summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: d9c9fe82896c8f5a52490ccb7be3147684ace455 (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use encoding 'utf8'; # force use of utf8 for io layer
  7. package IkiWiki;
  8. sub page_locked ($$;$) { #{{{
  9. my $page=shift;
  10. my $session=shift;
  11. my $nonfatal=shift;
  12. my $user=$session->param("name");
  13. return if defined $user && is_admin($user);
  14. foreach my $admin (@{$config{adminuser}}) {
  15. my $locked_pages=userinfo_get($admin, "locked_pages");
  16. if (globlist_match($page, userinfo_get($admin, "locked_pages"))) {
  17. return 1 if $nonfatal;
  18. error(htmllink("", "", $page, 1)." is locked by ".
  19. htmllink("", "", $admin, 1)." and cannot be edited.");
  20. }
  21. }
  22. return 0;
  23. } #}}}
  24. sub cgi_recentchanges ($) { #{{{
  25. my $q=shift;
  26. unlockwiki();
  27. # Force reading the template as utf-8, necessary if
  28. # rcs_recentchanges returns true utf-8 strings.
  29. open(TMPL, "<:utf8", "$config{templatedir}/recentchanges.tmpl");
  30. my $template=HTML::Template->new(filehandle => *TMPL);
  31. close(TMPL);
  32. my $template=HTML::Template->new(
  33. filename => "$config{templatedir}/recentchanges.tmpl"
  34. );
  35. $template->param(
  36. title => "RecentChanges",
  37. indexlink => indexlink(),
  38. wikiname => $config{wikiname},
  39. changelog => [rcs_recentchanges(100)],
  40. styleurl => styleurl(),
  41. baseurl => "$config{url}/",
  42. );
  43. print $q->header(-charset=>'utf-8'), $template->output;
  44. } #}}}
  45. sub cgi_signin ($$) { #{{{
  46. my $q=shift;
  47. my $session=shift;
  48. eval q{use CGI::FormBuilder};
  49. my $form = CGI::FormBuilder->new(
  50. title => "signin",
  51. fields => [qw(do title page subpage from name password confirm_password email)],
  52. header => 1,
  53. charset => "utf-8",
  54. method => 'POST',
  55. validate => {
  56. confirm_password => {
  57. perl => q{eq $form->field("password")},
  58. },
  59. email => 'EMAIL',
  60. },
  61. required => 'NONE',
  62. javascript => 0,
  63. params => $q,
  64. action => $config{cgiurl},
  65. header => 0,
  66. template => (-e "$config{templatedir}/signin.tmpl" ?
  67. "$config{templatedir}/signin.tmpl" : ""),
  68. stylesheet => styleurl(),
  69. );
  70. $form->field(name => "name", required => 0);
  71. $form->field(name => "do", type => "hidden");
  72. $form->field(name => "page", type => "hidden");
  73. $form->field(name => "title", type => "hidden");
  74. $form->field(name => "from", type => "hidden");
  75. $form->field(name => "subpage", type => "hidden");
  76. $form->field(name => "password", type => "password", required => 0);
  77. $form->field(name => "confirm_password", type => "password", required => 0);
  78. $form->field(name => "email", required => 0);
  79. if ($q->param("do") ne "signin") {
  80. $form->text("You need to log in first.");
  81. }
  82. if ($form->submitted) {
  83. # Set required fields based on how form was submitted.
  84. my %required=(
  85. "Login" => [qw(name password)],
  86. "Register" => [qw(name password confirm_password email)],
  87. "Mail Password" => [qw(name)],
  88. );
  89. foreach my $opt (@{$required{$form->submitted}}) {
  90. $form->field(name => $opt, required => 1);
  91. }
  92. # Validate password differently depending on how
  93. # form was submitted.
  94. if ($form->submitted eq 'Login') {
  95. $form->field(
  96. name => "password",
  97. validate => sub {
  98. length $form->field("name") &&
  99. shift eq userinfo_get($form->field("name"), 'password');
  100. },
  101. );
  102. $form->field(name => "name", validate => '/^\w+$/');
  103. }
  104. else {
  105. $form->field(name => "password", validate => 'VALUE');
  106. }
  107. # And make sure the entered name exists when logging
  108. # in or sending email, and does not when registering.
