summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 53e151dc2696eb193dbabf9c61bb9986dcaa6f6a (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub redirect ($$) { #{{{
  10. my $q=shift;
  11. my $url=shift;
  12. if (! $config{w3mmode}) {
  13. print $q->redirect($url);
  14. }
  15. else {
  16. print "Content-type: text/plain\n";
  17. print "W3m-control: GOTO $url\n\n";
  18. }
  19. } #}}}
  20. sub page_locked ($$;$) { #{{{
  21. my $page=shift;
  22. my $session=shift;
  23. my $nonfatal=shift;
  24. my $user=$session->param("name");
  25. return if defined $user && is_admin($user);
  26. foreach my $admin (@{$config{adminuser}}) {
  27. my $locked_pages=userinfo_get($admin, "locked_pages");
  28. if (globlist_match($page, userinfo_get($admin, "locked_pages"))) {
  29. return 1 if $nonfatal;
  30. error(htmllink("", "", $page, 1)." is locked by ".
  31. htmllink("", "", $admin, 1)." and cannot be edited.");
  32. }
  33. }
  34. return 0;
  35. } #}}}
  36. sub cgi_recentchanges ($) { #{{{
  37. my $q=shift;
  38. unlockwiki();
  39. # Optimisation: building recentchanges means calculating lots of
  40. # links. Memoizing htmllink speeds it up a lot (can't be memoized
  41. # during page builds as the return values may change, but they
  42. # won't here.)
  43. eval q{use Memoize};
  44. memoize("htmllink");
  45. my $template=template("recentchanges.tmpl");
  46. $template->param(
  47. title => "RecentChanges",
  48. indexlink => indexlink(),
  49. wikiname => $config{wikiname},
  50. changelog => [rcs_recentchanges(100)],
  51. styleurl => styleurl(),
  52. baseurl => "$config{url}/",
  53. );
  54. print $q->header(-charset=>'utf-8'), $template->output;
  55. } #}}}
  56. sub cgi_signin ($$) { #{{{
  57. my $q=shift;
  58. my $session=shift;
  59. eval q{use CGI::FormBuilder};
  60. my $form = CGI::FormBuilder->new(
  61. title => "signin",
  62. fields => [qw(do title page subpage from name password confirm_password email)],
  63. header => 1,
  64. charset => "utf-8",
  65. method => 'POST',
  66. validate => {
  67. confirm_password => {
  68. perl => q{eq $form->field("password")},
  69. },
  70. email => 'EMAIL',
  71. },
  72. required => 'NONE',
  73. javascript => 0,
  74. params => $q,
  75. action => $config{cgiurl},
  76. header => 0,
  77. template => (-e "$config{templatedir}/signin.tmpl" ?
  78. {template_params("signin.tmpl")} : ""),
  79. stylesheet => styleurl(),
  80. );
  81. $form->field(name => "name", required => 0);
  82. $form->field(name => "do", type => "hidden");
  83. $form->field(name => "page", type => "hidden");
  84. $form->field(name => "title", type => "hidden");
  85. $form->field(name => "from", type => "hidden");
  86. $form->field(name => "subpage", type => "hidden");
  87. $form->field(name => "password", type => "password", required => 0);
  88. $form->field(name => "confirm_password", type => "password", required => 0);
  89. $form->field(name => "email", required => 0);
  90. if ($q->param("do") ne "signin") {
  91. $form->text("You need to log in first.");
  92. }
  93. if ($form->submitted) {
  94. # Set required fields based on how form was submitted.
  95. my %required=(
  96. "Login" => [qw(name password)],
  97. "Register" => [qw(name password confirm_password email)],
  98. "Mail Password" => [qw(name)],
  99. );
  100. foreach my $opt (@{$required{$form->submitted}}) {
  101. $form->field(name => $opt, required => 1);
  102. }
  103. # Validate password differently depending on how
  104. # form was submitted.
