summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 120e2fdee7dad588a027f6ef0264d995714e4a5b (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub redirect ($$) { #{{{
  10. my $q=shift;
  11. my $url=shift;
  12. if (! $config{w3mmode}) {
  13. print $q->redirect($url);
  14. }
  15. else {
  16. print "Content-type: text/plain\n";
  17. print "W3m-control: GOTO $url\n\n";
  18. }
  19. } #}}}
  20. sub page_locked ($$;$) { #{{{
  21. my $page=shift;
  22. my $session=shift;
  23. my $nonfatal=shift;
  24. my $user=$session->param("name");
  25. return if defined $user && is_admin($user);
  26. foreach my $admin (@{$config{adminuser}}) {
  27. my $locked_pages=userinfo_get($admin, "locked_pages");
  28. if (pagespec_match($page, userinfo_get($admin, "locked_pages"))) {
  29. return 1 if $nonfatal;
  30. error(htmllink("", "", $page, 1)." is locked by ".
  31. htmllink("", "", $admin, 1)." and cannot be edited.");
  32. }
  33. }
  34. return 0;
  35. } #}}}
  36. sub decode_form_utf8 ($) { #{{{
  37. my $form = shift;
  38. foreach my $f ($form->field) {
  39. next if Encode::is_utf8(scalar $form->field($f));
  40. $form->field(name => $f,
  41. value => decode_utf8($form->field($f)),
  42. force => 1,
  43. );
  44. }
  45. } #}}}
  46. sub cgi_recentchanges ($) { #{{{
  47. my $q=shift;
  48. unlockwiki();
  49. # Optimisation: building recentchanges means calculating lots of
  50. # links. Memoizing htmllink speeds it up a lot (can't be memoized
  51. # during page builds as the return values may change, but they
  52. # won't here.)
  53. eval q{use Memoize};
  54. memoize("htmllink");
  55. my $template=template("recentchanges.tmpl");
  56. $template->param(
  57. title => "RecentChanges",
  58. indexlink => indexlink(),
  59. wikiname => $config{wikiname},
  60. changelog => [rcs_recentchanges(100)],
  61. baseurl => baseurl(),
  62. );
  63. print $q->header(-charset=>'utf-8'), $template->output;
  64. } #}}}
  65. sub cgi_signin ($$) { #{{{
  66. my $q=shift;
  67. my $session=shift;
  68. eval q{use CGI::FormBuilder};
  69. my $form = CGI::FormBuilder->new(
  70. title => "signin",
  71. fields => [qw(do title page subpage from name password confirm_password email)],
  72. header => 1,
  73. charset => "utf-8",
  74. method => 'POST',
  75. validate => {
  76. confirm_password => {
  77. perl => q{eq $form->field("password")},
  78. },
  79. email => 'EMAIL',
  80. },
  81. required => 'NONE',
  82. javascript => 0,
  83. params => $q,
  84. action => $config{cgiurl},
  85. header => 0,
  86. template => (-e "$config{templatedir}/signin.tmpl" ?
  87. {template_params("signin.tmpl")} : ""),
  88. stylesheet => baseurl()."style.css",
  89. );
  90. decode_form_utf8($form);
  91. $form->field(name => "name", required => 0);
  92. $form->field(name => "do", type => "hidden");
  93. $form->field(name => "page", type => "hidden");
  94. $form->field(name => "title", type => "hidden");
  95. $form->field(name => "from", type => "hidden");
  96. $form->field(name => "subpage", type => "hidden");
  97. $form->field(name => "password", type => "password", required => 0);
  98. $form->field(name => "confirm_password", type => "password", required => 0);
  99. $form->field(name => "email", required => 0);
  100. if ($q->param("do") ne "signin" && !$form->submitted) {
  101. $form->text("You need to log in first.");
  102. }
  103. if ($form->submitted) {
  104. # Set required fields based on how form was submitted.
  105. my %required=(
  106. "Login" => [qw(name password)],
  107. "Register" => [qw(name password confirm_password email)],
  108. "Mail Password" => [qw(name)],
  109. );
  110. foreach my $opt (@{$required{$form->submitted}}) {
  111. $form->field(name => $opt, required => 1);
  112. }
  113. # Validate password differently depending on how
  114. # form was submitted.