  109. if ($form->submitted eq 'Register') {
  110. $form->field(
  111. name => "name",
  112. validate => sub {
  113. my $name=shift;
  114. length $name &&
  115. $name=~/$config{wiki_file_regexp}/ &&
  116. ! userinfo_get($name, "regdate");
  117. },
  118. );
  119. }
  120. else {
  121. $form->field(
  122. name => "name",
  123. validate => sub {
  124. my $name=shift;
  125. length $name &&
  126. userinfo_get($name, "regdate");
  127. },
  128. );
  129. }
  130. }
  131. else {
  132. # First time settings.
  133. $form->field(name => "name", comment => "use FirstnameLastName");
  134. $form->field(name => "confirm_password", comment => "(only needed");
  135. $form->field(name => "email", comment => "for registration)");
  136. if ($session->param("name")) {
  137. $form->field(name => "name", value => $session->param("name"));
  138. }
  139. }
  140. if ($form->submitted && $form->validate) {
  141. if ($form->submitted eq 'Login') {
  142. $session->param("name", $form->field("name"));
  143. if (defined $form->field("do") &&
  144. $form->field("do") ne 'signin') {
  145. print $q->redirect(cgiurl(
  146. do => $form->field("do"),
  147. page => $form->field("page"),
  148. title => $form->field("title"),
  149. subpage => $form->field("subpage"),
  150. from => $form->field("from"),
  151. ));
  152. }
  153. else {
  154. print $q->redirect($config{url});
  155. }
  156. }
  157. elsif ($form->submitted eq 'Register') {
  158. my $user_name=$form->field('name');
  159. if (userinfo_setall($user_name, {
  160. 'email' => $form->field('email'),
  161. 'password' => $form->field('password'),
  162. 'regdate' => time
  163. })) {
  164. $form->field(name => "confirm_password", type => "hidden");
  165. $form->field(name => "email", type => "hidden");
  166. $form->text("Registration successful. Now you can Login.");
  167. print $session->header(-charset=>'utf-8');
  168. print misctemplate($form->title, $form->render(submit => ["Login"]));
  169. }
  170. else {
  171. error("Error saving registration.");
  172. }
  173. }
  174. elsif ($form->submitted eq 'Mail Password') {
  175. my $user_name=$form->field("name");
  176. my $template=HTML::Template->new(
  177. filename => "$config{templatedir}/passwordmail.tmpl"
  178. );
  179. $template->param(
  180. user_name => $user_name,
  181. user_password => userinfo_get($user_name, "password"),
  182. wikiurl => $config{url},
  183. wikiname => $config{wikiname},
  184. REMOTE_ADDR => $ENV{REMOTE_ADDR},
  185. );
  186. eval q{use Mail::Sendmail};
  187. sendmail(
  188. To => userinfo_get($user_name, "email"),
  189. From => "$config{wikiname} admin <$config{adminemail}>",
  190. Subject => "$config{wikiname} information",
  191. Message => $template->output,
  192. ) or error("Failed to send mail");
  193. $form->text("Your password has been emailed to you.");
  194. $form->field(name => "name", required => 0);
  195. print $session->header(-charset=>'utf-8');
  196. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  197. }
  198. }
  199. else {
  200. print $session->header(-charset=>'utf-8');
  201. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  202. }
  203. } #}}}
  204. sub cgi_prefs ($$) { #{{{
  205. my $q=shift;
  206. my $session=shift;
  207. eval q{use CGI::FormBuilder};
  208. my $form = CGI::FormBuilder->new(
  209. title => "preferences",
  210. fields => [qw(do name password confirm_password email
  211. subscriptions locked_pages)],
  212. header => 0,
  213. charset => "utf-8",
  214. method => 'POST',
  215. validate => {
  216. confirm_password => {
  217. perl => q{eq $form->field("password")},
  218. },
  219. email => 'EMAIL',
  220. },
  221. required => 'NONE',
  222. javascript => 0,
  223. params => $q,
  224. action => $config{cgiurl},
  225. template => (-e "$config{templatedir}/prefs.tmpl" ?
