summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 8e0339dc5436097e1727390076903fe3933171a5 (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub printheader ($) { #{{{
  10. my $session=shift;
  11. if ($config{sslcookie}) {
  12. print $session->header(-charset => 'utf-8',
  13. -cookie => $session->cookie(-secure => 1));
  14. } else {
  15. print $session->header(-charset => 'utf-8');
  16. }
  17. } #}}}
  18. sub redirect ($$) { #{{{
  19. my $q=shift;
  20. my $url=shift;
  21. if (! $config{w3mmode}) {
  22. print $q->redirect($url);
  23. }
  24. else {
  25. print "Content-type: text/plain\n";
  26. print "W3m-control: GOTO $url\n\n";
  27. }
  28. } #}}}
  29. sub page_locked ($$;$) { #{{{
  30. my $page=shift;
  31. my $session=shift;
  32. my $nonfatal=shift;
  33. my $user=$session->param("name");
  34. return if defined $user && is_admin($user);
  35. foreach my $admin (@{$config{adminuser}}) {
  36. my $locked_pages=userinfo_get($admin, "locked_pages");
  37. if (pagespec_match($page, userinfo_get($admin, "locked_pages"))) {
  38. return 1 if $nonfatal;
  39. error(htmllink("", "", $page, 1)." is locked by ".
  40. htmllink("", "", $admin, 1)." and cannot be edited.");
  41. }
  42. }
  43. return 0;
  44. } #}}}
  45. sub decode_form_utf8 ($) { #{{{
  46. my $form = shift;
  47. foreach my $f ($form->field) {
  48. next if Encode::is_utf8(scalar $form->field($f));
  49. $form->field(name => $f,
  50. value => decode_utf8($form->field($f)),
  51. force => 1,
  52. );
  53. }
  54. } #}}}
  55. sub cgi_recentchanges ($) { #{{{
  56. my $q=shift;
  57. unlockwiki();
  58. # Optimisation: building recentchanges means calculating lots of
  59. # links. Memoizing htmllink speeds it up a lot (can't be memoized
  60. # during page builds as the return values may change, but they
  61. # won't here.)
  62. eval q{use Memoize};
  63. memoize("htmllink");
  64. my $template=template("recentchanges.tmpl");
  65. $template->param(
  66. title => "RecentChanges",
  67. indexlink => indexlink(),
  68. wikiname => $config{wikiname},
  69. changelog => [rcs_recentchanges(100)],
  70. baseurl => baseurl(),
  71. );
  72. print $q->header(-charset => 'utf-8'), $template->output;
  73. } #}}}
  74. sub cgi_signin ($$) { #{{{
  75. my $q=shift;
  76. my $session=shift;
  77. eval q{use CGI::FormBuilder};
  78. my $form = CGI::FormBuilder->new(
  79. title => "signin",
  80. fields => [qw(do title page subpage from name password confirm_password email)],
  81. header => 1,
  82. charset => "utf-8",
  83. method => 'POST',
  84. validate => {
  85. confirm_password => {
  86. perl => q{eq $form->field("password")},
  87. },
  88. email => 'EMAIL',
  89. },
  90. required => 'NONE',
  91. javascript => 0,
  92. params => $q,
  93. action => $config{cgiurl},
  94. header => 0,
  95. template => (-e "$config{templatedir}/signin.tmpl" ?
  96. {template_params("signin.tmpl")} : ""),
  97. stylesheet => baseurl()."style.css",
  98. );
  99. decode_form_utf8($form);
  100. $form->field(name => "name", required => 0);
  101. $form->field(name => "do", type => "hidden");
  102. $form->field(name => "page", type => "hidden");
  103. $form->field(name => "title", type => "hidden");
  104. $form->field(name => "from", type => "hidden");
  105. $form->field(name => "subpage", type => "hidden");
  106. $form->field(name => "password", type => "password", required => 0);
  107. $form->field(name => "confirm_password", type => "password", required => 0);
  108. $form->field(name => "email", required => 0);
  109. if ($q->param("do") ne "signin" && !$form->submitted) {
  110. $form->text("You need to log in first.");
  111. }
  112. if ($form->submitted) {
  113. # Set required fields based on how form was submitted.
