summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 15e86651d419f64e4b8e48dd5797feaafe8057ef (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. package IkiWiki;
  7. sub page_locked ($$;$) { #{{{
  8. my $page=shift;
  9. my $session=shift;
  10. my $nonfatal=shift;
  11. my $user=$session->param("name");
  12. return if defined $user && is_admin($user);
  13. foreach my $admin (@{$config{adminuser}}) {
  14. my $locked_pages=userinfo_get($admin, "locked_pages");
  15. if (globlist_match($page, userinfo_get($admin, "locked_pages"))) {
  16. return 1 if $nonfatal;
  17. error(htmllink("", $page, 1)." is locked by ".
  18. htmllink("", $admin, 1)." and cannot be edited.");
  19. }
  20. }
  21. return 0;
  22. } #}}}
  23. sub cgi_recentchanges ($) { #{{{
  24. my $q=shift;
  25. unlockwiki();
  26. my $template=HTML::Template->new(
  27. filename => "$config{templatedir}/recentchanges.tmpl"
  28. );
  29. $template->param(
  30. title => "RecentChanges",
  31. indexlink => indexlink(),
  32. wikiname => $config{wikiname},
  33. changelog => [rcs_recentchanges(100)],
  34. styleurl => styleurl(),
  35. baseurl => "$config{url}/",
  36. );
  37. print $q->header, $template->output;
  38. } #}}}
  39. sub cgi_signin ($$) { #{{{
  40. my $q=shift;
  41. my $session=shift;
  42. eval q{use CGI::FormBuilder};
  43. my $form = CGI::FormBuilder->new(
  44. title => "signin",
  45. fields => [qw(do title page subpage from name password confirm_password email)],
  46. header => 1,
  47. method => 'POST',
  48. validate => {
  49. confirm_password => {
  50. perl => q{eq $form->field("password")},
  51. },
  52. email => 'EMAIL',
  53. },
  54. required => 'NONE',
  55. javascript => 0,
  56. params => $q,
  57. action => $config{cgiurl},
  58. header => 0,
  59. template => (-e "$config{templatedir}/signin.tmpl" ?
  60. "$config{templatedir}/signin.tmpl" : ""),
  61. stylesheet => styleurl(),
  62. );
  63. $form->field(name => "name", required => 0);
  64. $form->field(name => "do", type => "hidden");
  65. $form->field(name => "page", type => "hidden");
  66. $form->field(name => "title", type => "hidden");
  67. $form->field(name => "from", type => "hidden");
  68. $form->field(name => "subpage", type => "hidden");
  69. $form->field(name => "password", type => "password", required => 0);
  70. $form->field(name => "confirm_password", type => "password", required => 0);
  71. $form->field(name => "email", required => 0);
  72. if ($q->param("do") ne "signin") {
  73. $form->text("You need to log in first.");
  74. }
  75. if ($form->submitted) {
  76. # Set required fields based on how form was submitted.
  77. my %required=(
  78. "Login" => [qw(name password)],
  79. "Register" => [qw(name password confirm_password email)],
  80. "Mail Password" => [qw(name)],
  81. );
  82. foreach my $opt (@{$required{$form->submitted}}) {
  83. $form->field(name => $opt, required => 1);
  84. }
  85. # Validate password differently depending on how
  86. # form was submitted.
  87. if ($form->submitted eq 'Login') {
  88. $form->field(
  89. name => "password",
  90. validate => sub {
  91. length $form->field("name") &&
  92. shift eq userinfo_get($form->field("name"), 'password');
  93. },
  94. );
  95. $form->field(name => "name", validate => '/^\w+$/');
  96. }
  97. else {
  98. $form->field(name => "password", validate => 'VALUE');
  99. }
  100. # And make sure the entered name exists when logging
  101. # in or sending email, and does not when registering.
  102. if ($form->submitted eq 'Register') {
  103. $form->field(
  104. name => "name",
  105. validate => sub {
  106. my $name=shift;
  107. length $name &&
  108. $name=~/$config{wiki_file_regexp}/ &&
  109. ! userinfo_get($name, "regdate");
  110. },
  111. );
  112. }
  113. else {
  114. $form->field(
  115. name => "name",
  116. validate => sub {
  117. my $name=shift;
  118. length $name &&
  119. userinfo_get($name, "regdate");
  120. },
  121. );
  122. }
  123. }
  124. else {
  125. # First time settings.
