summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 3f588e427146e3792f19a37ce44cf4b929847aa3 (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub printheader ($) { #{{{
  10. my $session=shift;
  11. if ($config{sslcookie}) {
  12. print $session->header(-charset => 'utf-8',
  13. -cookie => $session->cookie(-secure => 1));
  14. } else {
  15. print $session->header(-charset => 'utf-8');
  16. }
  17. } #}}}
  18. sub showform ($$$$) { #{{{
  19. my $form=shift;
  20. my $buttons=shift;
  21. my $session=shift;
  22. my $cgi=shift;
  23. if (exists $hooks{formbuilder}) {
  24. run_hooks(formbuilder => sub {
  25. shift->(form => $form, cgi => $cgi, session => $session,
  26. buttons => $buttons);
  27. });
  28. }
  29. printheader($session);
  30. print misctemplate($form->title, $form->render(submit => $buttons));
  31. }
  32. sub redirect ($$) { #{{{
  33. my $q=shift;
  34. my $url=shift;
  35. if (! $config{w3mmode}) {
  36. print $q->redirect($url);
  37. }
  38. else {
  39. print "Content-type: text/plain\n";
  40. print "W3m-control: GOTO $url\n\n";
  41. }
  42. } #}}}
  43. sub check_canedit ($$$;$) { #{{{
  44. my $page=shift;
  45. my $q=shift;
  46. my $session=shift;
  47. my $nonfatal=shift;
  48. my $canedit;
  49. run_hooks(canedit => sub {
  50. return if defined $canedit;
  51. my $ret=shift->($page, $q, $session);
  52. if (defined $ret) {
  53. if ($ret eq "") {
  54. $canedit=1;
  55. }
  56. elsif (ref $ret eq 'CODE') {
  57. $ret->() unless $nonfatal;
  58. $canedit=0;
  59. }
  60. elsif (defined $ret) {
  61. error($ret) unless $nonfatal;
  62. $canedit=0;
  63. }
  64. }
  65. });
  66. return $canedit;
  67. } #}}}
  68. sub decode_cgi_utf8 ($) { #{{{
  69. my $cgi = shift;
  70. foreach my $f ($cgi->param) {
  71. $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
  72. }
  73. } #}}}
  74. # Check if the user is signed in. If not, redirect to the signin form and
  75. # save their place to return to later.
  76. sub needsignin ($$) { #{{{
  77. my $q=shift;
  78. my $session=shift;
  79. if (! defined $session->param("name") ||
  80. ! userinfo_get($session->param("name"), "regdate")) {
  81. $session->param(postsignin => $ENV{QUERY_STRING});
  82. cgi_signin($q, $session);
  83. cgi_savesession($session);
  84. exit;
  85. }
  86. } #}}}
  87. sub cgi_signin ($$) { #{{{
  88. my $q=shift;
  89. my $session=shift;
  90. decode_cgi_utf8($q);
  91. eval q{use CGI::FormBuilder};
  92. error($@) if $@;
  93. my $form = CGI::FormBuilder->new(
  94. title => "signin",
  95. name => "signin",
  96. charset => "utf-8",
  97. method => 'POST',
  98. required => 'NONE',
  99. javascript => 0,
  100. params => $q,
  101. action => $config{cgiurl},
  102. header => 0,
  103. template => {type => 'div'},
  104. stylesheet => baseurl()."style.css",
  105. );
  106. my $buttons=["Login"];
  107. if ($q->param("do") ne "signin" && !$form->submitted) {
  108. $form->text(gettext("You need to log in first."));
  109. }
  110. $form->field(name => "do", type => "hidden", value => "signin",
  111. force => 1);
  112. run_hooks(formbuilder_setup => sub {
  113. shift->(form => $form, cgi => $q, session => $session,
  114. buttons => $buttons);
  115. });
  116. if ($form->submitted) {
  117. $form->validate;
  118. }
  119. showform($form, $buttons, $session, $q);
  120. } #}}}
  121. sub cgi_postsignin ($$) { #{{{
  122. my $q=shift;
  123. my $session=shift;
  124. # Continue with whatever was being done before the signin process.
