summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 015c9ae01fbde4f3be3a85bf28f4a429fba54881 (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub printheader ($) { #{{{
  10. my $session=shift;
  11. if ($config{sslcookie}) {
  12. print $session->header(-charset => 'utf-8',
  13. -cookie => $session->cookie(-secure => 1));
  14. } else {
  15. print $session->header(-charset => 'utf-8');
  16. }
  17. } #}}}
  18. sub showform ($$$$;@) { #{{{
  19. my $form=shift;
  20. my $buttons=shift;
  21. my $session=shift;
  22. my $cgi=shift;
  23. if (exists $hooks{formbuilder}) {
  24. run_hooks(formbuilder => sub {
  25. shift->(form => $form, cgi => $cgi, session => $session,
  26. buttons => $buttons);
  27. });
  28. }
  29. printheader($session);
  30. print misctemplate($form->title, $form->render(submit => $buttons), @_);
  31. }
  32. sub redirect ($$) { #{{{
  33. my $q=shift;
  34. my $url=shift;
  35. if (! $config{w3mmode}) {
  36. print $q->redirect($url);
  37. }
  38. else {
  39. print "Content-type: text/plain\n";
  40. print "W3m-control: GOTO $url\n\n";
  41. }
  42. } #}}}
  43. sub check_canedit ($$$;$) { #{{{
  44. my $page=shift;
  45. my $q=shift;
  46. my $session=shift;
  47. my $nonfatal=shift;
  48. my $canedit;
  49. run_hooks(canedit => sub {
  50. return if defined $canedit;
  51. my $ret=shift->($page, $q, $session);
  52. if (defined $ret) {
  53. if ($ret eq "") {
  54. $canedit=1;
  55. }
  56. elsif (ref $ret eq 'CODE') {
  57. $ret->() unless $nonfatal;
  58. $canedit=0;
  59. }
  60. elsif (defined $ret) {
  61. error($ret) unless $nonfatal;
  62. $canedit=0;
  63. }
  64. }
  65. });
  66. return $canedit;
  67. } #}}}
  68. sub decode_cgi_utf8 ($) { #{{{
  69. # decode_form_utf8 method is needed for 5.10
  70. if ($] < 5.01) {
  71. my $cgi = shift;
  72. foreach my $f ($cgi->param) {
  73. $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
  74. }
  75. }
  76. } #}}}
  77. sub decode_form_utf8 ($) { #{{{
  78. if ($] >= 5.01) {
  79. my $form = shift;
  80. foreach my $f ($form->field) {
  81. $form->field(name => $f,
  82. value => decode_utf8($form->field($f)),
  83. force => 1,
  84. );
  85. }
  86. }
  87. } #}}}
  88. # Check if the user is signed in. If not, redirect to the signin form and
  89. # save their place to return to later.
  90. sub needsignin ($$) { #{{{
  91. my $q=shift;
  92. my $session=shift;
  93. if (! defined $session->param("name") ||
  94. ! userinfo_get($session->param("name"), "regdate")) {
  95. $session->param(postsignin => $ENV{QUERY_STRING});
  96. cgi_signin($q, $session);
  97. cgi_savesession($session);
  98. exit;
  99. }
  100. } #}}}
  101. sub cgi_signin ($$) { #{{{
  102. my $q=shift;
  103. my $session=shift;
  104. decode_cgi_utf8($q);
  105. eval q{use CGI::FormBuilder};
  106. error($@) if $@;
  107. my $form = CGI::FormBuilder->new(
  108. title => "signin",
  109. name => "signin",
  110. charset => "utf-8",
  111. method => 'POST',
  112. required => 'NONE',
  113. javascript => 0,
  114. params => $q,
  115. action => $config{cgiurl},
  116. header => 0,
  117. template => {type => 'div'},
  118. stylesheet => baseurl()."style.css",
  119. );
  120. my $buttons=["Login"];
  121. if ($q->param("do") ne "signin" && !$form->submitted) {
  122. $form->text(gettext("You need to log in first."));
  123. }
  124. $form->field(name => "do", type => "hidden", value => "signin",
  125. force => 1);
  126. decode_form_utf8($form);
  127. run_hooks(formbuilder_setup => sub {
  128. shift->(form => $form, cgi => $q, session => $session,
  129. buttons => $buttons);
  130. });
  131. decode_form_utf8($form);
  132. if ($form->submitted) {
  133. $form->validate;
  134. }
  135. showform($form, $buttons, $session, $q);
  136. } #}}}
  137. sub cgi_postsignin ($$) { #{{{
  138. my $q=shift;
  139. my $session=shift;
  140. # Continue with whatever was being done before the signin process.
