summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 74ed2f2178db703d26f4e5b49189414b2760897a (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki::UserInfo;
  5. package IkiWiki;
  6. sub page_locked ($$;$) { #{{{
  7. my $page=shift;
  8. my $session=shift;
  9. my $nonfatal=shift;
  10. my $user=$session->param("name");
  11. return if defined $user && is_admin($user);
  12. foreach my $admin (@{$config{adminuser}}) {
  13. my $locked_pages=userinfo_get($admin, "locked_pages");
  14. if (globlist_match($page, userinfo_get($admin, "locked_pages"))) {
  15. return 1 if $nonfatal;
  16. error(htmllink("", $page, 1)." is locked by ".
  17. htmllink("", $admin, 1)." and cannot be edited.");
  18. }
  19. }
  20. return 0;
  21. } #}}}
  22. sub cgi_recentchanges ($) { #{{{
  23. my $q=shift;
  24. unlockwiki();
  25. my $template=HTML::Template->new(
  26. filename => "$config{templatedir}/recentchanges.tmpl"
  27. );
  28. $template->param(
  29. title => "RecentChanges",
  30. indexlink => indexlink(),
  31. wikiname => $config{wikiname},
  32. changelog => [rcs_recentchanges(100)],
  33. styleurl => styleurl(),
  34. baseurl => "$config{url}/",
  35. );
  36. print $q->header, $template->output;
  37. } #}}}
  38. sub cgi_signin ($$) { #{{{
  39. my $q=shift;
  40. my $session=shift;
  41. eval q{use CGI::FormBuilder};
  42. my $form = CGI::FormBuilder->new(
  43. title => "signin",
  44. fields => [qw(do title page subpage from name password confirm_password email)],
  45. header => 1,
  46. method => 'POST',
  47. validate => {
  48. confirm_password => {
  49. perl => q{eq $form->field("password")},
  50. },
  51. email => 'EMAIL',
  52. },
  53. required => 'NONE',
  54. javascript => 0,
  55. params => $q,
  56. action => $config{cgiurl},
  57. header => 0,
  58. template => (-e "$config{templatedir}/signin.tmpl" ?
  59. "$config{templatedir}/signin.tmpl" : ""),
  60. stylesheet => styleurl(),
  61. );
  62. $form->field(name => "name", required => 0);
  63. $form->field(name => "do", type => "hidden");
  64. $form->field(name => "page", type => "hidden");
  65. $form->field(name => "title", type => "hidden");
  66. $form->field(name => "from", type => "hidden");
  67. $form->field(name => "subpage", type => "hidden");
  68. $form->field(name => "password", type => "password", required => 0);
  69. $form->field(name => "confirm_password", type => "password", required => 0);
  70. $form->field(name => "email", required => 0);
  71. if ($q->param("do") ne "signin") {
  72. $form->text("You need to log in first.");
  73. }
  74. if ($form->submitted) {
  75. # Set required fields based on how form was submitted.
  76. my %required=(
  77. "Login" => [qw(name password)],
  78. "Register" => [qw(name password confirm_password email)],
  79. "Mail Password" => [qw(name)],
  80. );
  81. foreach my $opt (@{$required{$form->submitted}}) {
  82. $form->field(name => $opt, required => 1);
  83. }
  84. # Validate password differently depending on how
  85. # form was submitted.
  86. if ($form->submitted eq 'Login') {
  87. $form->field(
  88. name => "password",
  89. validate => sub {
  90. length $form->field("name") &&
  91. shift eq userinfo_get($form->field("name"), 'password');
  92. },
  93. );
  94. $form->field(name => "name", validate => '/^\w+$/');
  95. }
  96. else {
  97. $form->field(name => "password", validate => 'VALUE');
  98. }
  99. # And make sure the entered name exists when logging
  100. # in or sending email, and does not when registering.
  101. if ($form->submitted eq 'Register') {
  102. $form->field(
  103. name => "name",
  104. validate => sub {
  105. my $name=shift;
  106. length $name &&
  107. $name=~/$config{wiki_file_regexp}/ &&
  108. ! userinfo_get($name, "regdate");
  109. },
  110. );
  111. }
  112. else {
  113. $form->field(
  114. name => "name",
  115. validate => sub {
  116. my $name=shift;
  117. length $name &&
  118. userinfo_get($name, "regdate");
  119. },
  120. );
  121. }
  122. }
  123. else {
  124. # First time settings.