  125. if (defined $session->param("postsignin")) {
  126. my $postsignin=CGI->new($session->param("postsignin"));
  127. $session->clear("postsignin");
  128. cgi($postsignin, $session);
  129. cgi_savesession($session);
  130. exit;
  131. }
  132. else {
  133. error(gettext("login failed, perhaps you need to turn on cookies?"));
  134. }
  135. } #}}}
  136. sub cgi_prefs ($$) { #{{{
  137. my $q=shift;
  138. my $session=shift;
  139. needsignin($q, $session);
  140. decode_cgi_utf8($q);
  141. eval q{use CGI::FormBuilder};
  142. error($@) if $@;
  143. my $form = CGI::FormBuilder->new(
  144. title => "preferences",
  145. name => "preferences",
  146. header => 0,
  147. charset => "utf-8",
  148. method => 'POST',
  149. validate => {
  150. email => 'EMAIL',
  151. },
  152. required => 'NONE',
  153. javascript => 0,
  154. params => $q,
  155. action => $config{cgiurl},
  156. template => {type => 'div'},
  157. stylesheet => baseurl()."style.css",
  158. fieldsets => [
  159. [login => gettext("Login")],
  160. [preferences => gettext("Preferences")],
  161. [admin => gettext("Admin")]
  162. ],
  163. );
  164. my $buttons=["Save Preferences", "Logout", "Cancel"];
  165. run_hooks(formbuilder_setup => sub {
  166. shift->(form => $form, cgi => $q, session => $session,
  167. buttons => $buttons);
  168. });
  169. $form->field(name => "do", type => "hidden");
  170. $form->field(name => "email", size => 50, fieldset => "preferences");
  171. $form->field(name => "banned_users", size => 50,
  172. fieldset => "admin");
  173. my $user_name=$session->param("name");
  174. if (! is_admin($user_name)) {
  175. $form->field(name => "banned_users", type => "hidden");
  176. }
  177. if (! $form->submitted) {
  178. $form->field(name => "email", force => 1,
  179. value => userinfo_get($user_name, "email"));
  180. if (is_admin($user_name)) {
  181. $form->field(name => "banned_users", force => 1,
  182. value => join(" ", get_banned_users()));
  183. }
  184. }
  185. if ($form->submitted eq 'Logout') {
  186. $session->delete();
  187. redirect($q, $config{url});
  188. return;
  189. }
  190. elsif ($form->submitted eq 'Cancel') {
  191. redirect($q, $config{url});
  192. return;
  193. }
  194. elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
  195. if (defined $form->field('email')) {
  196. userinfo_set($user_name, 'email', $form->field('email')) ||
  197. error("failed to set email");
  198. }
  199. if (is_admin($user_name)) {
  200. set_banned_users(grep { ! is_admin($_) }
  201. split(' ',
  202. $form->field("banned_users"))) ||
  203. error("failed saving changes");
  204. }
  205. $form->text(gettext("Preferences saved."));
  206. }
  207. showform($form, $buttons, $session, $q);
  208. } #}}}
  209. sub cgi_editpage ($$) { #{{{
  210. my $q=shift;
  211. my $session=shift;
  212. my @fields=qw(do rcsinfo subpage from page type editcontent comments);
  213. my @buttons=("Save Page", "Preview", "Cancel");
  214. decode_cgi_utf8($q);
  215. eval q{use CGI::FormBuilder};
  216. error($@) if $@;
  217. my $form = CGI::FormBuilder->new(
  218. title => "editpage",
  219. fields => \@fields,
  220. charset => "utf-8",
  221. method => 'POST',
  222. required => [qw{editcontent}],
  223. javascript => 0,
  224. params => $q,
  225. action => $config{cgiurl},
  226. header => 0,
  227. table => 0,
  228. template => scalar template_params("editpage.tmpl"),
  229. wikiname => $config{wikiname},
  230. );
  231. run_hooks(formbuilder_setup => sub {
  232. shift->(form => $form, cgi => $q, session => $session,
  233. buttons => \@buttons);
  234. });
  235. # This untaint is safe because titlepage removes any problematic
  236. # characters.