  114. my %required=(
  115. "Login" => [qw(name password)],
  116. "Register" => [qw(name password confirm_password email)],
  117. "Mail Password" => [qw(name)],
  118. );
  119. foreach my $opt (@{$required{$form->submitted}}) {
  120. $form->field(name => $opt, required => 1);
  121. }
  122. # Validate password differently depending on how
  123. # form was submitted.
  124. if ($form->submitted eq 'Login') {
  125. $form->field(
  126. name => "password",
  127. validate => sub {
  128. length $form->field("name") &&
  129. shift eq userinfo_get($form->field("name"), 'password');
  130. },
  131. );
  132. $form->field(name => "name", validate => '/^\w+$/');
  133. }
  134. else {
  135. $form->field(name => "password", validate => 'VALUE');
  136. }
  137. # And make sure the entered name exists when logging
  138. # in or sending email, and does not when registering.
  139. if ($form->submitted eq 'Register') {
  140. $form->field(
  141. name => "name",
  142. validate => sub {
  143. my $name=shift;
  144. length $name &&
  145. $name=~/$config{wiki_file_regexp}/ &&
  146. ! userinfo_get($name, "regdate");
  147. },
  148. );
  149. }
  150. else {
  151. $form->field(
  152. name => "name",
  153. validate => sub {
  154. my $name=shift;
  155. length $name &&
  156. userinfo_get($name, "regdate");
  157. },
  158. );
  159. }
  160. }
  161. else {
  162. # First time settings.
  163. $form->field(name => "name", comment => "use FirstnameLastName");
  164. $form->field(name => "confirm_password", comment => "(only needed");
  165. $form->field(name => "email", comment => "for registration)");
  166. if ($session->param("name")) {
  167. $form->field(name => "name", value => $session->param("name"));
  168. }
  169. }
  170. if ($form->submitted && $form->validate) {
  171. if ($form->submitted eq 'Login') {
  172. $session->param("name", $form->field("name"));
  173. if (defined $form->field("do") &&
  174. $form->field("do") ne 'signin') {
  175. redirect($q, cgiurl(
  176. do => $form->field("do"),
  177. page => $form->field("page"),
  178. title => $form->field("title"),
  179. subpage => $form->field("subpage"),
  180. from => $form->field("from"),
  181. ));
  182. }
  183. else {
  184. redirect($q, $config{url});
  185. }
  186. }
  187. elsif ($form->submitted eq 'Register') {
  188. my $user_name=$form->field('name');
  189. if (userinfo_setall($user_name, {
  190. 'email' => $form->field('email'),
  191. 'password' => $form->field('password'),
  192. 'regdate' => time
  193. })) {
  194. $form->field(name => "confirm_password", type => "hidden");
  195. $form->field(name => "email", type => "hidden");
  196. $form->text("Registration successful. Now you can Login.");
  197. printheader($session);
  198. print misctemplate($form->title, $form->render(submit => ["Login"]));
  199. }
  200. else {
  201. error("Error saving registration.");
  202. }
  203. }
  204. elsif ($form->submitted eq 'Mail Password') {
  205. my $user_name=$form->field("name");
  206. my $template=template("passwordmail.tmpl");
  207. $template->param(
  208. user_name => $user_name,
  209. user_password => userinfo_get($user_name, "password"),
  210. wikiurl => $config{url},
  211. wikiname => $config{wikiname},
  212. REMOTE_ADDR => $ENV{REMOTE_ADDR},
  213. );
  214. eval q{use Mail::Sendmail};
  215. sendmail(
  216. To => userinfo_get($user_name, "email"),
  217. From => "$config{wikiname} admin <$config{adminemail}>",
  218. Subject => "$config{wikiname} information",
  219. Message => $template->output,
  220. ) or error("Failed to send mail");
  221. $form->text("Your password has been emailed to you.");
  222. $form->field(name => "name", required => 0);
  223. printheader($session);
  224. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  225. }
  226. }
  227. else {
  228. printheader($session);
  229. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  230. }
  231. } #}}}
  232. sub cgi_prefs ($$) { #{{{
  233. my $q=shift;
  234. my $session=shift;
  235. eval q{use CGI::FormBuilder};
  236. my $form = CGI::FormBuilder->new(
  237. title => "preferences",
  238. fields => [qw(do name password confirm_password email
  239. subscriptions locked_pages)],
  240. header => 0,
  241. charset => "utf-8",
  242. method => 'POST',
  243. validate => {
  244. confirm_password => {
  245. perl => q{eq $form->field("password")},
  246. },
  247. email => 'EMAIL',
  248. },
  249. required => 'NONE',
  250. javascript => 0,
  251. params => $q,
  252. action => $config{cgiurl},
  253. template => (-e "$config{templatedir}/prefs.tmpl" ?