  125. $form->field(name => "name", comment => "use FirstnameLastName");
  126. $form->field(name => "confirm_password", comment => "(only needed");
  127. $form->field(name => "email", comment => "for registration)");
  128. if ($session->param("name")) {
  129. $form->field(name => "name", value => $session->param("name"));
  130. }
  131. }
  132. if ($form->submitted && $form->validate) {
  133. if ($form->submitted eq 'Login') {
  134. $session->param("name", $form->field("name"));
  135. if (defined $form->field("do") &&
  136. $form->field("do") ne 'signin') {
  137. print $q->redirect(cgiurl(
  138. do => $form->field("do"),
  139. page => $form->field("page"),
  140. title => $form->field("title"),
  141. subpage => $form->field("subpage"),
  142. from => $form->field("from"),
  143. ));
  144. }
  145. else {
  146. print $q->redirect($config{url});
  147. }
  148. }
  149. elsif ($form->submitted eq 'Register') {
  150. my $user_name=$form->field('name');
  151. if (userinfo_setall($user_name, {
  152. 'email' => $form->field('email'),
  153. 'password' => $form->field('password'),
  154. 'regdate' => time
  155. })) {
  156. $form->field(name => "confirm_password", type => "hidden");
  157. $form->field(name => "email", type => "hidden");
  158. $form->text("Registration successful. Now you can Login.");
  159. print $session->header();
  160. print misctemplate($form->title, $form->render(submit => ["Login"]));
  161. }
  162. else {
  163. error("Error saving registration.");
  164. }
  165. }
  166. elsif ($form->submitted eq 'Mail Password') {
  167. my $user_name=$form->field("name");
  168. my $template=HTML::Template->new(
  169. filename => "$config{templatedir}/passwordmail.tmpl"
  170. );
  171. $template->param(
  172. user_name => $user_name,
  173. user_password => userinfo_get($user_name, "password"),
  174. wikiurl => $config{url},
  175. wikiname => $config{wikiname},
  176. REMOTE_ADDR => $ENV{REMOTE_ADDR},
  177. );
  178. eval q{use Mail::Sendmail};
  179. sendmail(
  180. To => userinfo_get($user_name, "email"),
  181. From => "$config{wikiname} admin <$config{adminemail}>",
  182. Subject => "$config{wikiname} information",
  183. Message => $template->output,
  184. ) or error("Failed to send mail");
  185. $form->text("Your password has been emailed to you.");
  186. $form->field(name => "name", required => 0);
  187. print $session->header();
  188. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  189. }
  190. }
  191. else {
  192. print $session->header();
  193. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  194. }
  195. } #}}}
  196. sub cgi_prefs ($$) { #{{{
  197. my $q=shift;
  198. my $session=shift;
  199. eval q{use CGI::FormBuilder};
  200. my $form = CGI::FormBuilder->new(
  201. title => "preferences",
  202. fields => [qw(do name password confirm_password email
  203. subscriptions locked_pages)],
  204. header => 0,
  205. method => 'POST',
  206. validate => {
  207. confirm_password => {
  208. perl => q{eq $form->field("password")},
  209. },
  210. email => 'EMAIL',
  211. },
  212. required => 'NONE',
  213. javascript => 0,
  214. params => $q,
  215. action => $config{cgiurl},
  216. template => (-e "$config{templatedir}/prefs.tmpl" ?
  217. "$config{templatedir}/prefs.tmpl" : ""),
  218. stylesheet => styleurl(),
  219. );
  220. my @buttons=("Save Preferences", "Logout", "Cancel");
  221. my $user_name=$session->param("name");
  222. $form->field(name => "do", type => "hidden");
  223. $form->field(name => "name", disabled => 1,
  224. value => $user_name, force => 1);
  225. $form->field(name => "password", type => "password");
  226. $form->field(name => "confirm_password", type => "password");
  227. $form->field(name => "subscriptions", size => 50,
  228. comment => "(".htmllink("", "GlobList", 1).")");
  229. $form->field(name => "locked_pages", size => 50,
  230. comment => "(".htmllink("", "GlobList", 1).")");
  231. if (! is_admin($user_name)) {
  232. $form->field(name => "locked_pages", type => "hidden");
  233. }
  234. if (! $form->submitted) {
  235. $form->field(name => "email", force => 1,
  236. value => userinfo_get($user_name, "email"));
  237. $form->field(name => "subscriptions", force => 1,
  238. value => userinfo_get($user_name, "subscriptions"));
  239. $form->field(name => "locked_pages", force => 1,
  240. value => userinfo_get($user_name, "locked_pages"));
  241. }
  242. if ($form->submitted eq 'Logout') {
  243. $session->delete();
  244. print $q->redirect($config{url});
  245. return;
  246. }
  247. elsif ($form->submitted eq 'Cancel') {
  248. print $q->redirect($config{url});
  249. return;
  250. }
  251. elsif ($form->submitted eq "Save Preferences" && $form->validate) {
  252. foreach my $field (qw(password email subscriptions locked_pages)) {
  253. if (length $form->field($field)) {
  254. userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field");
  255. }
  256. }
  257. $form->text("Preferences saved.");
  258. }
  259. print $session->header();
  260. print misctemplate($form->title, $form->render(submit => \@buttons));
  261. } #}}}
  262. sub cgi_editpage ($$) { #{{{
  263. my $q=shift;
  264. my $session=shift;
  265. eval q{use CGI::FormBuilder};
  266. my $form = CGI::FormBuilder->new(
  267. fields => [qw(do rcsinfo subpage from page content comments)],
  268. header => 1,
  269. method => 'POST',
  270. validate => {
  271. content => '/.+/',
  272. },
  273. required => [qw{content}],
  274. javascript => 0,
  275. params => $q,
  276. action => $config{cgiurl},
  277. table => 0,
  278. template => "$config{templatedir}/editpage.tmpl"
  279. );
  280. my @buttons=("Save Page", "Preview", "Cancel");
  281. # This untaint is safe because titlepage removes any problimatic
  282. # characters.