  237. my ($page)=$form->field('page');
  238. $page=titlepage(possibly_foolish_untaint($page));
  239. if (! defined $page || ! length $page ||
  240. file_pruned($page, $config{srcdir}) || $page=~/^\//) {
  241. error("bad page name");
  242. }
  243. my $from;
  244. if (defined $form->field('from')) {
  245. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  246. }
  247. my $file;
  248. my $type;
  249. if (exists $pagesources{$page} && $form->field("do") ne "create") {
  250. $file=$pagesources{$page};
  251. $type=pagetype($file);
  252. if (! defined $type || $type=~/^_/) {
  253. error(sprintf(gettext("%s is not an editable page"), $page));
  254. }
  255. if (! $form->submitted) {
  256. $form->field(name => "rcsinfo",
  257. value => rcs_prepedit($file), force => 1);
  258. }
  259. $form->field(name => "editcontent", validate => '/.*/');
  260. }
  261. else {
  262. $type=$form->param('type');
  263. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  264. $type=possibly_foolish_untaint($type);
  265. }
  266. elsif (defined $from && exists $pagesources{$from}) {
  267. # favor the type of linking page
  268. $type=pagetype($pagesources{$from});
  269. }
  270. $type=$config{default_pageext} unless defined $type;
  271. $file=$page.".".$type;
  272. if (! $form->submitted) {
  273. $form->field(name => "rcsinfo", value => "", force => 1);
  274. }
  275. $form->field(name => "editcontent", validate => '/.+/');
  276. }
  277. $form->field(name => "do", type => 'hidden');
  278. $form->field(name => "from", type => 'hidden');
  279. $form->field(name => "rcsinfo", type => 'hidden');
  280. $form->field(name => "subpage", type => 'hidden');
  281. $form->field(name => "page", value => pagetitle($page, 1), force => 1);
  282. $form->field(name => "type", value => $type, force => 1);
  283. $form->field(name => "comments", type => "text", size => 80);
  284. $form->field(name => "editcontent", type => "textarea", rows => 20,
  285. cols => 80);
  286. $form->tmpl_param("can_commit", $config{rcs});
  287. $form->tmpl_param("indexlink", indexlink());
  288. $form->tmpl_param("helponformattinglink",
  289. htmllink("", "", "ikiwiki/formatting",
  290. noimageinline => 1,
  291. linktext => "FormattingHelp"));
  292. $form->tmpl_param("baseurl", baseurl());
  293. if ($form->submitted eq "Cancel") {
  294. if ($form->field("do") eq "create" && defined $from) {
  295. redirect($q, "$config{url}/".htmlpage($from));
  296. }
  297. elsif ($form->field("do") eq "create") {
  298. redirect($q, $config{url});
  299. }
  300. else {
  301. redirect($q, "$config{url}/".htmlpage($page));
  302. }
  303. return;
  304. }
  305. elsif ($form->submitted eq "Preview") {
  306. my $content=$form->field('editcontent');
  307. run_hooks(editcontent => sub {
  308. $content=shift->(
  309. content => $content,
  310. page => $page,
  311. cgi => $q,
  312. session => $session,
  313. );
  314. });
  315. $form->tmpl_param("page_preview",
  316. htmlize($page, $type,
  317. linkify($page, "",
  318. preprocess($page, $page,
  319. filter($page, $page, $content), 0, 1))));
  320. }
  321. elsif ($form->submitted eq "Save Page") {
  322. $form->tmpl_param("page_preview", "");
  323. }
  324. $form->tmpl_param("page_conflict", "");
  325. if ($form->submitted ne "Save Page" || ! $form->validate) {
  326. if ($form->field("do") eq "create") {
  327. my @page_locs;
  328. my $best_loc;
  329. if (! defined $from || ! length $from ||
  330. $from ne $form->field('from') ||
  331. file_pruned($from, $config{srcdir}) ||
  332. $from=~/^\// ||
  333. $form->submitted eq "Preview") {
  334. @page_locs=$best_loc=$page;
  335. }
  336. else {
  337. my $dir=$from."/";
  338. $dir=~s![^/]+/+$!!;
  339. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  340. $page eq gettext('discussion')) {
  341. $best_loc="$from/$page";
  342. }
  343. else {
  344. $best_loc=$dir.$page;
  345. }
  346. push @page_locs, $dir.$page;
  347. push @page_locs, "$from/$page";
  348. while (length $dir) {
  349. $dir=~s![^/]+/+$!!;
  350. push @page_locs, $dir.$page;
  351. }
  352. }
  353. push @page_locs, "$config{userdir}/$page"
  354. if length $config{userdir};
  355. @page_locs = grep {
  356. ! exists $pagecase{lc $_}
  357. } @page_locs;
  358. if (! @page_locs) {
  359. # hmm, someone else made the page in the
  360. # meantime?
