summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: af58d7cb56893a831d5ae798d5c5f16fc96b23fd (plain)
  1. #!/usr/bin/perl
  2. package IkiWiki;
  3. use warnings;
  4. use strict;
  5. use IkiWiki;
  6. use IkiWiki::UserInfo;
  7. use open qw{:utf8 :std};
  8. use Encode;
  9. sub printheader ($) {
  10. my $session=shift;
  11. if ($config{sslcookie}) {
  12. print $session->header(-charset => 'utf-8',
  13. -cookie => $session->cookie(-httponly => 1, -secure => 1));
  14. } else {
  15. print $session->header(-charset => 'utf-8',
  16. -cookie => $session->cookie(-httponly => 1));
  17. }
  18. }
  19. sub showform ($$$$;@) {
  20. my $form=shift;
  21. my $buttons=shift;
  22. my $session=shift;
  23. my $cgi=shift;
  24. if (exists $hooks{formbuilder}) {
  25. run_hooks(formbuilder => sub {
  26. shift->(form => $form, cgi => $cgi, session => $session,
  27. buttons => $buttons);
  28. });
  29. }
  30. printheader($session);
  31. print misctemplate($form->title, $form->render(submit => $buttons), @_);
  32. }
  33. sub redirect ($$) {
  34. my $q=shift;
  35. my $url=shift;
  36. if (! $config{w3mmode}) {
  37. print $q->redirect($url);
  38. }
  39. else {
  40. print "Content-type: text/plain\n";
  41. print "W3m-control: GOTO $url\n\n";
  42. }
  43. }
  44. sub decode_cgi_utf8 ($) {
  45. # decode_form_utf8 method is needed for 5.10
  46. if ($] < 5.01) {
  47. my $cgi = shift;
  48. foreach my $f ($cgi->param) {
  49. $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
  50. }
  51. }
  52. }
  53. sub decode_form_utf8 ($) {
  54. if ($] >= 5.01) {
  55. my $form = shift;
  56. foreach my $f ($form->field) {
  57. $form->field(name => $f,
  58. value => decode_utf8($form->field($f)),
  59. force => 1,
  60. );
  61. }
  62. }
  63. }
  64. # Check if the user is signed in. If not, redirect to the signin form and
  65. # save their place to return to later.
  66. sub needsignin ($$) {
  67. my $q=shift;
  68. my $session=shift;
  69. if (! defined $session->param("name") ||
  70. ! userinfo_get($session->param("name"), "regdate")) {
  71. $session->param(postsignin => $ENV{QUERY_STRING});
  72. cgi_signin($q, $session);
  73. cgi_savesession($session);
  74. exit;
  75. }
  76. }
  77. sub cgi_signin ($$) {
  78. my $q=shift;
  79. my $session=shift;
  80. decode_cgi_utf8($q);
  81. eval q{use CGI::FormBuilder};
  82. error($@) if $@;
  83. my $form = CGI::FormBuilder->new(
  84. title => "signin",
  85. name => "signin",
  86. charset => "utf-8",
  87. method => 'POST',
  88. required => 'NONE',
  89. javascript => 0,
  90. params => $q,
  91. action => $config{cgiurl},
  92. header => 0,
  93. template => {type => 'div'},
  94. stylesheet => baseurl()."style.css",
  95. );
  96. my $buttons=["Login"];
  97. if ($q->param("do") ne "signin" && !$form->submitted) {
  98. $form->text(gettext("You need to log in first."));
  99. }
  100. $form->field(name => "do", type => "hidden", value => "signin",
  101. force => 1);
  102. decode_form_utf8($form);
  103. run_hooks(formbuilder_setup => sub {
  104. shift->(form => $form, cgi => $q, session => $session,
  105. buttons => $buttons);
  106. });
  107. decode_form_utf8($form);
  108. if ($form->submitted) {
  109. $form->validate;
  110. }
  111. showform($form, $buttons, $session, $q);
  112. }
  113. sub cgi_postsignin ($$) {
  114. my $q=shift;
  115. my $session=shift;
  116. # Continue with whatever was being done before the signin process.