  283. my ($page)=titlepage(possibly_foolish_untaint(lc($form->param('page'))));
  284. if (! defined $page || ! length $page ||
  285. $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) {
  286. error("bad page name");
  287. }
  288. $page=lc($page);
  289. my $file=$page.$config{default_pageext};
  290. if (exists $pagesources{lc($page)}) {
  291. $file=$pagesources{lc($page)};
  292. }
  293. my $newfile=0;
  294. if (! -e "$config{srcdir}/$file") {
  295. $newfile=1;
  296. }
  297. $form->field(name => "do", type => 'hidden');
  298. $form->field(name => "from", type => 'hidden');
  299. $form->field(name => "rcsinfo", type => 'hidden');
  300. $form->field(name => "subpage", type => 'hidden');
  301. $form->field(name => "page", value => "$page", force => 1);
  302. $form->field(name => "comments", type => "text", size => 80);
  303. $form->field(name => "content", type => "textarea", rows => 20,
  304. cols => 80);
  305. $form->tmpl_param("can_commit", $config{rcs});
  306. $form->tmpl_param("indexlink", indexlink());
  307. $form->tmpl_param("helponformattinglink",
  308. htmllink("", "HelpOnFormatting", 1));
  309. $form->tmpl_param("styleurl", styleurl());
  310. $form->tmpl_param("baseurl", "$config{url}/");
  311. if (! $form->submitted) {
  312. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  313. force => 1);
  314. }
  315. if ($form->submitted eq "Cancel") {
  316. print $q->redirect("$config{url}/".htmlpage($page));
  317. return;
  318. }
  319. elsif ($form->submitted eq "Preview") {
  320. require IkiWiki::Render;
  321. $form->tmpl_param("page_preview",
  322. htmlize($config{default_pageext},
  323. linkify($form->field('content'), $page)));
  324. }
  325. else {
  326. $form->tmpl_param("page_preview", "");
  327. }
  328. $form->tmpl_param("page_conflict", "");
  329. if (! $form->submitted || $form->submitted eq "Preview" ||
  330. ! $form->validate) {
  331. if ($form->field("do") eq "create") {
  332. my @page_locs;
  333. my $best_loc;
  334. my ($from)=$form->param('from')=~/$config{wiki_file_regexp}/;
  335. if (! defined $from || ! length $from ||
  336. $from ne $form->param('from') ||
  337. $from=~/$config{wiki_file_prune_regexp}/ ||
  338. $from=~/^\// ||
  339. $form->submitted eq "Preview") {
  340. @page_locs=$best_loc=$page;
  341. }
  342. else {
  343. my $dir=$from."/";
  344. $dir=~s![^/]+/+$!!;
  345. if ((defined $form->param('subpage') && length $form->param('subpage')) ||
  346. $page eq 'discussion') {
  347. $best_loc="$from/$page";
  348. }
  349. else {
  350. $best_loc=$dir.$page;
  351. }
  352. push @page_locs, $dir.$page;
  353. push @page_locs, "$from/$page";
  354. while (length $dir) {
  355. $dir=~s![^/]+/+$!!;
  356. push @page_locs, $dir.$page;
  357. }
  358. }
  359. @page_locs = grep {
  360. ! exists $pagesources{lc($_)} &&
  361. ! page_locked($_, $session, 1)
  362. } @page_locs;
  363. if (! @page_locs) {
  364. # hmm, someone else made the page in the
  365. # meantime?
