summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 8a294e887554bbf0f145cfedc239dd062ba4bfc9 (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub printheader ($) { #{{{
  10. my $session=shift;
  11. if ($config{sslcookie}) {
  12. print $session->header(-charset => 'utf-8',
  13. -cookie => $session->cookie(-secure => 1));
  14. } else {
  15. print $session->header(-charset => 'utf-8');
  16. }
  17. } #}}}
  18. sub showform ($$$$;@) { #{{{
  19. my $form=shift;
  20. my $buttons=shift;
  21. my $session=shift;
  22. my $cgi=shift;
  23. if (exists $hooks{formbuilder}) {
  24. run_hooks(formbuilder => sub {
  25. shift->(form => $form, cgi => $cgi, session => $session,
  26. buttons => $buttons);
  27. });
  28. }
  29. printheader($session);
  30. print misctemplate($form->title, $form->render(submit => $buttons), @_);
  31. }
  32. sub redirect ($$) { #{{{
  33. my $q=shift;
  34. my $url=shift;
  35. if (! $config{w3mmode}) {
  36. print $q->redirect($url);
  37. }
  38. else {
  39. print "Content-type: text/plain\n";
  40. print "W3m-control: GOTO $url\n\n";
  41. }
  42. } #}}}
  43. sub check_canedit ($$$;$) { #{{{
  44. my $page=shift;
  45. my $q=shift;
  46. my $session=shift;
  47. my $nonfatal=shift;
  48. my $canedit;
  49. run_hooks(canedit => sub {
  50. return if defined $canedit;
  51. my $ret=shift->($page, $q, $session);
  52. if (defined $ret) {
  53. if ($ret eq "") {
  54. $canedit=1;
  55. }
  56. elsif (ref $ret eq 'CODE') {
  57. $ret->() unless $nonfatal;
  58. $canedit=0;
  59. }
  60. elsif (defined $ret) {
  61. error($ret) unless $nonfatal;
  62. $canedit=0;
  63. }
  64. }
  65. });
  66. return $canedit;
  67. } #}}}
  68. sub decode_cgi_utf8 ($) { #{{{
  69. # decode_form_utf8 method is needed for 5.10
  70. if ($] < 5.01) {
  71. my $cgi = shift;
  72. foreach my $f ($cgi->param) {
  73. $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
  74. }
  75. }
  76. } #}}}
  77. sub decode_form_utf8 ($) { #{{{
  78. if ($] >= 5.01) {
  79. my $form = shift;
  80. foreach my $f ($form->field) {
  81. $form->field(name => $f,
  82. value => decode_utf8($form->field($f)),
  83. force => 1,
  84. );
  85. }
  86. }
  87. } #}}}
  88. # Check if the user is signed in. If not, redirect to the signin form and
  89. # save their place to return to later.
  90. sub needsignin ($$) { #{{{
  91. my $q=shift;
  92. my $session=shift;
  93. if (! defined $session->param("name") ||
  94. ! userinfo_get($session->param("name"), "regdate")) {
  95. $session->param(postsignin => $ENV{QUERY_STRING});
  96. cgi_signin($q, $session);
  97. cgi_savesession($session);
  98. exit;
  99. }
  100. } #}}}
  101. sub cgi_signin ($$) { #{{{
  102. my $q=shift;
  103. my $session=shift;
  104. decode_cgi_utf8($q);
  105. eval q{use CGI::FormBuilder};
  106. error($@) if $@;
  107. my $form = CGI::FormBuilder->new(
  108. title => "signin",
  109. name => "signin",
  110. charset => "utf-8",
  111. method => 'POST',
  112. required => 'NONE',
  113. javascript => 0,
  114. params => $q,
  115. action => $config{cgiurl},
  116. header => 0,
  117. template => {type => 'div'},
  118. stylesheet => baseurl()."style.css",
  119. );
  120. my $buttons=["Login"];
  121. if ($q->param("do") ne "signin" && !$form->submitted) {
  122. $form->text(gettext("You need to log in first."));
  123. }
  124. $form->field(name => "do", type => "hidden", value => "signin",
  125. force => 1);
  126. decode_form_utf8($form);
  127. run_hooks(formbuilder_setup => sub {
  128. shift->(form => $form, cgi => $q, session => $session,
  129. buttons => $buttons);
  130. });
  131. decode_form_utf8($form);
  132. if ($form->submitted) {
  133. $form->validate;
  134. }
  135. showform($form, $buttons, $session, $q);
  136. } #}}}
  137. sub cgi_postsignin ($$) { #{{{
  138. my $q=shift;
  139. my $session=shift;
  140. # Continue with whatever was being done before the signin process.