  115. if ($form->submitted eq 'Login') {
  116. $form->field(
  117. name => "password",
  118. validate => sub {
  119. length $form->field("name") &&
  120. shift eq userinfo_get($form->field("name"), 'password');
  121. },
  122. );
  123. $form->field(name => "name", validate => '/^\w+$/');
  124. }
  125. else {
  126. $form->field(name => "password", validate => 'VALUE');
  127. }
  128. # And make sure the entered name exists when logging
  129. # in or sending email, and does not when registering.
  130. if ($form->submitted eq 'Register') {
  131. $form->field(
  132. name => "name",
  133. validate => sub {
  134. my $name=shift;
  135. length $name &&
  136. $name=~/$config{wiki_file_regexp}/ &&
  137. ! userinfo_get($name, "regdate");
  138. },
  139. );
  140. }
  141. else {
  142. $form->field(
  143. name => "name",
  144. validate => sub {
  145. my $name=shift;
  146. length $name &&
  147. userinfo_get($name, "regdate");
  148. },
  149. );
  150. }
  151. }
  152. else {
  153. # First time settings.
  154. $form->field(name => "name", comment => "use FirstnameLastName");
  155. $form->field(name => "confirm_password", comment => "(only needed");
  156. $form->field(name => "email", comment => "for registration)");
  157. if ($session->param("name")) {
  158. $form->field(name => "name", value => $session->param("name"));
  159. }
  160. }
  161. if ($form->submitted && $form->validate) {
  162. if ($form->submitted eq 'Login') {
  163. $session->param("name", $form->field("name"));
  164. if (defined $form->field("do") &&
  165. $form->field("do") ne 'signin') {
  166. redirect($q, cgiurl(
  167. do => $form->field("do"),
  168. page => $form->field("page"),
  169. title => $form->field("title"),
  170. subpage => $form->field("subpage"),
  171. from => $form->field("from"),
  172. ));
  173. }
  174. else {
  175. redirect($q, $config{url});
  176. }
  177. }
  178. elsif ($form->submitted eq 'Register') {
  179. my $user_name=$form->field('name');
  180. if (userinfo_setall($user_name, {
  181. 'email' => $form->field('email'),
  182. 'password' => $form->field('password'),
  183. 'regdate' => time
  184. })) {
  185. $form->field(name => "confirm_password", type => "hidden");
  186. $form->field(name => "email", type => "hidden");
  187. $form->text("Registration successful. Now you can Login.");
  188. print $session->header(-charset=>'utf-8');
  189. print misctemplate($form->title, $form->render(submit => ["Login"]));
  190. }
  191. else {
  192. error("Error saving registration.");
  193. }
  194. }
  195. elsif ($form->submitted eq 'Mail Password') {
  196. my $user_name=$form->field("name");
  197. my $template=template("passwordmail.tmpl");
  198. $template->param(
  199. user_name => $user_name,
  200. user_password => userinfo_get($user_name, "password"),
  201. wikiurl => $config{url},
  202. wikiname => $config{wikiname},
  203. REMOTE_ADDR => $ENV{REMOTE_ADDR},
  204. );
  205. eval q{use Mail::Sendmail};
  206. sendmail(
  207. To => userinfo_get($user_name, "email"),
  208. From => "$config{wikiname} admin <$config{adminemail}>",
  209. Subject => "$config{wikiname} information",
  210. Message => $template->output,
  211. ) or error("Failed to send mail");
  212. $form->text("Your password has been emailed to you.");
  213. $form->field(name => "name", required => 0);
  214. print $session->header(-charset=>'utf-8');
  215. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  216. }
  217. }
  218. else {
  219. print $session->header(-charset=>'utf-8');
  220. print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
  221. }
  222. } #}}}
  223. sub cgi_prefs ($$) { #{{{
  224. my $q=shift;
  225. my $session=shift;
  226. eval q{use CGI::FormBuilder};
  227. my $form = CGI::FormBuilder->new(
  228. title => "preferences",
  229. fields => [qw(do name password confirm_password email
  230. subscriptions locked_pages)],
  231. header => 0,
  232. charset => "utf-8",
  233. method => 'POST',
  234. validate => {
  235. confirm_password => {
  236. perl => q{eq $form->field("password")},
  237. },
  238. email => 'EMAIL',
  239. },
  240. required => 'NONE',
  241. javascript => 0,
  242. params => $q,
  243. action => $config{cgiurl},
  244. template => (-e "$config{templatedir}/prefs.tmpl" ?