  117. if (defined $session->param("postsignin")) {
  118. my $postsignin=CGI->new($session->param("postsignin"));
  119. $session->clear("postsignin");
  120. cgi($postsignin, $session);
  121. cgi_savesession($session);
  122. exit;
  123. }
  124. else {
  125. if ($config{sslcookie} && ! $q->https()) {
  126. error(gettext("probable misconfiguration: sslcookie is set, but you are attempting to login via http, not https"));
  127. }
  128. else {
  129. error(gettext("login failed, perhaps you need to turn on cookies?"));
  130. }
  131. }
  132. }
  133. sub cgi_prefs ($$) {
  134. my $q=shift;
  135. my $session=shift;
  136. needsignin($q, $session);
  137. decode_cgi_utf8($q);
  138. # The session id is stored on the form and checked to
  139. # guard against CSRF.
  140. my $sid=$q->param('sid');
  141. if (! defined $sid) {
  142. $q->delete_all;
  143. }
  144. elsif ($sid ne $session->id) {
  145. error(gettext("Your login session has expired."));
  146. }
  147. eval q{use CGI::FormBuilder};
  148. error($@) if $@;
  149. my $form = CGI::FormBuilder->new(
  150. title => "preferences",
  151. name => "preferences",
  152. header => 0,
  153. charset => "utf-8",
  154. method => 'POST',
  155. validate => {
  156. email => 'EMAIL',
  157. },
  158. required => 'NONE',
  159. javascript => 0,
  160. params => $q,
  161. action => $config{cgiurl},
  162. template => {type => 'div'},
  163. stylesheet => baseurl()."style.css",
  164. fieldsets => [
  165. [login => gettext("Login")],
  166. [preferences => gettext("Preferences")],
  167. [admin => gettext("Admin")]
  168. ],
  169. );
  170. my $buttons=["Save Preferences", "Logout", "Cancel"];
  171. decode_form_utf8($form);
  172. run_hooks(formbuilder_setup => sub {
  173. shift->(form => $form, cgi => $q, session => $session,
  174. buttons => $buttons);
  175. });
  176. decode_form_utf8($form);
  177. $form->field(name => "do", type => "hidden", value => "prefs",
  178. force => 1);
  179. $form->field(name => "sid", type => "hidden", value => $session->id,
  180. force => 1);
  181. $form->field(name => "email", size => 50, fieldset => "preferences");
  182. my $user_name=$session->param("name");
  183. if (! $form->submitted) {
  184. $form->field(name => "email", force => 1,
  185. value => userinfo_get($user_name, "email"));
  186. }
  187. if ($form->submitted eq 'Logout') {
  188. $session->delete();
  189. redirect($q, $config{url});
  190. return;
  191. }
  192. elsif ($form->submitted eq 'Cancel') {
  193. redirect($q, $config{url});
  194. return;
  195. }
  196. elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
  197. if (defined $form->field('email')) {
  198. userinfo_set($user_name, 'email', $form->field('email')) ||
  199. error("failed to set email");
  200. }
  201. $form->text(gettext("Preferences saved."));
  202. }
  203. showform($form, $buttons, $session, $q);
  204. }
  205. sub cgi_custom_failure ($$) {
  206. my $header=shift;
  207. my $message=shift;
  208. print $header;
  209. print $message;
  210. # Internet Explod^Hrer won't show custom 404 responses
  211. # unless they're >= 512 bytes
  212. print ' ' x 512;
  213. exit;
  214. }
  215. sub check_banned ($$) {
  216. my $q=shift;
  217. my $session=shift;
  218. my $name=$session->param("name");
  219. if (defined $name) {
  220. if (grep { $name eq $_ } @{$config{banned_users}}) {
  221. $session->delete();
  222. cgi_savesession($session);
  223. cgi_custom_failure(
  224. $q->header(-status => "403 Forbidden"),
  225. gettext("You are banned."));
  226. }
  227. }
  228. }
  229. sub cgi_getsession ($) {
  230. my $q=shift;
  231. eval q{use CGI::Session; use HTML::Entities};
  232. error($@) if $@;
  233. CGI::Session->name("ikiwiki_session_".encode_entities($config{wikiname}));
  234. my $oldmask=umask(077);
  235. my $session = eval {
  236. CGI::Session->new("driver:DB_File", $q,
  237. { FileName => "$config{wikistatedir}/sessions.db" })
  238. };
  239. if (! $session || $@) {
  240. error($@." ".CGI::Session->errstr());
  241. }
  242. umask($oldmask);
  243. return $session;
  244. }
  245. # To guard against CSRF, the user's session id (sid)
  246. # can be stored on a form. This function will check
  247. # (for logged in users) that the sid on the form matches
  248. # the session id in the cookie.