  254. {template_params("prefs.tmpl")} : ""),
  255. stylesheet => baseurl()."style.css",
  256. );
  257. my @buttons=("Save Preferences", "Logout", "Cancel");
  258. my $user_name=$session->param("name");
  259. $form->field(name => "do", type => "hidden");
  260. $form->field(name => "name", disabled => 1,
  261. value => $user_name, force => 1);
  262. $form->field(name => "password", type => "password");
  263. $form->field(name => "confirm_password", type => "password");
  264. $form->field(name => "subscriptions", size => 50,
  265. comment => "(".htmllink("", "", "PageSpec", 1).")");
  266. $form->field(name => "locked_pages", size => 50,
  267. comment => "(".htmllink("", "", "PageSpec", 1).")");
  268. if (! is_admin($user_name)) {
  269. $form->field(name => "locked_pages", type => "hidden");
  270. }
  271. if (! $form->submitted) {
  272. $form->field(name => "email", force => 1,
  273. value => userinfo_get($user_name, "email"));
  274. $form->field(name => "subscriptions", force => 1,
  275. value => userinfo_get($user_name, "subscriptions"));
  276. $form->field(name => "locked_pages", force => 1,
  277. value => userinfo_get($user_name, "locked_pages"));
  278. }
  279. decode_form_utf8($form);
  280. if ($form->submitted eq 'Logout') {
  281. $session->delete();
  282. redirect($q, $config{url});
  283. return;
  284. }
  285. elsif ($form->submitted eq 'Cancel') {
  286. redirect($q, $config{url});
  287. return;
  288. }
  289. elsif ($form->submitted eq "Save Preferences" && $form->validate) {
  290. foreach my $field (qw(password email subscriptions locked_pages)) {
  291. if (length $form->field($field)) {
  292. userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field");
  293. }
  294. }
  295. $form->text("Preferences saved.");
  296. }
  297. printheader($session);
  298. print misctemplate($form->title, $form->render(submit => \@buttons));
  299. } #}}}
  300. sub cgi_editpage ($$) { #{{{
  301. my $q=shift;
  302. my $session=shift;
  303. eval q{use CGI::FormBuilder};
  304. my $form = CGI::FormBuilder->new(
  305. fields => [qw(do rcsinfo subpage from page type editcontent comments)],
  306. header => 1,
  307. charset => "utf-8",
  308. method => 'POST',
  309. validate => {
  310. editcontent => '/.+/',
  311. },
  312. required => [qw{editcontent}],
  313. javascript => 0,
  314. params => $q,
  315. action => $config{cgiurl},
  316. table => 0,
  317. template => {template_params("editpage.tmpl")},
  318. );
  319. my @buttons=("Save Page", "Preview", "Cancel");
  320. decode_form_utf8($form);
  321. # This untaint is safe because titlepage removes any problematic
  322. # characters.