  245. {template_params("prefs.tmpl")} : ""),
  246. stylesheet => baseurl()."style.css",
  247. );
  248. my @buttons=("Save Preferences", "Logout", "Cancel");
  249. my $user_name=$session->param("name");
  250. $form->field(name => "do", type => "hidden");
  251. $form->field(name => "name", disabled => 1,
  252. value => $user_name, force => 1);
  253. $form->field(name => "password", type => "password");
  254. $form->field(name => "confirm_password", type => "password");
  255. $form->field(name => "subscriptions", size => 50,
  256. comment => "(".htmllink("", "", "PageSpec", 1).")");
  257. $form->field(name => "locked_pages", size => 50,
  258. comment => "(".htmllink("", "", "PageSpec", 1).")");
  259. if (! is_admin($user_name)) {
  260. $form->field(name => "locked_pages", type => "hidden");
  261. }
  262. if (! $form->submitted) {
  263. $form->field(name => "email", force => 1,
  264. value => userinfo_get($user_name, "email"));
  265. $form->field(name => "subscriptions", force => 1,
  266. value => userinfo_get($user_name, "subscriptions"));
  267. $form->field(name => "locked_pages", force => 1,
  268. value => userinfo_get($user_name, "locked_pages"));
  269. }
  270. decode_form_utf8($form);
  271. if ($form->submitted eq 'Logout') {
  272. $session->delete();
  273. redirect($q, $config{url});
  274. return;
  275. }
  276. elsif ($form->submitted eq 'Cancel') {
  277. redirect($q, $config{url});
  278. return;
  279. }
  280. elsif ($form->submitted eq "Save Preferences" && $form->validate) {
  281. foreach my $field (qw(password email subscriptions locked_pages)) {
  282. if (length $form->field($field)) {
  283. userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field");
  284. }
  285. }
  286. $form->text("Preferences saved.");
  287. }
  288. print $session->header(-charset=>'utf-8');
  289. print misctemplate($form->title, $form->render(submit => \@buttons));
  290. } #}}}
  291. sub cgi_editpage ($$) { #{{{
  292. my $q=shift;
  293. my $session=shift;
  294. eval q{use CGI::FormBuilder};
  295. my $form = CGI::FormBuilder->new(
  296. fields => [qw(do rcsinfo subpage from page type editcontent comments)],
  297. header => 1,
  298. charset => "utf-8",
  299. method => 'POST',
  300. validate => {
  301. editcontent => '/.+/',
  302. },
  303. required => [qw{editcontent}],
  304. javascript => 0,
  305. params => $q,
  306. action => $config{cgiurl},
  307. table => 0,
  308. template => {template_params("editpage.tmpl")},
  309. );
  310. my @buttons=("Save Page", "Preview", "Cancel");
  311. decode_form_utf8($form);
  312. # This untaint is safe because titlepage removes any problematic
  313. # characters.