  126. $form->field(name => "name", comment => "use FirstnameLastName");
  127. $form->field(name => "confirm_password", comment => "(only needed");
  128. $form->field(name => "email", comment => "for registration)");
  129. if ($session->param("name")) {
  130. $form->field(name => "name", value => $session->param("name"));
  131. }
  132. }
  133. if ($form->submitted && $form->validate) {
  134. if ($form->submitted eq 'Login') {
  135. $session->param("name", $form->field("name"));
  136. if (defined $form->field("do") &&
  137. $form->field("do") ne 'signin') {
  138. print $q->redirect(cgiurl(
  139. do => $form->field("do"),
  140. page => $form->field("page"),
  141. title => $form->field("title"),
  142. subpage => $form->field("subpage"),
  143. from => $form->field("from"),
  144. ));
  145. }
  146. else {
  147. print $q->redirect($config{url});
  148. }
  149. }
  150. elsif ($form->submitted eq 'Register') {
  151. my $user_name=$form->field('name');
  152. if (userinfo_setall($user_name, {
  153. 'email' => $form->field('email'),
  154. 'password' => $form->field('password'),
  155. 'regdate' => time
  156. })) {
  157. $form->field(name => "confirm_password", type => "hidden");
  158. $form->field(name => "email", type => "hidden");
  159. $form->text("Registration successful. Now you can Login.");
  160. print $session->header();
  161. print misctemplate($form->title, $form->render(submit => ["Login"]));
  162. }
  163. else {
  164. error("Error saving registration.");
  165. }
  166. }
  167. elsif ($form->submitted eq 'Mail Password') {
  168. my $user_name=$form->field("name");
  169. my $template=HTML::Template->new(
  170. filename => "$config{templatedir}/passwordmail.tmpl"
  171. );
  172. $template->param(
  173. user_name => $user_name,
  174. user_password => userinfo_get($user_name, "password"),
  175. wikiurl => $config{url},
  176. wikiname => $config{wikiname},
  177. REMOTE_ADDR => $ENV{REMOTE_ADDR},
  178. );
  179. eval q{use Mail::Sendmail};
  180. sendmail(
  181. To => userinfo_get($user_name, "email"),
  182. From => "$config{wikiname} admin <$config{adminemail}>",
  183. Subject => "$config{wikiname} information",
  184. Message => $template->output,
  185. ) or error("Failed to send mail");
  186. $form->text("Your password has been emailed to you.");
  187. $form->field(name => "name", required => 0);
  188. print $session->header();
  189. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  190. }
  191. }
  192. else {
  193. print $session->header();
  194. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  195. }
  196. } #}}}
  197. sub cgi_prefs ($$) { #{{{
  198. my $q=shift;
  199. my $session=shift;
  200. eval q{use CGI::FormBuilder};
  201. my $form = CGI::FormBuilder->new(
  202. title => "preferences",
  203. fields => [qw(do name password confirm_password email
  204. subscriptions locked_pages)],
  205. header => 0,
  206. method => 'POST',
  207. validate => {
  208. confirm_password => {
  209. perl => q{eq $form->field("password")},
  210. },
  211. email => 'EMAIL',
  212. },
  213. required => 'NONE',
  214. javascript => 0,
  215. params => $q,
  216. action => $config{cgiurl},
  217. template => (-e "$config{templatedir}/prefs.tmpl" ?
  218. "$config{templatedir}/prefs.tmpl" : ""),
  219. stylesheet => styleurl(),
  220. );
  221. my @buttons=("Save Preferences", "Logout", "Cancel");
  222. my $user_name=$session->param("name");
  223. $form->field(name => "do", type => "hidden");
  224. $form->field(name => "name", disabled => 1,
  225. value => $user_name, force => 1);
  226. $form->field(name => "password", type => "password");
  227. $form->field(name => "confirm_password", type => "password");
  228. $form->field(name => "subscriptions", size => 50,
  229. comment => "(".htmllink("", "GlobList", 1).")");
  230. $form->field(name => "locked_pages", size => 50,
  231. comment => "(".htmllink("", "GlobList", 1).")");
  232. if (! is_admin($user_name)) {
  233. $form->field(name => "locked_pages", type => "hidden");
  234. }
  235. if (! $form->submitted) {
  236. $form->field(name => "email", force => 1,
  237. value => userinfo_get($user_name, "email"));
  238. $form->field(name => "subscriptions", force => 1,
  239. value => userinfo_get($user_name, "subscriptions"));
  240. $form->field(name => "locked_pages", force => 1,
  241. value => userinfo_get($user_name, "locked_pages"));
  242. }
  243. if ($form->submitted eq 'Logout') {
  244. $session->delete();
  245. print $q->redirect($config{url});
  246. return;
  247. }
  248. elsif ($form->submitted eq 'Cancel') {
  249. print $q->redirect($config{url});
  250. return;
  251. }
  252. elsif ($form->submitted eq "Save Preferences" && $form->validate) {
  253. foreach my $field (qw(password email subscriptions locked_pages)) {
  254. if (length $form->field($field)) {
  255. userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field");
  256. }
  257. }
  258. $form->text("Preferences saved.");
  259. }
  260. print $session->header();
  261. print misctemplate($form->title, $form->render(submit => \@buttons));
  262. } #}}}
  263. sub cgi_editpage ($$) { #{{{
  264. my $q=shift;
  265. my $session=shift;
  266. eval q{use CGI::FormBuilder};
  267. my $form = CGI::FormBuilder->new(
  268. fields => [qw(do rcsinfo subpage from page content comments)],
  269. header => 1,
  270. method => 'POST',
  271. validate => {
  272. content => '/.+/',
  273. },
  274. required => [qw{content}],
  275. javascript => 0,
  276. params => $q,
  277. action => $config{cgiurl},
  278. table => 0,
  279. template => "$config{templatedir}/editpage.tmpl"
  280. );
  281. my @buttons=("Save Page", "Preview", "Cancel");
  282. # This untaint is safe because titlepage removes any problimatic
  283. # characters.