  323. my ($page)=$form->field('page');
  324. $page=titlepage(possibly_foolish_untaint($page));
  325. if (! defined $page || ! length $page ||
  326. $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) {
  327. error("bad page name");
  328. }
  329. my $from;
  330. if (defined $form->field('from')) {
  331. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  332. }
  333. my $file;
  334. my $type;
  335. if (exists $pagesources{$page}) {
  336. $file=$pagesources{$page};
  337. $type=pagetype($file);
  338. }
  339. else {
  340. $type=$form->param('type');
  341. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  342. $type=possibly_foolish_untaint($type);
  343. }
  344. elsif (defined $from) {
  345. # favor the type of linking page
  346. $type=pagetype($pagesources{$from});
  347. }
  348. $type=$config{default_pageext} unless defined $type;
  349. $file=$page.".".$type;
  350. }
  351. my $newfile=0;
  352. if (! -e "$config{srcdir}/$file") {
  353. $newfile=1;
  354. }
  355. $form->field(name => "do", type => 'hidden');
  356. $form->field(name => "from", type => 'hidden');
  357. $form->field(name => "rcsinfo", type => 'hidden');
  358. $form->field(name => "subpage", type => 'hidden');
  359. $form->field(name => "page", value => $page, force => 1);
  360. $form->field(name => "type", value => $type, force => 1);
  361. $form->field(name => "comments", type => "text", size => 80);
  362. $form->field(name => "editcontent", type => "textarea", rows => 20,
  363. cols => 80);
  364. $form->tmpl_param("can_commit", $config{rcs});
  365. $form->tmpl_param("indexlink", indexlink());
  366. $form->tmpl_param("helponformattinglink",
  367. htmllink("", "", "HelpOnFormatting", 1));
  368. $form->tmpl_param("baseurl", baseurl());
  369. if (! $form->submitted) {
  370. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  371. force => 1);
  372. }
  373. if ($form->submitted eq "Cancel") {
  374. redirect($q, "$config{url}/".htmlpage($page));
  375. return;
  376. }
  377. elsif ($form->submitted eq "Preview") {
  378. require IkiWiki::Render;
  379. my $content=$form->field('editcontent');
  380. my $comments=$form->field('comments');
  381. $form->field(name => "editcontent",
  382. value => $content, force => 1);
  383. $form->field(name => "comments",
  384. value => $comments, force => 1);
  385. $config{rss}=0; # avoid preview writing an rss feed!
  386. $form->tmpl_param("page_preview",
  387. htmlize($type,
  388. linkify($page, "",
  389. preprocess($page, $page,
  390. filter($page, $content)))));
  391. }
  392. else {
  393. $form->tmpl_param("page_preview", "");
  394. }
  395. $form->tmpl_param("page_conflict", "");
  396. if (! $form->submitted || $form->submitted eq "Preview" ||
  397. ! $form->validate) {
  398. if ($form->field("do") eq "create") {
  399. my @page_locs;
  400. my $best_loc;
  401. if (! defined $from || ! length $from ||
  402. $from ne $form->field('from') ||
  403. $from=~/$config{wiki_file_prune_regexp}/ ||
  404. $from=~/^\// ||
  405. $form->submitted eq "Preview") {
  406. @page_locs=$best_loc=$page;
  407. }
  408. else {
  409. my $dir=$from."/";
  410. $dir=~s![^/]+/+$!!;
  411. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  412. $page eq 'discussion') {
  413. $best_loc="$from/$page";
  414. }
  415. else {
  416. $best_loc=$dir.$page;
  417. }
  418. push @page_locs, $dir.$page;
  419. push @page_locs, "$from/$page";
  420. while (length $dir) {
  421. $dir=~s![^/]+/+$!!;
  422. push @page_locs, $dir.$page;
  423. }
  424. }
  425. @page_locs = grep {
  426. ! exists $pagecase{lc $_} &&
  427. ! page_locked($_, $session, 1)
  428. } @page_locs;
  429. if (! @page_locs) {
  430. # hmm, someone else made the page in the
  431. # meantime?