  314. my ($page)=$form->field('page');
  315. $page=titlepage(possibly_foolish_untaint($page));
  316. if (! defined $page || ! length $page ||
  317. $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) {
  318. error("bad page name");
  319. }
  320. my $from;
  321. if (defined $form->field('from')) {
  322. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  323. }
  324. my $file;
  325. my $type;
  326. if (exists $pagesources{$page}) {
  327. $file=$pagesources{$page};
  328. $type=pagetype($file);
  329. }
  330. else {
  331. $type=$form->param('type');
  332. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  333. $type=possibly_foolish_untaint($type);
  334. }
  335. elsif (defined $from) {
  336. # favor the type of linking page
  337. $type=pagetype($pagesources{$from});
  338. }
  339. $type=$config{default_pageext} unless defined $type;
  340. $file=$page.".".$type;
  341. }
  342. my $newfile=0;
  343. if (! -e "$config{srcdir}/$file") {
  344. $newfile=1;
  345. }
  346. $form->field(name => "do", type => 'hidden');
  347. $form->field(name => "from", type => 'hidden');
  348. $form->field(name => "rcsinfo", type => 'hidden');
  349. $form->field(name => "subpage", type => 'hidden');
  350. $form->field(name => "page", value => $page, force => 1);
  351. $form->field(name => "type", value => $type, force => 1);
  352. $form->field(name => "comments", type => "text", size => 80);
  353. $form->field(name => "editcontent", type => "textarea", rows => 20,
  354. cols => 80);
  355. $form->tmpl_param("can_commit", $config{rcs});
  356. $form->tmpl_param("indexlink", indexlink());
  357. $form->tmpl_param("helponformattinglink",
  358. htmllink("", "", "HelpOnFormatting", 1));
  359. $form->tmpl_param("baseurl", baseurl());
  360. if (! $form->submitted) {
  361. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  362. force => 1);
  363. }
  364. if ($form->submitted eq "Cancel") {
  365. redirect($q, "$config{url}/".htmlpage($page));
  366. return;
  367. }
  368. elsif ($form->submitted eq "Preview") {
  369. require IkiWiki::Render;
  370. my $content=$form->field('editcontent');
  371. my $comments=$form->field('comments');
  372. $form->field(name => "editcontent",
  373. value => $content, force => 1);
  374. $form->field(name => "comments",
  375. value => $comments, force => 1);
  376. $config{rss}=0; # avoid preview writing an rss feed!
  377. $form->tmpl_param("page_preview",
  378. htmlize($type,
  379. linkify($page, "",
  380. preprocess($page, $page,
  381. filter($page, $content)))));
  382. }
  383. else {
  384. $form->tmpl_param("page_preview", "");
  385. }
  386. $form->tmpl_param("page_conflict", "");
  387. if (! $form->submitted || $form->submitted eq "Preview" ||
  388. ! $form->validate) {
  389. if ($form->field("do") eq "create") {
  390. my @page_locs;
  391. my $best_loc;
  392. if (! defined $from || ! length $from ||
  393. $from ne $form->field('from') ||
  394. $from=~/$config{wiki_file_prune_regexp}/ ||
  395. $from=~/^\// ||
  396. $form->submitted eq "Preview") {
  397. @page_locs=$best_loc=$page;
  398. }
  399. else {
  400. my $dir=$from."/";
  401. $dir=~s![^/]+/+$!!;
  402. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  403. $page eq 'discussion') {
  404. $best_loc="$from/$page";
  405. }
  406. else {
  407. $best_loc=$dir.$page;
  408. }
  409. push @page_locs, $dir.$page;
  410. push @page_locs, "$from/$page";
  411. while (length $dir) {
  412. $dir=~s![^/]+/+$!!;
  413. push @page_locs, $dir.$page;
  414. }
  415. }
  416. @page_locs = grep {
  417. ! exists $pagecase{lc $_} &&
  418. ! page_locked($_, $session, 1)
  419. } @page_locs;
  420. if (! @page_locs) {
  421. # hmm, someone else made the page in the
  422. # meantime?