  105. if ($form->submitted eq 'Login') {
  106. $form->field(
  107. name => "password",
  108. validate => sub {
  109. length $form->field("name") &&
  110. shift eq userinfo_get($form->field("name"), 'password');
  111. },
  112. );
  113. $form->field(name => "name", validate => '/^\w+$/');
  114. }
  115. else {
  116. $form->field(name => "password", validate => 'VALUE');
  117. }
  118. # And make sure the entered name exists when logging
  119. # in or sending email, and does not when registering.
  120. if ($form->submitted eq 'Register') {
  121. $form->field(
  122. name => "name",
  123. validate => sub {
  124. my $name=shift;
  125. length $name &&
  126. $name=~/$config{wiki_file_regexp}/ &&
  127. ! userinfo_get($name, "regdate");
  128. },
  129. );
  130. }
  131. else {
  132. $form->field(
  133. name => "name",
  134. validate => sub {
  135. my $name=shift;
  136. length $name &&
  137. userinfo_get($name, "regdate");
  138. },
  139. );
  140. }
  141. }
  142. else {
  143. # First time settings.
  144. $form->field(name => "name", comment => "use FirstnameLastName");
  145. $form->field(name => "confirm_password", comment => "(only needed");
  146. $form->field(name => "email", comment => "for registration)");
  147. if ($session->param("name")) {
  148. $form->field(name => "name", value => $session->param("name"));
  149. }
  150. }
  151. if ($form->submitted && $form->validate) {
  152. if ($form->submitted eq 'Login') {
  153. $session->param("name", $form->field("name"));
  154. if (defined $form->field("do") &&
  155. $form->field("do") ne 'signin') {
  156. redirect($q, cgiurl(
  157. do => $form->field("do"),
  158. page => $form->field("page"),
  159. title => $form->field("title"),
  160. subpage => $form->field("subpage"),
  161. from => $form->field("from"),
  162. ));
  163. }
  164. else {
  165. redirect($q, $config{url});
  166. }
  167. }
  168. elsif ($form->submitted eq 'Register') {
  169. my $user_name=$form->field('name');
  170. if (userinfo_setall($user_name, {
  171. 'email' => $form->field('email'),
  172. 'password' => $form->field('password'),
  173. 'regdate' => time
  174. })) {
  175. $form->field(name => "confirm_password", type => "hidden");
  176. $form->field(name => "email", type => "hidden");
  177. $form->text("Registration successful. Now you can Login.");
  178. print $session->header(-charset=>'utf-8');
  179. print misctemplate($form->title, $form->render(submit => ["Login"]));
  180. }
  181. else {
  182. error("Error saving registration.");
  183. }
  184. }
  185. elsif ($form->submitted eq 'Mail Password') {
  186. my $user_name=$form->field("name");
  187. my $template=template("passwordmail.tmpl");
  188. $template->param(
  189. user_name => $user_name,
  190. user_password => userinfo_get($user_name, "password"),
  191. wikiurl => $config{url},
  192. wikiname => $config{wikiname},
  193. REMOTE_ADDR => $ENV{REMOTE_ADDR},
  194. );
  195. eval q{use Mail::Sendmail};
  196. sendmail(
  197. To => userinfo_get($user_name, "email"),
  198. From => "$config{wikiname} admin <$config{adminemail}>",
  199. Subject => "$config{wikiname} information",
  200. Message => $template->output,
  201. ) or error("Failed to send mail");
  202. $form->text("Your password has been emailed to you.");
  203. $form->field(name => "name", required => 0);
  204. print $session->header(-charset=>'utf-8');
  205. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  206. }
  207. }
  208. else {
  209. print $session->header(-charset=>'utf-8');
  210. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  211. }
  212. } #}}}
  213. sub cgi_prefs ($$) { #{{{
  214. my $q=shift;
  215. my $session=shift;
  216. eval q{use CGI::FormBuilder};
  217. my $form = CGI::FormBuilder->new(
  218. title => "preferences",
  219. fields => [qw(do name password confirm_password email
  220. subscriptions locked_pages)],
  221. header => 0,
  222. charset => "utf-8",
  223. method => 'POST',
  224. validate => {
  225. confirm_password => {
  226. perl => q{eq $form->field("password")},
  227. },
  228. email => 'EMAIL',
  229. },
  230. required => 'NONE',
  231. javascript => 0,
  232. params => $q,
  233. action => $config{cgiurl},
  234. template => (-e "$config{templatedir}/prefs.tmpl" ?