  432. redirect($q, "$config{url}/".htmlpage($page));
  433. return;
  434. }
  435. my @page_types;
  436. if (exists $hooks{htmlize}) {
  437. @page_types=keys %{$hooks{htmlize}};
  438. }
  439. $form->tmpl_param("page_select", 1);
  440. $form->field(name => "page", type => 'select',
  441. options => \@page_locs, value => $best_loc);
  442. $form->field(name => "type", type => 'select',
  443. options => \@page_types);
  444. $form->title("creating ".pagetitle($page));
  445. }
  446. elsif ($form->field("do") eq "edit") {
  447. page_locked($page, $session);
  448. if (! defined $form->field('editcontent') ||
  449. ! length $form->field('editcontent')) {
  450. my $content="";
  451. if (exists $pagesources{$page}) {
  452. $content=readfile(srcfile($pagesources{$page}));
  453. $content=~s/\n/\r\n/g;
  454. }
  455. $form->field(name => "editcontent", value => $content,
  456. force => 1);
  457. }
  458. $form->tmpl_param("page_select", 0);
  459. $form->field(name => "page", type => 'hidden');
  460. $form->field(name => "type", type => 'hidden');
  461. $form->title("editing ".pagetitle($page));
  462. }
  463. print $form->render(submit => \@buttons);
  464. }
  465. else {
  466. # save page
  467. page_locked($page, $session);
  468. my $content=$form->field('editcontent');
  469. $content=~s/\r\n/\n/g;
  470. $content=~s/\r/\n/g;
  471. writefile($file, $config{srcdir}, $content);
  472. my $message="web commit ";
  473. if (defined $session->param("name") &&
  474. length $session->param("name")) {
  475. $message.="by ".$session->param("name");
  476. }
  477. else {
  478. $message.="from $ENV{REMOTE_ADDR}";
  479. }
  480. if (defined $form->field('comments') &&
  481. length $form->field('comments')) {
  482. $message.=": ".$form->field('comments');
  483. }
  484. if ($config{rcs}) {
  485. if ($newfile) {
  486. rcs_add($file);
  487. }
  488. # prevent deadlock with post-commit hook
  489. unlockwiki();
  490. # presumably the commit will trigger an update
  491. # of the wiki
  492. my $conflict=rcs_commit($file, $message,
  493. $form->field("rcsinfo"));
  494. if (defined $conflict) {
  495. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  496. force => 1);
  497. $form->tmpl_param("page_conflict", 1);
  498. $form->field("editcontent", value => $conflict, force => 1);
  499. $form->field(name => "comments", value => $form->field('comments'), force => 1);
  500. $form->field("do", "edit)");
  501. $form->tmpl_param("page_select", 0);
  502. $form->field(name => "page", type => 'hidden');
  503. $form->field(name => "type", type => 'hidden');
  504. $form->title("editing $page");
  505. print $form->render(submit => \@buttons);
  506. return;
  507. }
  508. }
  509. else {
  510. require IkiWiki::Render;
  511. refresh();
  512. saveindex();
  513. }
  514. # The trailing question mark tries to avoid broken
  515. # caches and get the most recent version of the page.
  516. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  517. }
  518. } #}}}
  519. sub cgi () { #{{{
  520. eval q{use CGI};
  521. eval q{use CGI::Session};
  522. my $q=CGI->new;
  523. run_hooks(cgi => sub { shift->($q) });
  524. my $do=$q->param('do');
  525. if (! defined $do || ! length $do) {
  526. my $error = $q->cgi_error;
  527. if ($error) {
  528. error("Request not processed: $error");
  529. }
  530. else {
  531. error("\"do\" parameter missing");
  532. }
  533. }
  534. # Things that do not need a session.
  535. if ($do eq 'recentchanges') {
  536. cgi_recentchanges($q);
  537. return;
  538. }
  539. elsif ($do eq 'hyperestraier') {
  540. cgi_hyperestraier();
  541. }
  542. CGI::Session->name("ikiwiki_session_$config{wikiname}");
  543. my $oldmask=umask(077);
  544. my $session = CGI::Session->new("driver:DB_File", $q,
  545. { FileName => "$config{wikistatedir}/sessions.db" });
  546. umask($oldmask);
  547. # Everything below this point needs the user to be signed in.
  548. if (((! $config{anonok} || $do eq 'prefs') &&
  549. (! defined $session->param("name") ||
  550. ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
  551. cgi_signin($q, $session);
  552. # Force session flush with safe umask.
  553. my $oldmask=umask(077);
  554. $session->flush;
  555. umask($oldmask);
  556. return;
  557. }
  558. if ($do eq 'create' || $do eq 'edit') {
  559. cgi_editpage($q, $session);
  560. }
  561. elsif ($do eq 'prefs') {
  562. cgi_prefs($q, $session);
  563. }
  564. elsif ($do eq 'blog') {
  565. my $page=titlepage(decode_utf8($q->param('title')));
  566. # if the page already exists, munge it to be unique
  567. my $from=$q->param('from');
  568. my $add="";
  569. while (exists $pagecase{lc "$from/$page$add"}) {
  570. $add=1 unless length $add;
  571. $add++;
  572. }
  573. $q->param('page', $page.$add);
  574. # now run same as create
  575. $q->param('do', 'create');
  576. cgi_editpage($q, $session);
  577. }
  578. else {
  579. error("unknown do parameter");
  580. }
  581. } #}}}
  582. 1