  361. redirect($q, "$config{url}/".htmlpage($page));
  362. return;
  363. }
  364. my @editable_locs = grep {
  365. check_canedit($_, $q, $session, 1)
  366. } @page_locs;
  367. if (! @editable_locs) {
  368. # let it throw an error this time
  369. map { check_canedit($_, $q, $session) } @page_locs;
  370. }
  371. my @page_types;
  372. if (exists $hooks{htmlize}) {
  373. @page_types=grep { !/^_/ }
  374. keys %{$hooks{htmlize}};
  375. }
  376. $form->tmpl_param("page_select", 1);
  377. $form->field(name => "page", type => 'select',
  378. options => [ map { pagetitle($_, 1) } @editable_locs ],
  379. value => pagetitle($best_loc, 1));
  380. $form->field(name => "type", type => 'select',
  381. options => \@page_types);
  382. $form->title(sprintf(gettext("creating %s"), pagetitle($page)));
  383. }
  384. elsif ($form->field("do") eq "edit") {
  385. check_canedit($page, $q, $session);
  386. if (! defined $form->field('editcontent') ||
  387. ! length $form->field('editcontent')) {
  388. my $content="";
  389. if (exists $pagesources{$page}) {
  390. $content=readfile(srcfile($pagesources{$page}));
  391. $content=~s/\n/\r\n/g;
  392. }
  393. $form->field(name => "editcontent", value => $content,
  394. force => 1);
  395. }
  396. $form->tmpl_param("page_select", 0);
  397. $form->field(name => "page", type => 'hidden');
  398. $form->field(name => "type", type => 'hidden');
  399. $form->title(sprintf(gettext("editing %s"), pagetitle($page)));
  400. }
  401. showform($form, \@buttons, $session, $q);
  402. saveindex();
  403. }
  404. else {
  405. # save page
  406. check_canedit($page, $q, $session);
  407. my $exists=-e "$config{srcdir}/$file";
  408. if ($form->field("do") ne "create" && ! $exists &&
  409. ! eval { srcfile($file) }) {
  410. $form->tmpl_param("page_gone", 1);
  411. $form->field(name => "do", value => "create", force => 1);
  412. $form->tmpl_param("page_select", 0);
  413. $form->field(name => "page", type => 'hidden');
  414. $form->field(name => "type", type => 'hidden');
  415. $form->title(sprintf(gettext("editing %s"), $page));
  416. showform($form, \@buttons, $session, $q);
  417. return;
  418. }
  419. elsif ($form->field("do") eq "create" && $exists) {
  420. $form->tmpl_param("creation_conflict", 1);
  421. $form->field(name => "do", value => "edit", force => 1);
  422. $form->tmpl_param("page_select", 0);
  423. $form->field(name => "page", type => 'hidden');
  424. $form->field(name => "type", type => 'hidden');
  425. $form->title(sprintf(gettext("editing %s"), $page));
  426. $form->field("editcontent",
  427. value => readfile("$config{srcdir}/$file").
  428. "\n\n\n".$form->field("editcontent"),
  429. force => 1);
  430. showform($form, \@buttons, $session, $q);
  431. return;
  432. }
  433. my $content=$form->field('editcontent');
  434. run_hooks(editcontent => sub {
  435. $content=shift->(
  436. content => $content,
  437. page => $page,
  438. cgi => $q,
  439. session => $session,
  440. );
  441. });
  442. $content=~s/\r\n/\n/g;
  443. $content=~s/\r/\n/g;
  444. $content.="\n" if $content !~ /\n$/;
  445. $config{cgi}=0; # avoid cgi error message
  446. eval { writefile($file, $config{srcdir}, $content) };
  447. $config{cgi}=1;
  448. if ($@) {
  449. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  450. force => 1);
  451. $form->tmpl_param("failed_save", 1);
  452. $form->tmpl_param("error_message", $@);
  453. $form->field("editcontent", value => $content, force => 1);
  454. $form->tmpl_param("page_select", 0);
  455. $form->field(name => "page", type => 'hidden');
  456. $form->field(name => "type", type => 'hidden');
  457. $form->title(sprintf(gettext("editing %s"), $page));
  458. showform($form, \@buttons, $session, $q);
  459. return;
  460. }
  461. my $conflict;
  462. if ($config{rcs}) {
  463. my $message="";
  464. if (defined $form->field('comments') &&
  465. length $form->field('comments')) {
  466. $message=$form->field('comments');
  467. }
  468. if (! $exists) {
  469. rcs_add($file);
  470. }
  471. # Prevent deadlock with post-commit hook by
  472. # signaling to it that it should not try to
  473. # do anything (except send commit mails).