  249. sub checksessionexpiry ($$) {
  250. my $q=shift;
  251. my $session = shift;
  252. if (defined $session->param("name")) {
  253. my $sid=$q->param('sid');
  254. if (! defined $sid || $sid ne $session->id) {
  255. error(gettext("Your login session has expired."));
  256. }
  257. }
  258. }
  259. sub cgi_savesession ($) {
  260. my $session=shift;
  261. # Force session flush with safe umask.
  262. my $oldmask=umask(077);
  263. $session->flush;
  264. umask($oldmask);
  265. }
  266. sub cgi (;$$) {
  267. my $q=shift;
  268. my $session=shift;
  269. eval q{use CGI};
  270. error($@) if $@;
  271. $CGI::DISABLE_UPLOADS=$config{cgi_disable_uploads};
  272. if (! $q) {
  273. binmode(STDIN);
  274. $q=CGI->new;
  275. binmode(STDIN, ":utf8");
  276. run_hooks(cgi => sub { shift->($q) });
  277. }
  278. my $do=$q->param('do');
  279. if (! defined $do || ! length $do) {
  280. my $error = $q->cgi_error;
  281. if ($error) {
  282. error("Request not processed: $error");
  283. }
  284. else {
  285. error("\"do\" parameter missing");
  286. }
  287. }
  288. # Need to lock the wiki before getting a session.
  289. lockwiki();
  290. loadindex();
  291. if (! $session) {
  292. $session=cgi_getsession($q);
  293. }
  294. # Auth hooks can sign a user in.
  295. if ($do ne 'signin' && ! defined $session->param("name")) {
  296. run_hooks(auth => sub {
  297. shift->($q, $session)
  298. });
  299. if (defined $session->param("name")) {
  300. # Make sure whatever user was authed is in the
  301. # userinfo db.
  302. if (! userinfo_get($session->param("name"), "regdate")) {
  303. userinfo_setall($session->param("name"), {
  304. email => "",
  305. password => "",
  306. regdate => time,
  307. }) || error("failed adding user");
  308. }
  309. }
  310. }
  311. check_banned($q, $session);
  312. run_hooks(sessioncgi => sub { shift->($q, $session) });
  313. if ($do eq 'signin') {
  314. cgi_signin($q, $session);
  315. cgi_savesession($session);
  316. }
  317. elsif ($do eq 'prefs') {
  318. cgi_prefs($q, $session);
  319. }
  320. elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
  321. cgi_postsignin($q, $session);
  322. }
  323. else {
  324. error("unknown do parameter");
  325. }
  326. }
  327. # Does not need to be called directly; all errors will go through here.
  328. sub cgierror ($) {
  329. my $message=shift;
  330. print "Content-type: text/html\n\n";
  331. print misctemplate(gettext("Error"),
  332. "<p class=\"error\">".gettext("Error").": $message</p>");
  333. die $@;
  334. }
  335. 1