  226. "$config{templatedir}/prefs.tmpl" : ""),
  227. stylesheet => styleurl(),
  228. );
  229. my @buttons=("Save Preferences", "Logout", "Cancel");
  230. my $user_name=$session->param("name");
  231. $form->field(name => "do", type => "hidden");
  232. $form->field(name => "name", disabled => 1,
  233. value => $user_name, force => 1);
  234. $form->field(name => "password", type => "password");
  235. $form->field(name => "confirm_password", type => "password");
  236. $form->field(name => "subscriptions", size => 50,
  237. comment => "(".htmllink("", "", "GlobList", 1).")");
  238. $form->field(name => "locked_pages", size => 50,
  239. comment => "(".htmllink("", "", "GlobList", 1).")");
  240. if (! is_admin($user_name)) {
  241. $form->field(name => "locked_pages", type => "hidden");
  242. }
  243. if (! $form->submitted) {
  244. $form->field(name => "email", force => 1,
  245. value => userinfo_get($user_name, "email"));
  246. $form->field(name => "subscriptions", force => 1,
  247. value => userinfo_get($user_name, "subscriptions"));
  248. $form->field(name => "locked_pages", force => 1,
  249. value => userinfo_get($user_name, "locked_pages"));
  250. }
  251. if ($form->submitted eq 'Logout') {
  252. $session->delete();
  253. print $q->redirect($config{url});
  254. return;
  255. }
  256. elsif ($form->submitted eq 'Cancel') {
  257. print $q->redirect($config{url});
  258. return;
  259. }
  260. elsif ($form->submitted eq "Save Preferences" && $form->validate) {
  261. foreach my $field (qw(password email subscriptions locked_pages)) {
  262. if (length $form->field($field)) {
  263. userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field");
  264. }
  265. }
  266. $form->text("Preferences saved.");
  267. }
  268. print $session->header(-charset=>'utf-8');
  269. print misctemplate($form->title, $form->render(submit => \@buttons));
  270. } #}}}
  271. sub cgi_editpage ($$) { #{{{
  272. my $q=shift;
  273. my $session=shift;
  274. eval q{use CGI::FormBuilder};
  275. my $form = CGI::FormBuilder->new(
  276. fields => [qw(do rcsinfo subpage from page editcontent comments)],
  277. header => 1,
  278. charset => "utf-8",
  279. method => 'POST',
  280. validate => {
  281. editcontent => '/.+/',
  282. },
  283. required => [qw{editcontent}],
  284. javascript => 0,
  285. params => $q,
  286. action => $config{cgiurl},
  287. table => 0,
  288. template => "$config{templatedir}/editpage.tmpl"
  289. );
  290. my @buttons=("Save Page", "Preview", "Cancel");
  291. # This untaint is safe because titlepage removes any problimatic
  292. # characters.
  293. my ($page)=titlepage(possibly_foolish_untaint(lc($form->param('page'))));
  294. if (! defined $page || ! length $page ||
  295. $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) {
  296. error("bad page name");
  297. }
  298. $page=lc($page);
  299. my $file=$page.$config{default_pageext};
  300. if (exists $pagesources{lc($page)}) {
  301. $file=$pagesources{lc($page)};
  302. }
  303. my $newfile=0;
  304. if (! -e "$config{srcdir}/$file") {
  305. $newfile=1;
  306. }
  307. $form->field(name => "do", type => 'hidden');
  308. $form->field(name => "from", type => 'hidden');
  309. $form->field(name => "rcsinfo", type => 'hidden');
  310. $form->field(name => "subpage", type => 'hidden');
  311. $form->field(name => "page", value => "$page", force => 1);
  312. $form->field(name => "comments", type => "text", size => 80);
  313. $form->field(name => "editcontent", type => "textarea", rows => 20,
  314. cols => 80);
  315. $form->tmpl_param("can_commit", $config{rcs});
  316. $form->tmpl_param("indexlink", indexlink());
  317. $form->tmpl_param("helponformattinglink",
  318. htmllink("", "", "HelpOnFormatting", 1));
  319. $form->tmpl_param("styleurl", styleurl());
  320. $form->tmpl_param("baseurl", "$config{url}/");
  321. if (! $form->submitted) {
  322. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  323. force => 1);
  324. }
  325. if ($form->submitted eq "Cancel") {
  326. print $q->redirect("$config{url}/".htmlpage($page));
  327. return;
  328. }
  329. elsif ($form->submitted eq "Preview") {
  330. require IkiWiki::Render;
  331. # Apparently FormBuilder doesn't not treat input as
  332. # utf-8, so decode from it.