  366. print $q->redirect("$config{url}/".htmlpage($page));
  367. return;
  368. }
  369. $form->tmpl_param("page_select", 1);
  370. $form->field(name => "page", type => 'select',
  371. options => \@page_locs, value => $best_loc);
  372. $form->title("creating ".pagetitle($page));
  373. }
  374. elsif ($form->field("do") eq "edit") {
  375. page_locked($page, $session);
  376. if (! defined $form->field('content') ||
  377. ! length $form->field('content')) {
  378. my $content="";
  379. if (exists $pagesources{lc($page)}) {
  380. $content=readfile(srcfile($pagesources{lc($page)}));
  381. $content=~s/\n/\r\n/g;
  382. }
  383. $form->field(name => "content", value => $content,
  384. force => 1);
  385. }
  386. $form->tmpl_param("page_select", 0);
  387. $form->field(name => "page", type => 'hidden');
  388. $form->title("editing ".pagetitle($page));
  389. }
  390. print $form->render(submit => \@buttons);
  391. }
  392. else {
  393. # save page
  394. page_locked($page, $session);
  395. my $content=$form->field('content');
  396. $content=~s/\r\n/\n/g;
  397. $content=~s/\r/\n/g;
  398. writefile($file, $config{srcdir}, $content);
  399. my $message="web commit ";
  400. if (length $session->param("name")) {
  401. $message.="by ".$session->param("name");
  402. }
  403. else {
  404. $message.="from $ENV{REMOTE_ADDR}";
  405. }
  406. if (defined $form->field('comments') &&
  407. length $form->field('comments')) {
  408. $message.=": ".$form->field('comments');
  409. }
  410. if ($config{rcs}) {
  411. if ($newfile) {
  412. rcs_add($file);
  413. }
  414. # prevent deadlock with post-commit hook
  415. unlockwiki();
  416. # presumably the commit will trigger an update
  417. # of the wiki
  418. my $conflict=rcs_commit($file, $message,
  419. $form->field("rcsinfo"));
  420. if (defined $conflict) {
  421. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  422. force => 1);
  423. $form->tmpl_param("page_conflict", 1);
  424. $form->field("content", value => $conflict, force => 1);
  425. $form->field("do", "edit)");
  426. $form->tmpl_param("page_select", 0);
  427. $form->field(name => "page", type => 'hidden');
  428. $form->title("editing $page");
  429. print $form->render(submit => \@buttons);
  430. return;
  431. }
  432. }
  433. else {
  434. require IkiWiki::Render;
  435. refresh();
  436. saveindex();
  437. }
  438. # The trailing question mark tries to avoid broken
  439. # caches and get the most recent version of the page.
  440. print $q->redirect("$config{url}/".htmlpage($page)."?updated");
  441. }
  442. } #}}}
  443. sub cgi_hyperestraier () { #{{{
  444. # only works for GET requests
  445. chdir("$config{wikistatedir}/hyperestraier") || error("chdir: $!");
  446. exec("./".basename($config{cgiurl})) || error("estseek.cgi failed");
  447. } #}}}
  448. sub cgi () { #{{{
  449. eval q{use CGI};
  450. eval q{use CGI::Session};
  451. my $q=CGI->new;
  452. my $do=$q->param('do');
  453. if (! defined $do || ! length $do) {
  454. if (defined $q->param('phrase')) {
  455. cgi_hyperestraier();
  456. }
  457. else {
  458. error("\"do\" parameter missing");
  459. }
  460. }
  461. # Things that do not need a session.
  462. if ($do eq 'recentchanges') {
  463. cgi_recentchanges($q);
  464. return;
  465. }
  466. elsif ($do eq 'hyperestraier') {
  467. cgi_hyperestraier();
  468. }
  469. CGI::Session->name("ikiwiki_session_$config{wikiname}");
  470. my $oldmask=umask(077);
  471. my $session = CGI::Session->new("driver:DB_File", $q,
  472. { FileName => "$config{wikistatedir}/sessions.db" });
  473. umask($oldmask);
  474. # Everything below this point needs the user to be signed in.
  475. if ((! $config{anonok} &&
  476. (! defined $session->param("name") ||
  477. ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
  478. cgi_signin($q, $session);
  479. # Force session flush with safe umask.
  480. my $oldmask=umask(077);
  481. $session->flush;
  482. umask($oldmask);
  483. return;
  484. }
  485. if ($do eq 'create' || $do eq 'edit') {
  486. cgi_editpage($q, $session);
  487. }
  488. elsif ($do eq 'prefs') {
  489. cgi_prefs($q, $session);
  490. }
  491. elsif ($do eq 'blog') {
  492. my $page=titlepage(lc($q->param('title')));
  493. # if the page already exists, munge it to be unique
  494. my $from=$q->param('from');
  495. my $add="";
  496. while (exists $oldpagemtime{"$from/$page$add"}) {
  497. $add=1 unless length $add;
  498. $add++;
  499. }
  500. $q->param('page', $page.$add);
  501. # now run same as create
  502. $q->param('do', 'create');
  503. cgi_editpage($q, $session);
  504. }
  505. else {
  506. error("unknown do parameter");
  507. }
  508. } #}}}
  509. 1