  141. if (defined $session->param("postsignin")) {
  142. my $postsignin=CGI->new($session->param("postsignin"));
  143. $session->clear("postsignin");
  144. cgi($postsignin, $session);
  145. cgi_savesession($session);
  146. exit;
  147. }
  148. else {
  149. error(gettext("login failed, perhaps you need to turn on cookies?"));
  150. }
  151. } #}}}
  152. sub cgi_prefs ($$) { #{{{
  153. my $q=shift;
  154. my $session=shift;
  155. needsignin($q, $session);
  156. decode_cgi_utf8($q);
  157. # The session id is stored on the form and checked to
  158. # guard against CSRF.
  159. my $sid=$q->param('sid');
  160. if (! defined $sid) {
  161. $q->delete_all;
  162. }
  163. elsif ($sid ne $session->id) {
  164. error(gettext("Your login session has expired."));
  165. }
  166. eval q{use CGI::FormBuilder};
  167. error($@) if $@;
  168. my $form = CGI::FormBuilder->new(
  169. title => "preferences",
  170. name => "preferences",
  171. header => 0,
  172. charset => "utf-8",
  173. method => 'POST',
  174. validate => {
  175. email => 'EMAIL',
  176. },
  177. required => 'NONE',
  178. javascript => 0,
  179. params => $q,
  180. action => $config{cgiurl},
  181. template => {type => 'div'},
  182. stylesheet => baseurl()."style.css",
  183. fieldsets => [
  184. [login => gettext("Login")],
  185. [preferences => gettext("Preferences")],
  186. [admin => gettext("Admin")]
  187. ],
  188. );
  189. my $buttons=["Save Preferences", "Logout", "Cancel"];
  190. decode_form_utf8($form);
  191. run_hooks(formbuilder_setup => sub {
  192. shift->(form => $form, cgi => $q, session => $session,
  193. buttons => $buttons);
  194. });
  195. decode_form_utf8($form);
  196. $form->field(name => "do", type => "hidden", value => "prefs",
  197. force => 1);
  198. $form->field(name => "sid", type => "hidden", value => $session->id,
  199. force => 1);
  200. $form->field(name => "email", size => 50, fieldset => "preferences");
  201. $form->field(name => "banned_users", size => 50,
  202. fieldset => "admin");
  203. my $user_name=$session->param("name");
  204. if (! is_admin($user_name)) {
  205. $form->field(name => "banned_users", type => "hidden");
  206. }
  207. if (! $form->submitted) {
  208. $form->field(name => "email", force => 1,
  209. value => userinfo_get($user_name, "email"));
  210. if (is_admin($user_name)) {
  211. $form->field(name => "banned_users", force => 1,
  212. value => join(" ", get_banned_users()));
  213. }
  214. }
  215. if ($form->submitted eq 'Logout') {
  216. $session->delete();
  217. redirect($q, $config{url});
  218. return;
  219. }
  220. elsif ($form->submitted eq 'Cancel') {
  221. redirect($q, $config{url});
  222. return;
  223. }
  224. elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
  225. if (defined $form->field('email')) {
  226. userinfo_set($user_name, 'email', $form->field('email')) ||
  227. error("failed to set email");
  228. }
  229. if (is_admin($user_name)) {
  230. set_banned_users(grep { ! is_admin($_) }
  231. split(' ',
  232. $form->field("banned_users"))) ||
  233. error("failed saving changes");
  234. }
  235. $form->text(gettext("Preferences saved."));
  236. }
  237. showform($form, $buttons, $session, $q);
  238. } #}}}
  239. sub cgi_editpage ($$) { #{{{
  240. my $q=shift;
  241. my $session=shift;
  242. decode_cgi_utf8($q);
  243. my @fields=qw(do rcsinfo subpage from page type editcontent comments);
  244. my @buttons=("Save Page", "Preview", "Cancel");
  245. eval q{use CGI::FormBuilder};
  246. error($@) if $@;
  247. my $form = CGI::FormBuilder->new(
  248. title => "editpage",
  249. fields => \@fields,
  250. charset => "utf-8",
  251. method => 'POST',
  252. required => [qw{editcontent}],