  333. require Encode;
  334. my $content = Encode::decode_utf8($form->field('editcontent'));
  335. $form->field(name => "editcontent",
  336. value => $content, force => 1);
  337. $form->field(name => "comments",
  338. value => Encode::decode_utf8($form->field('comments')), force => 1);
  339. $form->tmpl_param("page_preview",
  340. htmlize($config{default_pageext},
  341. linkify($page, $page, $content)));
  342. }
  343. else {
  344. $form->tmpl_param("page_preview", "");
  345. }
  346. $form->tmpl_param("page_conflict", "");
  347. if (! $form->submitted || $form->submitted eq "Preview" ||
  348. ! $form->validate) {
  349. if ($form->field("do") eq "create") {
  350. my @page_locs;
  351. my $best_loc;
  352. my ($from)=$form->param('from')=~/$config{wiki_file_regexp}/;
  353. if (! defined $from || ! length $from ||
  354. $from ne $form->param('from') ||
  355. $from=~/$config{wiki_file_prune_regexp}/ ||
  356. $from=~/^\// ||
  357. $form->submitted eq "Preview") {
  358. @page_locs=$best_loc=$page;
  359. }
  360. else {
  361. my $dir=$from."/";
  362. $dir=~s![^/]+/+$!!;
  363. if ((defined $form->param('subpage') && length $form->param('subpage')) ||
  364. $page eq 'discussion') {
  365. $best_loc="$from/$page";
  366. }
  367. else {
  368. $best_loc=$dir.$page;
  369. }
  370. push @page_locs, $dir.$page;
  371. push @page_locs, "$from/$page";
  372. while (length $dir) {
  373. $dir=~s![^/]+/+$!!;
  374. push @page_locs, $dir.$page;
  375. }
  376. }
  377. @page_locs = grep {
  378. ! exists $pagesources{lc($_)} &&
  379. ! page_locked($_, $session, 1)
  380. } @page_locs;
  381. if (! @page_locs) {
  382. # hmm, someone else made the page in the
  383. # meantime?
  384. print $q->redirect("$config{url}/".htmlpage($page));
  385. return;
  386. }
  387. $form->tmpl_param("page_select", 1);
  388. $form->field(name => "page", type => 'select',
  389. options => \@page_locs, value => $best_loc);
  390. $form->title("creating ".pagetitle($page));
  391. }
  392. elsif ($form->field("do") eq "edit") {
  393. page_locked($page, $session);
  394. if (! defined $form->field('editcontent') ||
  395. ! length $form->field('editcontent')) {
  396. my $content="";
  397. if (exists $pagesources{lc($page)}) {
  398. $content=readfile(srcfile($pagesources{lc($page)}));
  399. $content=~s/\n/\r\n/g;
  400. }
  401. $form->field(name => "editcontent", value => $content,
  402. force => 1);
  403. }
  404. $form->tmpl_param("page_select", 0);
  405. $form->field(name => "page", type => 'hidden');
  406. $form->title("editing ".pagetitle($page));
  407. }
  408. print $form->render(submit => \@buttons);
  409. }
  410. else {
  411. # save page
  412. page_locked($page, $session);
  413. # Decode utf-8 since FormBuilder does not
  414. require Encode;
  415. my $content=Encode::decode_utf8($form->field('editcontent'));
  416. $content=~s/\r\n/\n/g;
  417. $content=~s/\r/\n/g;
  418. writefile($file, $config{srcdir}, $content);
  419. my $message="web commit ";
  420. if (defined $session->param("name") &&
  421. length $session->param("name")) {
  422. $message.="by ".$session->param("name");
  423. }
  424. else {
  425. $message.="from $ENV{REMOTE_ADDR}";
  426. }
  427. if (defined $form->field('comments') &&