  235. {template_params("prefs.tmpl")} : ""),
  236. stylesheet => styleurl(),
  237. );
  238. my @buttons=("Save Preferences", "Logout", "Cancel");
  239. my $user_name=$session->param("name");
  240. $form->field(name => "do", type => "hidden");
  241. $form->field(name => "name", disabled => 1,
  242. value => $user_name, force => 1);
  243. $form->field(name => "password", type => "password");
  244. $form->field(name => "confirm_password", type => "password");
  245. $form->field(name => "subscriptions", size => 50,
  246. comment => "(".htmllink("", "", "GlobList", 1).")");
  247. $form->field(name => "locked_pages", size => 50,
  248. comment => "(".htmllink("", "", "GlobList", 1).")");
  249. if (! is_admin($user_name)) {
  250. $form->field(name => "locked_pages", type => "hidden");
  251. }
  252. if (! $form->submitted) {
  253. $form->field(name => "email", force => 1,
  254. value => userinfo_get($user_name, "email"));
  255. $form->field(name => "subscriptions", force => 1,
  256. value => userinfo_get($user_name, "subscriptions"));
  257. $form->field(name => "locked_pages", force => 1,
  258. value => userinfo_get($user_name, "locked_pages"));
  259. }
  260. if ($form->submitted eq 'Logout') {
  261. $session->delete();
  262. redirect($q, $config{url});
  263. return;
  264. }
  265. elsif ($form->submitted eq 'Cancel') {
  266. redirect($q, $config{url});
  267. return;
  268. }
  269. elsif ($form->submitted eq "Save Preferences" && $form->validate) {
  270. foreach my $field (qw(password email subscriptions locked_pages)) {
  271. if (length $form->field($field)) {
  272. userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field");
  273. }
  274. }
  275. $form->text("Preferences saved.");
  276. }
  277. print $session->header(-charset=>'utf-8');
  278. print misctemplate($form->title, $form->render(submit => \@buttons));
  279. } #}}}
  280. sub cgi_editpage ($$) { #{{{
  281. my $q=shift;
  282. my $session=shift;
  283. eval q{use CGI::FormBuilder};
  284. my $form = CGI::FormBuilder->new(
  285. fields => [qw(do rcsinfo subpage from page editcontent comments)],
  286. header => 1,
  287. charset => "utf-8",
  288. method => 'POST',
  289. validate => {
  290. editcontent => '/.+/',
  291. },
  292. required => [qw{editcontent}],
  293. javascript => 0,
  294. params => $q,
  295. action => $config{cgiurl},
  296. table => 0,
  297. template => {template_params("editpage.tmpl")},
  298. );
  299. my @buttons=("Save Page", "Preview", "Cancel");
  300. # This untaint is safe because titlepage removes any problimatic
  301. # characters.
  302. my ($page)=decode_utf8($form->param('page'));
  303. $page=titlepage(possibly_foolish_untaint(lc($page)));
  304. if (! defined $page || ! length $page ||
  305. $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) {
  306. error("bad page name");
  307. }
  308. $page=lc($page);
  309. my $file;
  310. if (exists $pagesources{lc($page)}) {
  311. $file=$pagesources{lc($page)};
  312. }
  313. else {
  314. $file=$page.".".$config{default_pageext};
  315. }
  316. my $newfile=0;
  317. if (! -e "$config{srcdir}/$file") {
  318. $newfile=1;
  319. }
  320. $form->field(name => "do", type => 'hidden');
  321. $form->field(name => "from", type => 'hidden');
  322. $form->field(name => "rcsinfo", type => 'hidden');
  323. $form->field(name => "subpage", type => 'hidden');
  324. $form->field(name => "page", value => "$page", force => 1);
  325. $form->field(name => "comments", type => "text", size => 80);
  326. $form->field(name => "editcontent", type => "textarea", rows => 20,
  327. cols => 80);
  328. $form->tmpl_param("can_commit", $config{rcs});
  329. $form->tmpl_param("indexlink", indexlink());
  330. $form->tmpl_param("helponformattinglink",
  331. htmllink("", "", "HelpOnFormatting", 1));
  332. $form->tmpl_param("styleurl", styleurl());
  333. $form->tmpl_param("baseurl", "$config{url}/");
  334. if (! $form->submitted) {
  335. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  336. force => 1);
  337. }
  338. if ($form->submitted eq "Cancel") {
  339. redirect($q, "$config{url}/".htmlpage($page));
  340. return;
  341. }
  342. elsif ($form->submitted eq "Preview") {
  343. require IkiWiki::Render;
  344. # Apparently FormBuilder doesn't not treat input as
  345. # utf-8, so decode from it.