  253. javascript => 0,
  254. params => $q,
  255. action => $config{cgiurl},
  256. header => 0,
  257. table => 0,
  258. template => scalar template_params("editpage.tmpl"),
  259. wikiname => $config{wikiname},
  260. );
  261. decode_form_utf8($form);
  262. run_hooks(formbuilder_setup => sub {
  263. shift->(form => $form, cgi => $q, session => $session,
  264. buttons => \@buttons);
  265. });
  266. decode_form_utf8($form);
  267. # This untaint is safe because titlepage removes any problematic
  268. # characters.
  269. my ($page)=$form->field('page');
  270. $page=titlepage(possibly_foolish_untaint($page));
  271. if (! defined $page || ! length $page ||
  272. file_pruned($page, $config{srcdir}) || $page=~/^\//) {
  273. error("bad page name");
  274. }
  275. my $baseurl=$config{url}."/".htmlpage($page);
  276. my $from;
  277. if (defined $form->field('from')) {
  278. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  279. }
  280. my $file;
  281. my $type;
  282. if (exists $pagesources{$page} && $form->field("do") ne "create") {
  283. $file=$pagesources{$page};
  284. $type=pagetype($file);
  285. if (! defined $type || $type=~/^_/) {
  286. error(sprintf(gettext("%s is not an editable page"), $page));
  287. }
  288. if (! $form->submitted) {
  289. $form->field(name => "rcsinfo",
  290. value => rcs_prepedit($file), force => 1);
  291. }
  292. $form->field(name => "editcontent", validate => '/.*/');
  293. }
  294. else {
  295. $type=$form->param('type');
  296. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  297. $type=possibly_foolish_untaint($type);
  298. }
  299. elsif (defined $from && exists $pagesources{$from}) {
  300. # favor the type of linking page
  301. $type=pagetype($pagesources{$from});
  302. }
  303. $type=$config{default_pageext} unless defined $type;
  304. $file=$page.".".$type;
  305. if (! $form->submitted) {
  306. $form->field(name => "rcsinfo", value => "", force => 1);
  307. }
  308. $form->field(name => "editcontent", validate => '/.+/');
  309. }
  310. $form->field(name => "do", type => 'hidden');
  311. $form->field(name => "sid", type => "hidden", value => $session->id,
  312. force => 1);
  313. $form->field(name => "from", type => 'hidden');
  314. $form->field(name => "rcsinfo", type => 'hidden');
  315. $form->field(name => "subpage", type => 'hidden');
  316. $form->field(name => "page", value => pagetitle($page, 1), force => 1);
  317. $form->field(name => "type", value => $type, force => 1);
  318. $form->field(name => "comments", type => "text", size => 80);
  319. $form->field(name => "editcontent", type => "textarea", rows => 20,
  320. cols => 80);
  321. $form->tmpl_param("can_commit", $config{rcs});
  322. $form->tmpl_param("indexlink", indexlink());
  323. $form->tmpl_param("helponformattinglink",
  324. htmllink($page, $page, "ikiwiki/formatting",
  325. noimageinline => 1,
  326. linktext => "FormattingHelp"));
  327. if ($form->submitted eq "Cancel") {
  328. if ($form->field("do") eq "create" && defined $from) {
  329. redirect($q, "$config{url}/".htmlpage($from));
  330. }
  331. elsif ($form->field("do") eq "create") {
  332. redirect($q, $config{url});
  333. }
  334. else {
  335. redirect($q, "$config{url}/".htmlpage($page));
  336. }
  337. return;
  338. }
  339. elsif ($form->submitted eq "Preview") {
  340. my $new=not exists $pagesources{$page};
  341. if ($new) {
  342. # temporarily record its type
  343. $pagesources{$page}=$page.".".$type;
  344. }
  345. my $content=$form->field('editcontent');
  346. run_hooks(editcontent => sub {
  347. $content=shift->(
  348. content => $content,
  349. page => $page,
  350. cgi => $q,
  351. session => $session,
  352. );
  353. });