  423. redirect($q, "$config{url}/".htmlpage($page));
  424. return;
  425. }
  426. my @page_types;
  427. if (exists $hooks{htmlize}) {
  428. @page_types=keys %{$hooks{htmlize}};
  429. }
  430. $form->tmpl_param("page_select", 1);
  431. $form->field(name => "page", type => 'select',
  432. options => \@page_locs, value => $best_loc);
  433. $form->field(name => "type", type => 'select',
  434. options => \@page_types);
  435. $form->title("creating ".pagetitle($page));
  436. }
  437. elsif ($form->field("do") eq "edit") {
  438. page_locked($page, $session);
  439. if (! defined $form->field('editcontent') ||
  440. ! length $form->field('editcontent')) {
  441. my $content="";
  442. if (exists $pagesources{$page}) {
  443. $content=readfile(srcfile($pagesources{$page}));
  444. $content=~s/\n/\r\n/g;
  445. }
  446. $form->field(name => "editcontent", value => $content,
  447. force => 1);
  448. }
  449. $form->tmpl_param("page_select", 0);
  450. $form->field(name => "page", type => 'hidden');
  451. $form->field(name => "type", type => 'hidden');
  452. $form->title("editing ".pagetitle($page));
  453. }
  454. print $form->render(submit => \@buttons);
  455. }
  456. else {
  457. # save page
  458. page_locked($page, $session);
  459. my $content=$form->field('editcontent');
  460. $content=~s/\r\n/\n/g;
  461. $content=~s/\r/\n/g;
  462. writefile($file, $config{srcdir}, $content);
  463. my $message="web commit ";
  464. if (defined $session->param("name") &&
  465. length $session->param("name")) {
  466. $message.="by ".$session->param("name");
  467. }
  468. else {
  469. $message.="from $ENV{REMOTE_ADDR}";
  470. }
  471. if (defined $form->field('comments') &&
  472. length $form->field('comments')) {
  473. $message.=": ".$form->field('comments');
  474. }
  475. if ($config{rcs}) {
  476. if ($newfile) {
  477. rcs_add($file);
  478. }
  479. # prevent deadlock with post-commit hook
  480. unlockwiki();
  481. # presumably the commit will trigger an update
  482. # of the wiki
  483. my $conflict=rcs_commit($file, $message,
  484. $form->field("rcsinfo"));
  485. if (defined $conflict) {
  486. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  487. force => 1);
  488. $form->tmpl_param("page_conflict", 1);
  489. $form->field("editcontent", value => $conflict, force => 1);
  490. $form->field(name => "comments", value => $form->field('comments'), force => 1);
  491. $form->field("do", "edit)");
  492. $form->tmpl_param("page_select", 0);
  493. $form->field(name => "page", type => 'hidden');
  494. $form->field(name => "type", type => 'hidden');
  495. $form->title("editing $page");
  496. print $form->render(submit => \@buttons);
  497. return;
  498. }
  499. }
  500. else {
  501. require IkiWiki::Render;
  502. refresh();
  503. saveindex();
  504. }
  505. # The trailing question mark tries to avoid broken
  506. # caches and get the most recent version of the page.
  507. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  508. }
  509. } #}}}
  510. sub cgi () { #{{{
  511. eval q{use CGI};
  512. eval q{use CGI::Session};
  513. my $q=CGI->new;
  514. run_hooks(cgi => sub { shift->($q) });
  515. my $do=$q->param('do');
  516. if (! defined $do || ! length $do) {
  517. my $error = $q->cgi_error;
  518. if ($error) {
  519. error("Request not processed: $error");
  520. }
  521. else {
  522. error("\"do\" parameter missing");
  523. }
  524. }
  525. # Things that do not need a session.
  526. if ($do eq 'recentchanges') {
  527. cgi_recentchanges($q);
  528. return;
  529. }
  530. elsif ($do eq 'hyperestraier') {
  531. cgi_hyperestraier();
  532. }
  533. CGI::Session->name("ikiwiki_session_$config{wikiname}");
  534. my $oldmask=umask(077);
  535. my $session = CGI::Session->new("driver:DB_File", $q,
  536. { FileName => "$config{wikistatedir}/sessions.db" });
  537. umask($oldmask);
  538. # Everything below this point needs the user to be signed in.
  539. if ((! $config{anonok} &&
  540. (! defined $session->param("name") ||
  541. ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
  542. cgi_signin($q, $session);
  543. # Force session flush with safe umask.
  544. my $oldmask=umask(077);
  545. $session->flush;
  546. umask($oldmask);
  547. return;
  548. }
  549. if ($do eq 'create' || $do eq 'edit') {
  550. cgi_editpage($q, $session);
  551. }
  552. elsif ($do eq 'prefs') {
  553. cgi_prefs($q, $session);
  554. }
  555. elsif ($do eq 'blog') {
  556. my $page=titlepage(decode_utf8($q->param('title')));
  557. # if the page already exists, munge it to be unique
  558. my $from=$q->param('from');
  559. my $add="";
  560. while (exists $pagecase{lc "$from/$page$add"}) {
  561. $add=1 unless length $add;
  562. $add++;
  563. }
  564. $q->param('page', $page.$add);
  565. # now run same as create
  566. $q->param('do', 'create');
  567. cgi_editpage($q, $session);
  568. }
  569. else {
  570. error("unknown do parameter");
  571. }
  572. } #}}}
  573. 1