  141. if (defined $session->param("postsignin")) {
  142. my $postsignin=CGI->new($session->param("postsignin"));
  143. $session->clear("postsignin");
  144. cgi($postsignin, $session);
  145. cgi_savesession($session);
  146. exit;
  147. }
  148. else {
  149. error(gettext("login failed, perhaps you need to turn on cookies?"));
  150. }
  151. } #}}}
  152. sub cgi_prefs ($$) { #{{{
  153. my $q=shift;
  154. my $session=shift;
  155. needsignin($q, $session);
  156. decode_cgi_utf8($q);
  157. # The session id is stored on the form and checked to
  158. # guard against CSRF.
  159. my $sid=$q->param('sid');
  160. if (! defined $sid) {
  161. $q->delete_all;
  162. }
  163. elsif ($sid ne $session->id) {
  164. error(gettext("Your login session has expired."));
  165. }
  166. eval q{use CGI::FormBuilder};
  167. error($@) if $@;
  168. my $form = CGI::FormBuilder->new(
  169. title => "preferences",
  170. name => "preferences",
  171. header => 0,
  172. charset => "utf-8",
  173. method => 'POST',
  174. validate => {
  175. email => 'EMAIL',
  176. },
  177. required => 'NONE',
  178. javascript => 0,
  179. params => $q,
  180. action => $config{cgiurl},
  181. template => {type => 'div'},
  182. stylesheet => baseurl()."style.css",
  183. fieldsets => [
  184. [login => gettext("Login")],
  185. [preferences => gettext("Preferences")],
  186. [admin => gettext("Admin")]
  187. ],
  188. );
  189. my $buttons=["Save Preferences", "Logout", "Cancel"];
  190. decode_form_utf8($form);
  191. run_hooks(formbuilder_setup => sub {
  192. shift->(form => $form, cgi => $q, session => $session,
  193. buttons => $buttons);
  194. });
  195. decode_form_utf8($form);
  196. $form->field(name => "do", type => "hidden", value => "prefs",
  197. force => 1);
  198. $form->field(name => "sid", type => "hidden", value => $session->id,
  199. force => 1);
  200. $form->field(name => "email", size => 50, fieldset => "preferences");
  201. $form->field(name => "banned_users", size => 50,
  202. fieldset => "admin");
  203. my $user_name=$session->param("name");
  204. if (! is_admin($user_name)) {
  205. $form->field(name => "banned_users", type => "hidden");
  206. }
  207. if (! $form->submitted) {
  208. $form->field(name => "email", force => 1,
  209. value => userinfo_get($user_name, "email"));
  210. if (is_admin($user_name)) {
  211. $form->field(name => "banned_users", force => 1,
  212. value => join(" ", get_banned_users()));
  213. }
  214. }
  215. if ($form->submitted eq 'Logout') {
  216. $session->delete();
  217. redirect($q, $config{url});
  218. return;
  219. }
  220. elsif ($form->submitted eq 'Cancel') {
  221. redirect($q, $config{url});
  222. return;
  223. }
  224. elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
  225. if (defined $form->field('email')) {
  226. userinfo_set($user_name, 'email', $form->field('email')) ||
  227. error("failed to set email");
  228. }
  229. if (is_admin($user_name)) {
  230. set_banned_users(grep { ! is_admin($_) }
  231. split(' ',
  232. $form->field("banned_users"))) ||
  233. error("failed saving changes");
  234. }
  235. $form->text(gettext("Preferences saved."));
  236. }
  237. showform($form, $buttons, $session, $q);
  238. } #}}}
  239. sub cgi_editpage ($$) { #{{{
  240. my $q=shift;
  241. my $session=shift;
  242. decode_cgi_utf8($q);
  243. my @fields=qw(do rcsinfo subpage from page type editcontent comments);
  244. my @buttons=("Save Page", "Preview", "Cancel");
  245. eval q{use CGI::FormBuilder};
  246. error($@) if $@;
  247. my $form = CGI::FormBuilder->new(
  248. title => "editpage",
  249. fields => \@fields,
  250. charset => "utf-8",