  354. my $preview=htmlize($page, $page, $type,
  355. linkify($page, $page,
  356. preprocess($page, $page,
  357. filter($page, $page, $content), 0, 1)));
  358. run_hooks(format => sub {
  359. $preview=shift->(
  360. page => $page,
  361. content => $preview,
  362. );
  363. });
  364. $form->tmpl_param("page_preview", $preview);
  365. if ($new) {
  366. delete $pagesources{$page};
  367. }
  368. # previewing may have created files on disk
  369. saveindex();
  370. }
  371. elsif ($form->submitted eq "Save Page") {
  372. $form->tmpl_param("page_preview", "");
  373. }
  374. $form->tmpl_param("page_conflict", "");
  375. if ($form->submitted ne "Save Page" || ! $form->validate) {
  376. if ($form->field("do") eq "create") {
  377. my @page_locs;
  378. my $best_loc;
  379. if (! defined $from || ! length $from ||
  380. $from ne $form->field('from') ||
  381. file_pruned($from, $config{srcdir}) ||
  382. $from=~/^\// ||
  383. $form->submitted eq "Preview") {
  384. @page_locs=$best_loc=$page;
  385. }
  386. else {
  387. my $dir=$from."/";
  388. $dir=~s![^/]+/+$!!;
  389. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  390. $page eq gettext('discussion')) {
  391. $best_loc="$from/$page";
  392. }
  393. else {
  394. $best_loc=$dir.$page;
  395. }
  396. push @page_locs, $dir.$page;
  397. push @page_locs, "$from/$page";
  398. while (length $dir) {
  399. $dir=~s![^/]+/+$!!;
  400. push @page_locs, $dir.$page;
  401. }
  402. push @page_locs, "$config{userdir}/$page"
  403. if length $config{userdir};
  404. }
  405. @page_locs = grep {
  406. ! exists $pagecase{lc $_}
  407. } @page_locs;
  408. if (! @page_locs) {
  409. # hmm, someone else made the page in the
  410. # meantime?
  411. if ($form->submitted eq "Preview") {
  412. # let them go ahead with the edit
  413. # and resolve the conflict at save
  414. # time
  415. @page_locs=$page;
  416. }
  417. else {
  418. redirect($q, "$config{url}/".htmlpage($page));
  419. return;
  420. }
  421. }
  422. my @editable_locs = grep {
  423. check_canedit($_, $q, $session, 1)
  424. } @page_locs;
  425. if (! @editable_locs) {
  426. # let it throw an error this time
  427. map { check_canedit($_, $q, $session) } @page_locs;
  428. }
  429. my @page_types;
  430. if (exists $hooks{htmlize}) {
  431. @page_types=grep { !/^_/ }
  432. keys %{$hooks{htmlize}};
  433. }
  434. $form->tmpl_param("page_select", 1);
  435. $form->field(name => "page", type => 'select',
  436. options => [ map { pagetitle($_, 1) } @editable_locs ],
  437. value => pagetitle($best_loc, 1));
  438. $form->field(name => "type", type => 'select',
  439. options => \@page_types);
  440. $form->title(sprintf(gettext("creating %s"), pagetitle($page)));
  441. }
  442. elsif ($form->field("do") eq "edit") {
  443. check_canedit($page, $q, $session);
  444. if (! defined $form->field('editcontent') ||
  445. ! length $form->field('editcontent')) {
  446. my $content="";
  447. if (exists $pagesources{$page}) {
  448. $content=readfile(srcfile($pagesources{$page}));
  449. $content=~s/\n/\r\n/g;
  450. }
  451. $form->field(name => "editcontent", value => $content,
  452. force => 1);
  453. }
  454. $form->tmpl_param("page_select", 0);
  455. $form->field(name => "page", type => 'hidden');
  456. $form->field(name => "type", type => 'hidden');
  457. $form->title(sprintf(gettext("editing %s"), pagetitle($page)));
  458. }
  459. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  460. }
  461. else {
  462. # save page
  463. check_canedit($page, $q, $session);
  464. # The session id is stored on the form and checked to
  465. # guard against CSRF. But only if the user is logged in,
  466. # as anonok can allow anonymous edits.