  428. length $form->field('comments')) {
  429. $message.=Encode::decode_utf8(": ".$form->field('comments'));
  430. }
  431. if ($config{rcs}) {
  432. if ($newfile) {
  433. rcs_add($file);
  434. }
  435. # prevent deadlock with post-commit hook
  436. unlockwiki();
  437. # presumably the commit will trigger an update
  438. # of the wiki
  439. my $conflict=rcs_commit($file, $message,
  440. $form->field("rcsinfo"));
  441. if (defined $conflict) {
  442. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  443. force => 1);
  444. $form->tmpl_param("page_conflict", 1);
  445. $form->field("editcontent", value => $conflict, force => 1);
  446. $form->field(name => "comments", value => Encode::decode_utf8($form->field('comments')), force => 1);
  447. $form->field("do", "edit)");
  448. $form->tmpl_param("page_select", 0);
  449. $form->field(name => "page", type => 'hidden');
  450. $form->title("editing $page");
  451. print $form->render(submit => \@buttons);
  452. return;
  453. }
  454. }
  455. else {
  456. require IkiWiki::Render;
  457. refresh();
  458. saveindex();
  459. }
  460. # The trailing question mark tries to avoid broken
  461. # caches and get the most recent version of the page.
  462. print $q->redirect("$config{url}/".htmlpage($page)."?updated");
  463. }
  464. } #}}}
  465. sub cgi () { #{{{
  466. eval q{use CGI};
  467. eval q{use CGI::Session};
  468. my $q=CGI->new;
  469. if (exists $hooks{cgi}) {
  470. foreach my $id (keys %{$hooks{cgi}}) {
  471. $hooks{cgi}{$id}{call}->($q);
  472. }
  473. }
  474. my $do=$q->param('do');
  475. if (! defined $do || ! length $do) {
  476. error("\"do\" parameter missing");
  477. }
  478. # Things that do not need a session.
  479. if ($do eq 'recentchanges') {
  480. cgi_recentchanges($q);
  481. return;
  482. }
  483. elsif ($do eq 'hyperestraier') {
  484. cgi_hyperestraier();
  485. }
  486. CGI::Session->name("ikiwiki_session_$config{wikiname}");
  487. my $oldmask=umask(077);
  488. my $session = CGI::Session->new("driver:DB_File", $q,
  489. { FileName => "$config{wikistatedir}/sessions.db" });
  490. umask($oldmask);
  491. # Everything below this point needs the user to be signed in.
  492. if ((! $config{anonok} &&
  493. (! defined $session->param("name") ||
  494. ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
  495. cgi_signin($q, $session);
  496. # Force session flush with safe umask.
  497. my $oldmask=umask(077);
  498. $session->flush;
  499. umask($oldmask);
  500. return;
  501. }
  502. if ($do eq 'create' || $do eq 'edit') {
  503. cgi_editpage($q, $session);
  504. }
  505. elsif ($do eq 'prefs') {
  506. cgi_prefs($q, $session);
  507. }
  508. elsif ($do eq 'blog') {
  509. my $page=titlepage(lc($q->param('title')));
  510. # if the page already exists, munge it to be unique
  511. my $from=$q->param('from');
  512. my $add="";
  513. while (exists $oldpagemtime{"$from/$page$add"}) {
  514. $add=1 unless length $add;
  515. $add++;
  516. }
  517. $q->param('page', $page.$add);
  518. # now run same as create
  519. $q->param('do', 'create');
  520. cgi_editpage($q, $session);
  521. }
  522. else {
  523. error("unknown do parameter");
  524. }
  525. } #}}}
  526. 1