  251. method => 'POST',
  252. required => [qw{editcontent}],
  253. javascript => 0,
  254. params => $q,
  255. action => $config{cgiurl},
  256. header => 0,
  257. table => 0,
  258. template => scalar template_params("editpage.tmpl"),
  259. wikiname => $config{wikiname},
  260. );
  261. decode_form_utf8($form);
  262. run_hooks(formbuilder_setup => sub {
  263. shift->(form => $form, cgi => $q, session => $session,
  264. buttons => \@buttons);
  265. });
  266. decode_form_utf8($form);
  267. # This untaint is safe because titlepage removes any problematic
  268. # characters.
  269. my ($page)=$form->field('page');
  270. $page=titlepage(possibly_foolish_untaint($page));
  271. if (! defined $page || ! length $page ||
  272. file_pruned($page, $config{srcdir}) || $page=~/^\//) {
  273. error("bad page name");
  274. }
  275. my $baseurl=$config{url}."/".htmlpage($page);
  276. my $from;
  277. if (defined $form->field('from')) {
  278. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  279. }
  280. my $file;
  281. my $type;
  282. if (exists $pagesources{$page} && $form->field("do") ne "create") {
  283. $file=$pagesources{$page};
  284. $type=pagetype($file);
  285. if (! defined $type || $type=~/^_/) {
  286. error(sprintf(gettext("%s is not an editable page"), $page));
  287. }
  288. if (! $form->submitted) {
  289. $form->field(name => "rcsinfo",
  290. value => rcs_prepedit($file), force => 1);
  291. }
  292. $form->field(name => "editcontent", validate => '/.*/');
  293. }
  294. else {
  295. $type=$form->param('type');
  296. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  297. $type=possibly_foolish_untaint($type);
  298. }
  299. elsif (defined $from && exists $pagesources{$from}) {
  300. # favor the type of linking page
  301. $type=pagetype($pagesources{$from});
  302. }
  303. $type=$config{default_pageext} unless defined $type;
  304. $file=$page.".".$type;
  305. if (! $form->submitted) {
  306. $form->field(name => "rcsinfo", value => "", force => 1);
  307. }
  308. $form->field(name => "editcontent", validate => '/.+/');
  309. }
  310. $form->field(name => "do", type => 'hidden');
  311. $form->field(name => "sid", type => "hidden", value => $session->id,
  312. force => 1);
  313. $form->field(name => "from", type => 'hidden');
  314. $form->field(name => "rcsinfo", type => 'hidden');
  315. $form->field(name => "subpage", type => 'hidden');
  316. $form->field(name => "page", value => pagetitle($page, 1), force => 1);
  317. $form->field(name => "type", value => $type, force => 1);
  318. $form->field(name => "comments", type => "text", size => 80);
  319. $form->field(name => "editcontent", type => "textarea", rows => 20,
  320. cols => 80);
  321. $form->tmpl_param("can_commit", $config{rcs});
  322. $form->tmpl_param("indexlink", indexlink());
  323. $form->tmpl_param("helponformattinglink",
  324. htmllink($page, $page, "ikiwiki/formatting",
  325. noimageinline => 1,
  326. linktext => "FormattingHelp"));
  327. if ($form->submitted eq "Cancel") {
  328. if ($form->field("do") eq "create" && defined $from) {
  329. redirect($q, "$config{url}/".htmlpage($from));
  330. }
  331. elsif ($form->field("do") eq "create") {
  332. redirect($q, $config{url});
  333. }
  334. else {
  335. redirect($q, "$config{url}/".htmlpage($page));
  336. }
  337. return;
  338. }
  339. elsif ($form->submitted eq "Preview") {
  340. my $new=not exists $pagesources{$page};
  341. if ($new) {
  342. # temporarily record its type
  343. $pagesources{$page}=$page.".".$type;
  344. }
  345. my $content=$form->field('editcontent');
  346. run_hooks(editcontent => sub {
  347. $content=shift->(