  467. if (defined $session->param("name")) {
  468. my $sid=$q->param('sid');
  469. if (! defined $sid || $sid ne $session->id) {
  470. error(gettext("Your login session has expired."));
  471. }
  472. }
  473. my $exists=-e "$config{srcdir}/$file";
  474. if ($form->field("do") ne "create" && ! $exists &&
  475. ! defined srcfile($file, 1)) {
  476. $form->tmpl_param("page_gone", 1);
  477. $form->field(name => "do", value => "create", force => 1);
  478. $form->tmpl_param("page_select", 0);
  479. $form->field(name => "page", type => 'hidden');
  480. $form->field(name => "type", type => 'hidden');
  481. $form->title(sprintf(gettext("editing %s"), $page));
  482. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  483. return;
  484. }
  485. elsif ($form->field("do") eq "create" && $exists) {
  486. $form->tmpl_param("creation_conflict", 1);
  487. $form->field(name => "do", value => "edit", force => 1);
  488. $form->tmpl_param("page_select", 0);
  489. $form->field(name => "page", type => 'hidden');
  490. $form->field(name => "type", type => 'hidden');
  491. $form->title(sprintf(gettext("editing %s"), $page));
  492. $form->field("editcontent",
  493. value => readfile("$config{srcdir}/$file").
  494. "\n\n\n".$form->field("editcontent"),
  495. force => 1);
  496. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  497. return;
  498. }
  499. my $content=$form->field('editcontent');
  500. run_hooks(editcontent => sub {
  501. $content=shift->(
  502. content => $content,
  503. page => $page,
  504. cgi => $q,
  505. session => $session,
  506. );
  507. });
  508. $content=~s/\r\n/\n/g;
  509. $content=~s/\r/\n/g;
  510. $content.="\n" if $content !~ /\n$/;
  511. $config{cgi}=0; # avoid cgi error message
  512. eval { writefile($file, $config{srcdir}, $content) };
  513. $config{cgi}=1;
  514. if ($@) {
  515. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  516. force => 1);
  517. $form->tmpl_param("failed_save", 1);
  518. $form->tmpl_param("error_message", $@);
  519. $form->field("editcontent", value => $content, force => 1);
  520. $form->tmpl_param("page_select", 0);
  521. $form->field(name => "page", type => 'hidden');
  522. $form->field(name => "type", type => 'hidden');
  523. $form->title(sprintf(gettext("editing %s"), $page));
  524. showform($form, \@buttons, $session, $q,
  525. forcebaseurl => $baseurl);
  526. return;
  527. }
  528. my $conflict;
  529. if ($config{rcs}) {
  530. my $message="";
  531. if (defined $form->field('comments') &&
  532. length $form->field('comments')) {
  533. $message=$form->field('comments');
  534. }
  535. if (! $exists) {
  536. rcs_add($file);
  537. }
  538. # Prevent deadlock with post-commit hook by
  539. # signaling to it that it should not try to
  540. # do anything.
