldmask);
  552. return;
  553. }
  554. if ($do eq 'create' || $do eq 'edit') {
  555. cgi_editpage($q, $session);
  556. }
  557. elsif ($do eq 'prefs') {
  558. cgi_prefs($q, $session);
  559. }
  560. elsif ($do eq 'blog') {
  561. my $page=titlepage(lc($q->param('title')));
  562. # if the page already exists, munge it to be unique
  563. my $from=$q->param('from');
  564. my $add="";
  565. while (exists $oldpagemtime{"$from/$page$add"}) {
  566. $add=1 unless length $add;
  567. $add++;
  568. }
  569. $q->param('page', $page.$add);
  570. # now run same as create
  571. $q->param('do', 'create');
  572. cgi_editpage($q, $session);
  573. }
  574. else {
  575. error("unknown do parameter");
  576. }
  577. } #}}}
  578. 1