  348. content => $content,
  349. page => $page,
  350. cgi => $q,
  351. session => $session,
  352. );
  353. });
  354. $form->tmpl_param("page_preview",
  355. htmlize($page, $page, $type,
  356. linkify($page, $page,
  357. preprocess($page, $page,
  358. filter($page, $page, $content), 0, 1))));
  359. if ($new) {
  360. delete $pagesources{$page};
  361. }
  362. # previewing may have created files on disk
  363. saveindex();
  364. }
  365. elsif ($form->submitted eq "Save Page") {
  366. $form->tmpl_param("page_preview", "");
  367. }
  368. $form->tmpl_param("page_conflict", "");
  369. if ($form->submitted ne "Save Page" || ! $form->validate) {
  370. if ($form->field("do") eq "create") {
  371. my @page_locs;
  372. my $best_loc;
  373. if (! defined $from || ! length $from ||
  374. $from ne $form->field('from') ||
  375. file_pruned($from, $config{srcdir}) ||
  376. $from=~/^\// ||
  377. $form->submitted eq "Preview") {
  378. @page_locs=$best_loc=$page;
  379. }
  380. else {
  381. my $dir=$from."/";
  382. $dir=~s![^/]+/+$!!;
  383. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  384. $page eq gettext('discussion')) {
  385. $best_loc="$from/$page";
  386. }
  387. else {
  388. $best_loc=$dir.$page;
  389. }
  390. push @page_locs, $dir.$page;
  391. push @page_locs, "$from/$page";
  392. while (length $dir) {
  393. $dir=~s![^/]+/+$!!;
  394. push @page_locs, $dir.$page;
  395. }
  396. push @page_locs, "$config{userdir}/$page"
  397. if length $config{userdir};
  398. }
  399. @page_locs = grep {
  400. ! exists $pagecase{lc $_}
  401. } @page_locs;
  402. if (! @page_locs) {
  403. # hmm, someone else made the page in the
  404. # meantime?
  405. if ($form->submitted eq "Preview") {
  406. # let them go ahead with the edit
  407. # and resolve the conflict at save
  408. # time
  409. @page_locs=$page;
  410. }
  411. else {
  412. redirect($q, "$config{url}/".htmlpage($page));
  413. return;
  414. }
  415. }
  416. my @editable_locs = grep {
  417. check_canedit($_, $q, $session, 1)
  418. } @page_locs;
  419. if (! @editable_locs) {
  420. # let it throw an error this time
  421. map { check_canedit($_, $q, $session) } @page_locs;
  422. }
  423. my @page_types;
  424. if (exists $hooks{htmlize}) {
  425. @page_types=grep { !/^_/ }
  426. keys %{$hooks{htmlize}};
  427. }
  428. $form->tmpl_param("page_select", 1);
  429. $form->field(name => "page", type => 'select',
  430. options => [ map { pagetitle($_, 1) } @editable_locs ],
  431. value => pagetitle($best_loc, 1));
  432. $form->field(name => "type", type => 'select',
  433. options => \@page_types);
  434. $form->title(sprintf(gettext("creating %s"), pagetitle($page)));
  435. }
  436. elsif ($form->field("do") eq "edit") {
  437. check_canedit($page, $q, $session);
  438. if (! defined $form->field('editcontent') ||
  439. ! length $form->field('editcontent')) {
  440. my $content="";
  441. if (exists $pagesources{$page}) {
  442. $content=readfile(srcfile($pagesources{$page}));
  443. $content=~s/\n/\r\n/g;
  444. }
  445. $form->field(name => "editcontent", value => $content,
  446. force => 1);
  447. }
  448. $form->tmpl_param("page_select", 0);
  449. $form->field(name => "page", type => 'hidden');
  450. $form->field(name => "type", type => 'hidden');
  451. $form->title(sprintf(gettext("editing %s"), pagetitle($page)));
  452. }
  453. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  454. }
  455. else {
  456. # save page
  457. check_canedit($page, $q, $session);
  458. # The session id is stored on the form and checked to
  459. # guard against CSRF. But only if the user is logged in,
  460. # as anonok can allow anonymous edits.