  541. disable_commit_hook();
  542. $conflict=rcs_commit($file, $message,
  543. $form->field("rcsinfo"),
  544. $session->param("name"), $ENV{REMOTE_ADDR});
  545. enable_commit_hook();
  546. rcs_update();
  547. }
  548. # Refresh even if there was a conflict, since other changes
  549. # may have been committed while the post-commit hook was
  550. # disabled.
  551. require IkiWiki::Render;
  552. refresh();
  553. saveindex();
  554. if (defined $conflict) {
  555. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  556. force => 1);
  557. $form->tmpl_param("page_conflict", 1);
  558. $form->field("editcontent", value => $conflict, force => 1);
  559. $form->field("do", "edit", force => 1);
  560. $form->tmpl_param("page_select", 0);
  561. $form->field(name => "page", type => 'hidden');
  562. $form->field(name => "type", type => 'hidden');
  563. $form->title(sprintf(gettext("editing %s"), $page));
  564. showform($form, \@buttons, $session, $q,
  565. forcebaseurl => $baseurl);
  566. return;
  567. }
  568. else {
  569. # The trailing question mark tries to avoid broken
  570. # caches and get the most recent version of the page.
  571. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  572. }
  573. }
  574. } #}}}
  575. sub cgi_getsession ($) { #{{{
  576. my $q=shift;
  577. eval q{use CGI::Session};
  578. error($@) if $@;
  579. CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname}));
  580. my $oldmask=umask(077);
  581. my $session = CGI::Session->new("driver:DB_File", $q,
  582. { FileName => "$config{wikistatedir}/sessions.db" });
  583. umask($oldmask);
  584. return $session;
  585. } #}}}
  586. sub cgi_savesession ($) { #{{{
  587. my $session=shift;
  588. # Force session flush with safe umask.
  589. my $oldmask=umask(077);
  590. $session->flush;
  591. umask($oldmask);
  592. } #}}}
  593. sub cgi (;$$) { #{{{
  594. my $q=shift;
  595. my $session=shift;
  596. if (! $q) {
  597. eval q{use CGI};
  598. error($@) if $@;
  599. binmode(STDIN);
  600. $q=CGI->new;
  601. binmode(STDIN, ":utf8");
  602. run_hooks(cgi => sub { shift->($q) });
  603. }
  604. my $do=$q->param('do');
  605. if (! defined $do || ! length $do) {
  606. my $error = $q->cgi_error;
  607. if ($error) {
  608. error("Request not processed: $error");
  609. }
  610. else {
  611. error("\"do\" parameter missing");
  612. }
  613. }
  614. # Need to lock the wiki before getting a session.
  615. lockwiki();
  616. loadindex();
  617. if (! $session) {
  618. $session=cgi_getsession($q);
  619. }
  620. # Auth hooks can sign a user in.
  621. if ($do ne 'signin' && ! defined $session->param("name")) {
  622. run_hooks(auth => sub {
  623. shift->($q, $session)
  624. });
  625. if (defined $session->param("name")) {
  626. # Make sure whatever user was authed is in the
  627. # userinfo db.
  628. if (! userinfo_get($session->param("name"), "regdate")) {
  629. userinfo_setall($session->param("name"), {
  630. email => "",
  631. password => "",
  632. regdate => time,
  633. }) || error("failed adding user");
  634. }
  635. }
  636. }
  637. if (defined $session->param("name") &&
  638. userinfo_get($session->param("name"), "banned")) {
  639. print $q->header(-status => "403 Forbidden");
  640. $session->delete();
  641. print gettext("You are banned.");
  642. cgi_savesession($session);
  643. }
  644. run_hooks(sessioncgi => sub { shift->($q, $session) });
  645. if ($do eq 'signin') {
  646. cgi_signin($q, $session);
  647. cgi_savesession($session);
  648. }
  649. elsif ($do eq 'prefs') {
  650. cgi_prefs($q, $session);
  651. }
  652. elsif ($do eq 'create' || $do eq 'edit') {
  653. cgi_editpage($q, $session);
  654. }
  655. elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
  656. cgi_postsignin($q, $session);
  657. }
  658. else {
  659. error("unknown do parameter");
  660. }
  661. } #}}}
  662. 1