  474. disable_commit_hook();
  475. $conflict=rcs_commit($file, $message,
  476. $form->field("rcsinfo"),
  477. $session->param("name"), $ENV{REMOTE_ADDR});
  478. enable_commit_hook();
  479. rcs_update();
  480. }
  481. # Refresh even if there was a conflict, since other changes
  482. # may have been committed while the post-commit hook was
  483. # disabled.
  484. require IkiWiki::Render;
  485. refresh();
  486. saveindex();
  487. if (defined $conflict) {
  488. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  489. force => 1);
  490. $form->tmpl_param("page_conflict", 1);
  491. $form->field("editcontent", value => $conflict, force => 1);
  492. $form->field("do", "edit", force => 1);
  493. $form->tmpl_param("page_select", 0);
  494. $form->field(name => "page", type => 'hidden');
  495. $form->field(name => "type", type => 'hidden');
  496. $form->title(sprintf(gettext("editing %s"), $page));
  497. showform($form, \@buttons, $session, $q);
  498. return;
  499. }
  500. else {
  501. # The trailing question mark tries to avoid broken
  502. # caches and get the most recent version of the page.
  503. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  504. }
  505. }
  506. } #}}}
  507. sub cgi_getsession ($) { #{{{
  508. my $q=shift;
  509. eval q{use CGI::Session};
  510. CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname}));
  511. my $oldmask=umask(077);
  512. my $session = CGI::Session->new("driver:DB_File", $q,
  513. { FileName => "$config{wikistatedir}/sessions.db" });
  514. umask($oldmask);
  515. return $session;
  516. } #}}}
  517. sub cgi_savesession ($) { #{{{
  518. my $session=shift;
  519. # Force session flush with safe umask.
  520. my $oldmask=umask(077);
  521. $session->flush;
  522. umask($oldmask);
  523. } #}}}
  524. sub cgi (;$$) { #{{{
  525. my $q=shift;
  526. my $session=shift;
  527. if (! $q) {
  528. eval q{use CGI};
  529. error($@) if $@;
  530. $q=CGI->new;
  531. run_hooks(cgi => sub { shift->($q) });
  532. }
  533. my $do=$q->param('do');
  534. if (! defined $do || ! length $do) {
  535. my $error = $q->cgi_error;
  536. if ($error) {
  537. error("Request not processed: $error");
  538. }
  539. else {
  540. error("\"do\" parameter missing");
  541. }
  542. }
  543. # Need to lock the wiki before getting a session.
  544. lockwiki();
  545. loadindex();
  546. if (! $session) {
  547. $session=cgi_getsession($q);
  548. }
  549. # Auth hooks can sign a user in.
  550. if ($do ne 'signin' && ! defined $session->param("name")) {
  551. run_hooks(auth => sub {
  552. shift->($q, $session)
  553. });
  554. if (defined $session->param("name")) {
  555. # Make sure whatever user was authed is in the
  556. # userinfo db.
  557. if (! userinfo_get($session->param("name"), "regdate")) {
  558. userinfo_setall($session->param("name"), {
  559. email => "",
  560. password => "",
  561. regdate => time,
  562. }) || error("failed adding user");
  563. }
  564. }
  565. }
  566. if (defined $session->param("name") &&
  567. userinfo_get($session->param("name"), "banned")) {
  568. print $q->header(-status => "403 Forbidden");
  569. $session->delete();
  570. print gettext("You are banned.");
  571. cgi_savesession($session);
  572. }
  573. run_hooks(sessioncgi => sub { shift->($q, $session) });
  574. if ($do eq 'signin') {
  575. cgi_signin($q, $session);
  576. cgi_savesession($session);
  577. }
  578. elsif ($do eq 'prefs') {
  579. cgi_prefs($q, $session);
  580. }
  581. elsif ($do eq 'create' || $do eq 'edit') {
  582. cgi_editpage($q, $session);
  583. }
  584. elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
  585. cgi_postsignin($q, $session);
  586. }
  587. else {
  588. error("unknown do parameter");
  589. }
  590. } #}}}
  591. 1