  461. if (defined $session->param("name")) {
  462. my $sid=$q->param('sid');
  463. if (! defined $sid || $sid ne $session->id) {
  464. error(gettext("Your login session has expired."));
  465. }
  466. }
  467. my $exists=-e "$config{srcdir}/$file";
  468. if ($form->field("do") ne "create" && ! $exists &&
  469. ! defined srcfile($file, 1)) {
  470. $form->tmpl_param("page_gone", 1);
  471. $form->field(name => "do", value => "create", force => 1);
  472. $form->tmpl_param("page_select", 0);
  473. $form->field(name => "page", type => 'hidden');
  474. $form->field(name => "type", type => 'hidden');
  475. $form->title(sprintf(gettext("editing %s"), $page));
  476. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  477. return;
  478. }
  479. elsif ($form->field("do") eq "create" && $exists) {
  480. $form->tmpl_param("creation_conflict", 1);
  481. $form->field(name => "do", value => "edit", force => 1);
  482. $form->tmpl_param("page_select", 0);
  483. $form->field(name => "page", type => 'hidden');
  484. $form->field(name => "type", type => 'hidden');
  485. $form->title(sprintf(gettext("editing %s"), $page));
  486. $form->field("editcontent",
  487. value => readfile("$config{srcdir}/$file").
  488. "\n\n\n".$form->field("editcontent"),
  489. force => 1);
  490. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  491. return;
  492. }
  493. my $content=$form->field('editcontent');
  494. run_hooks(editcontent => sub {
  495. $content=shift->(
  496. content => $content,
  497. page => $page,
  498. cgi => $q,
  499. session => $session,
  500. );
  501. });
  502. $content=~s/\r\n/\n/g;
  503. $content=~s/\r/\n/g;
  504. $content.="\n" if $content !~ /\n$/;
  505. $config{cgi}=0; # avoid cgi error message
  506. eval { writefile($file, $config{srcdir}, $content) };
  507. $config{cgi}=1;
  508. if ($@) {
  509. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  510. force => 1);
  511. $form->tmpl_param("failed_save", 1);
  512. $form->tmpl_param("error_message", $@);
  513. $form->field("editcontent", value => $content, force => 1);
  514. $form->tmpl_param("page_select", 0);
  515. $form->field(name => "page", type => 'hidden');
  516. $form->field(name => "type", type => 'hidden');
  517. $form->title(sprintf(gettext("editing %s"), $page));
  518. showform($form, \@buttons, $session, $q,
  519. forcebaseurl => $baseurl);
  520. return;
  521. }
  522. my $conflict;
  523. if ($config{rcs}) {
  524. my $message="";
  525. if (defined $form->field('comments') &&
  526. length $form->field('comments')) {
  527. $message=$form->field('comments');
  528. }
  529. if (! $exists) {
  530. rcs_add($file);
  531. }
  532. # Prevent deadlock with post-commit hook by
  533. # signaling to it that it should not try to
  534. # do anything.
  535. disable_commit_hook();
  536. $conflict=rcs_commit($file, $message,
  537. $form->field("rcsinfo"),
  538. $session->param("name"), $ENV{REMOTE_ADDR});
  539. enable_commit_hook();
  540. rcs_update();
  541. }
  542. # Refresh even if there was a conflict, since other changes
  543. # may have been committed while the post-commit hook was
  544. # disabled.