  346. my $content=decode_utf8($form->field('editcontent'));
  347. my $comments=decode_utf8($form->field('comments'));
  348. $form->field(name => "editcontent",
  349. value => $content, force => 1);
  350. $form->field(name => "comments",
  351. value => $comments, force => 1);
  352. $form->tmpl_param("page_preview",
  353. htmlize(pagetype($file),
  354. linkify($page, $page, $content)));
  355. }
  356. else {
  357. $form->tmpl_param("page_preview", "");
  358. }
  359. $form->tmpl_param("page_conflict", "");
  360. if (! $form->submitted || $form->submitted eq "Preview" ||
  361. ! $form->validate) {
  362. if ($form->field("do") eq "create") {
  363. my @page_locs;
  364. my $best_loc;
  365. my ($from)=$form->param('from')=~/$config{wiki_file_regexp}/;
  366. if (! defined $from || ! length $from ||
  367. $from ne $form->param('from') ||
  368. $from=~/$config{wiki_file_prune_regexp}/ ||
  369. $from=~/^\// ||
  370. $form->submitted eq "Preview") {
  371. @page_locs=$best_loc=$page;
  372. }
  373. else {
  374. my $dir=$from."/";
  375. $dir=~s![^/]+/+$!!;
  376. if ((defined $form->param('subpage') && length $form->param('subpage')) ||
  377. $page eq 'discussion') {
  378. $best_loc="$from/$page";
  379. }
  380. else {
  381. $best_loc=$dir.$page;
  382. }
  383. push @page_locs, $dir.$page;
  384. push @page_locs, "$from/$page";
  385. while (length $dir) {
  386. $dir=~s![^/]+/+$!!;
  387. push @page_locs, $dir.$page;
  388. }
  389. }
  390. @page_locs = grep {
  391. ! exists $pagesources{lc($_)} &&
  392. ! page_locked($_, $session, 1)
  393. } @page_locs;
  394. if (! @page_locs) {
  395. # hmm, someone else made the page in the
  396. # meantime?
  397. redirect($q, "$config{url}/".htmlpage($page));
  398. return;
  399. }
  400. $form->tmpl_param("page_select", 1);
  401. $form->field(name => "page", type => 'select',
  402. options => \@page_locs, value => $best_loc);
  403. $form->title("creating ".pagetitle($page));
  404. }
  405. elsif ($form->field("do") eq "edit") {
  406. page_locked($page, $session);
  407. if (! defined $form->field('editcontent') ||
  408. ! length $form->field('editcontent')) {
  409. my $content="";
  410. if (exists $pagesources{lc($page)}) {
  411. $content=readfile(srcfile($pagesources{lc($page)}));
  412. $content=~s/\n/\r\n/g;
  413. }
  414. $form->field(name => "editcontent", value => $content,
  415. force => 1);
  416. }
  417. $form->tmpl_param("page_select", 0);
  418. $form->field(name => "page", type => 'hidden');
  419. $form->title("editing ".pagetitle($page));
  420. }
  421. print $form->render(submit => \@buttons);
  422. }
  423. else {
  424. # save page
  425. page_locked($page, $session);
  426. # Decode utf-8 since FormBuilder does not
  427. my $content=decode_utf8($form->field('editcontent'));
  428. $content=~s/\r\n/\n/g;
  429. $content=~s/\r/\n/g;
  430. writefile($file, $config{srcdir}, $content);
  431. my $message="web commit ";
  432. if (defined $session->param("name") &&
  433. length $session->param("name")) {
  434. $message.="by ".$session->param("name");
  435. }
  436. else {
  437. $message.="from $ENV{REMOTE_ADDR}";
  438. }
  439. if (defined $form->field('comments') &&
  440. length $form->field('comments')) {