  284. my ($page)=titlepage(possibly_foolish_untaint(lc($form->param('page'))));
  285. if (! defined $page || ! length $page ||
  286. $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) {
  287. error("bad page name");
  288. }
  289. $page=lc($page);
  290. my $file=$page.$config{default_pageext};
  291. if (exists $pagesources{lc($page)}) {
  292. $file=$pagesources{lc($page)};
  293. }
  294. my $newfile=0;
  295. if (! -e "$config{srcdir}/$file") {
  296. $newfile=1;
  297. }
  298. $form->field(name => "do", type => 'hidden');
  299. $form->field(name => "from", type => 'hidden');
  300. $form->field(name => "rcsinfo", type => 'hidden');
  301. $form->field(name => "subpage", type => 'hidden');
  302. $form->field(name => "page", value => "$page", force => 1);
  303. $form->field(name => "comments", type => "text", size => 80);
  304. $form->field(name => "content", type => "textarea", rows => 20,
  305. cols => 80);
  306. $form->tmpl_param("can_commit", $config{rcs});
  307. $form->tmpl_param("indexlink", indexlink());
  308. $form->tmpl_param("helponformattinglink",
  309. htmllink("", "HelpOnFormatting", 1));
  310. $form->tmpl_param("styleurl", styleurl());
  311. $form->tmpl_param("baseurl", "$config{url}/");
  312. if (! $form->submitted) {
  313. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  314. force => 1);
  315. }
  316. if ($form->submitted eq "Cancel") {
  317. print $q->redirect("$config{url}/".htmlpage($page));
  318. return;
  319. }
  320. elsif ($form->submitted eq "Preview") {
  321. require IkiWiki::Render;
  322. $form->tmpl_param("page_preview",
  323. htmlize($config{default_pageext},
  324. linkify($form->field('content'), $page)));
  325. }
  326. else {
  327. $form->tmpl_param("page_preview", "");
  328. }
  329. $form->tmpl_param("page_conflict", "");
  330. if (! $form->submitted || $form->submitted eq "Preview" ||
  331. ! $form->validate) {
  332. if ($form->field("do") eq "create") {
  333. my @page_locs;
  334. my $best_loc;
  335. my ($from)=$form->param('from')=~/$config{wiki_file_regexp}/;
  336. if (! defined $from || ! length $from ||
  337. $from ne $form->param('from') ||
  338. $from=~/$config{wiki_file_prune_regexp}/ ||
  339. $from=~/^\// ||
  340. $form->submitted eq "Preview") {
  341. @page_locs=$best_loc=$page;
  342. }
  343. else {
  344. my $dir=$from."/";
  345. $dir=~s![^/]+/+$!!;
  346. if ((defined $form->param('subpage') && length $form->param('subpage')) ||
  347. $page eq 'discussion') {
  348. $best_loc="$from/$page";
  349. }
  350. else {
  351. $best_loc=$dir.$page;
  352. }
  353. push @page_locs, $dir.$page;
  354. push @page_locs, "$from/$page";
  355. while (length $dir) {
  356. $dir=~s![^/]+/+$!!;
  357. push @page_locs, $dir.$page;
  358. }
  359. }
  360. @page_locs = grep {
  361. ! exists $pagesources{lc($_)} &&
  362. ! page_locked($_, $session, 1)
  363. } @page_locs;
  364. if (! @page_locs) {
  365. # hmm, someone else made the page in the
  366. # meantime?