  545. require IkiWiki::Render;
  546. refresh();
  547. saveindex();
  548. if (defined $conflict) {
  549. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  550. force => 1);
  551. $form->tmpl_param("page_conflict", 1);
  552. $form->field("editcontent", value => $conflict, force => 1);
  553. $form->field("do", "edit", force => 1);
  554. $form->tmpl_param("page_select", 0);
  555. $form->field(name => "page", type => 'hidden');
  556. $form->field(name => "type", type => 'hidden');
  557. $form->title(sprintf(gettext("editing %s"), $page));
  558. showform($form, \@buttons, $session, $q,
  559. forcebaseurl => $baseurl);
  560. return;
  561. }
  562. else {
  563. # The trailing question mark tries to avoid broken
  564. # caches and get the most recent version of the page.
  565. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  566. }
  567. }
  568. } #}}}
  569. sub cgi_getsession ($) { #{{{
  570. my $q=shift;
  571. eval q{use CGI::Session};
  572. error($@) if $@;
  573. CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname}));
  574. my $oldmask=umask(077);
  575. my $session = CGI::Session->new("driver:DB_File", $q,
  576. { FileName => "$config{wikistatedir}/sessions.db" });
  577. umask($oldmask);
  578. return $session;
  579. } #}}}
  580. sub cgi_savesession ($) { #{{{
  581. my $session=shift;
  582. # Force session flush with safe umask.
  583. my $oldmask=umask(077);
  584. $session->flush;
  585. umask($oldmask);
  586. } #}}}
  587. sub cgi (;$$) { #{{{
  588. my $q=shift;
  589. my $session=shift;
  590. if (! $q) {
  591. eval q{use CGI};
  592. error($@) if $@;
  593. binmode(STDIN);
  594. $q=CGI->new;
  595. binmode(STDIN, ":utf8");
  596. run_hooks(cgi => sub { shift->($q) });
  597. }
  598. my $do=$q->param('do');
  599. if (! defined $do || ! length $do) {
  600. my $error = $q->cgi_error;
  601. if ($error) {
  602. error("Request not processed: $error");
  603. }
  604. else {
  605. error("\"do\" parameter missing");
  606. }
  607. }
  608. # Need to lock the wiki before getting a session.
  609. lockwiki();
  610. loadindex();
  611. if (! $session) {
  612. $session=cgi_getsession($q);
  613. }
  614. # Auth hooks can sign a user in.
  615. if ($do ne 'signin' && ! defined $session->param("name")) {
  616. run_hooks(auth => sub {
  617. shift->($q, $session)
  618. });
  619. if (defined $session->param("name")) {
  620. # Make sure whatever user was authed is in the
  621. # userinfo db.
  622. if (! userinfo_get($session->param("name"), "regdate")) {
  623. userinfo_setall($session->param("name"), {
  624. email => "",
  625. password => "",
  626. regdate => time,
  627. }) || error("failed adding user");
  628. }
  629. }
  630. }
  631. if (defined $session->param("name") &&
  632. userinfo_get($session->param("name"), "banned")) {
  633. print $q->header(-status => "403 Forbidden");
  634. $session->delete();
  635. print gettext("You are banned.");
  636. cgi_savesession($session);
  637. }
  638. run_hooks(sessioncgi => sub { shift->($q, $session) });
  639. if ($do eq 'signin') {
  640. cgi_signin($q, $session);
  641. cgi_savesession($session);
  642. }
  643. elsif ($do eq 'prefs') {
  644. cgi_prefs($q, $session);
  645. }
  646. elsif ($do eq 'create' || $do eq 'edit') {
  647. cgi_editpage($q, $session);
  648. }
  649. elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
  650. cgi_postsignin($q, $session);
  651. }
  652. else {
  653. error("unknown do parameter");
  654. }
  655. } #}}}
  656. 1