  441. $message.=": ".decode_utf8($form->field('comments'));
  442. }
  443. if ($config{rcs}) {
  444. if ($newfile) {
  445. rcs_add($file);
  446. }
  447. # prevent deadlock with post-commit hook
  448. unlockwiki();
  449. # presumably the commit will trigger an update
  450. # of the wiki
  451. my $conflict=rcs_commit($file, $message,
  452. $form->field("rcsinfo"));
  453. if (defined $conflict) {
  454. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  455. force => 1);
  456. $form->tmpl_param("page_conflict", 1);
  457. $form->field("editcontent", value => $conflict, force => 1);
  458. $form->field(name => "comments", value => decode_utf8($form->field('comments')), force => 1);
  459. $form->field("do", "edit)");
  460. $form->tmpl_param("page_select", 0);
  461. $form->field(name => "page", type => 'hidden');
  462. $form->title("editing $page");
  463. print $form->render(submit => \@buttons);
  464. return;
  465. }
  466. }
  467. else {
  468. require IkiWiki::Render;
  469. refresh();
  470. saveindex();
  471. }
  472. # The trailing question mark tries to avoid broken
  473. # caches and get the most recent version of the page.
  474. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  475. }
  476. } #}}}
  477. sub cgi () { #{{{
  478. eval q{use CGI};
  479. eval q{use CGI::Session};
  480. my $q=CGI->new;
  481. if (exists $hooks{cgi}) {
  482. foreach my $id (keys %{$hooks{cgi}}) {
  483. $hooks{cgi}{$id}{call}->($q);
  484. }
  485. }
  486. my $do=$q->param('do');
  487. if (! defined $do || ! length $do) {
  488. my $error = $q->cgi_error;
  489. if ($error) {
  490. error("Request not processed: $error");
  491. }
  492. else {
  493. error("\"do\" parameter missing");
  494. }
  495. }
  496. # Things that do not need a session.
  497. if ($do eq 'recentchanges') {
  498. cgi_recentchanges($q);
  499. return;
  500. }
  501. elsif ($do eq 'hyperestraier') {
  502. cgi_hyperestraier();
  503. }
  504. CGI::Session->name("ikiwiki_session_$config{wikiname}");
  505. my $oldmask=umask(077);
  506. my $session = CGI::Session->new("driver:DB_File", $q,
  507. { FileName => "$config{wikistatedir}/sessions.db" });
  508. umask($oldmask);
  509. # Everything below this point needs the user to be signed in.
  510. if ((! $config{anonok} &&
  511. (! defined $session->param("name") ||
  512. ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
  513. cgi_signin($q, $session);
  514. # Force session flush with safe umask.
  515. my $oldmask=umask(077);
  516. $session->flush;
  517. umask($oldmask);
  518. return;
  519. }
  520. if ($do eq 'create' || $do eq 'edit') {
  521. cgi_editpage($q, $session);
  522. }
  523. elsif ($do eq 'prefs') {
  524. cgi_prefs($q, $session);
  525. }
  526. elsif ($do eq 'blog') {
  527. my $page=titlepage(lc($q->param('title')));
  528. # if the page already exists, munge it to be unique
  529. my $from=$q->param('from');
  530. my $add="";
  531. while (exists $oldpagemtime{"$from/$page$add"}) {
  532. $add=1 unless length $add;
  533. $add++;
  534. }
  535. $q->param('page', $page.$add);
  536. # now run same as create
  537. $q->param('do', 'create');
  538. cgi_editpage($q, $session);
  539. }
  540. else {
  541. error("unknown do parameter");
  542. }
  543. } #}}}
  544. 1