  367. print $q->redirect("$config{url}/".htmlpage($page));
  368. return;
  369. }
  370. $form->tmpl_param("page_select", 1);
  371. $form->field(name => "page", type => 'select',
  372. options => \@page_locs, value => $best_loc);
  373. $form->title("creating ".pagetitle($page));
  374. }
  375. elsif ($form->field("do") eq "edit") {
  376. page_locked($page, $session);
  377. if (! defined $form->field('content') ||
  378. ! length $form->field('content')) {
  379. my $content="";
  380. if (exists $pagesources{lc($page)}) {
  381. $content=readfile(srcfile($pagesources{lc($page)}));
  382. $content=~s/\n/\r\n/g;
  383. }
  384. $form->field(name => "content", value => $content,
  385. force => 1);
  386. }
  387. $form->tmpl_param("page_select", 0);
  388. $form->field(name => "page", type => 'hidden');
  389. $form->title("editing ".pagetitle($page));
  390. }
  391. print $form->render(submit => \@buttons);
  392. }
  393. else {
  394. # save page
  395. page_locked($page, $session);
  396. my $content=$form->field('content');
  397. $content=~s/\r\n/\n/g;
  398. $content=~s/\r/\n/g;
  399. writefile($file, $config{srcdir}, $content);
  400. my $message="web commit ";
  401. if (length $session->param("name")) {
  402. $message.="by ".$session->param("name");
  403. }
  404. else {
  405. $message.="from $ENV{REMOTE_ADDR}";
  406. }
  407. if (defined $form->field('comments') &&
  408. length $form->field('comments')) {
  409. $message.=": ".$form->field('comments');
  410. }
  411. if ($config{rcs}) {
  412. if ($newfile) {
  413. rcs_add($file);
  414. }
  415. # prevent deadlock with post-commit hook
  416. unlockwiki();
  417. # presumably the commit will trigger an update
  418. # of the wiki
  419. my $conflict=rcs_commit($file, $message,
  420. $form->field("rcsinfo"));
  421. if (defined $conflict) {
  422. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  423. force => 1);
  424. $form->tmpl_param("page_conflict", 1);
  425. $form->field("content", value => $conflict, force => 1);
  426. $form->field("do", "edit)");
  427. $form->tmpl_param("page_select", 0);
  428. $form->field(name => "page", type => 'hidden');
  429. $form->title("editing $page");
  430. print $form->render(submit => \@buttons);
  431. return;
  432. }
  433. }
  434. else {
  435. require IkiWiki::Render;
  436. refresh();
  437. saveindex();
  438. }
  439. # The trailing question mark tries to avoid broken
  440. # caches and get the most recent version of the page.
  441. print $q->redirect("$config{url}/".htmlpage($page)."?updated");
  442. }
  443. } #}}}
  444. sub cgi () { #{{{
  445. eval q{use CGI};
  446. eval q{use CGI::Session};
  447. my $q=CGI->new;
  448. if (exists $hooks{cgi}) {
  449. foreach my $id (keys %{$hooks{cgi}}) {
  450. $hooks{cgi}{$id}{call}->($q);
  451. }
  452. }
  453. my $do=$q->param('do');
  454. if (! defined $do || ! length $do) {
  455. error("\"do\" parameter missing");
  456. }
  457. # Things that do not need a session.
  458. if ($do eq 'recentchanges') {
  459. cgi_recentchanges($q);
  460. return;
  461. }
  462. elsif ($do eq 'hyperestraier') {
  463. cgi_hyperestraier();
  464. }
  465. CGI::Session->name("ikiwiki_session_$config{wikiname}");
  466. my $oldmask=umask(077);
  467. my $session = CGI::Session->new("driver:DB_File", $q,
  468. { FileName => "$config{wikistatedir}/sessions.db" });
  469. umask($oldmask);
  470. # Everything below this point needs the user to be signed in.
  471. if ((! $config{anonok} &&
  472. (! defined $session->param("name") ||
  473. ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
  474. cgi_signin($q, $session);
  475. # Force session flush with safe umask.
  476. my $oldmask=umask(077);
  477. $session->flush;
  478. umask($oldmask);
  479. return;
  480. }
  481. if ($do eq 'create' || $do eq 'edit') {
  482. cgi_editpage($q, $session);
  483. }
  484. elsif ($do eq 'prefs') {
  485. cgi_prefs($q, $session);
  486. }
  487. elsif ($do eq 'blog') {
  488. my $page=titlepage(lc($q->param('title')));
  489. # if the page already exists, munge it to be unique
  490. my $from=$q->param('from');
  491. my $add="";
  492. while (exists $oldpagemtime{"$from/$page$add"}) {
  493. $add=1 unless length $add;
  494. $add++;
  495. }
  496. $q->param('page', $page.$add);
  497. # now run same as create
  498. $q->param('do', 'create');
  499. cgi_editpage($q, $session);
  500. }
  501. else {
  502. error("unknown do parameter");
  503. }
  504. } #}}}
  505. 1