summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 3fadc462e5704cf446dc9e347d710265b1eae374 (plain)
  1. #!/usr/bin/perl
  2. package IkiWiki;
  3. use warnings;
  4. use strict;
  5. use IkiWiki;
  6. use IkiWiki::UserInfo;
  7. use open qw{:utf8 :std};
  8. use Encode;
  9. sub printheader ($) {
  10. my $session=shift;
  11. if ($config{sslcookie}) {
  12. print $session->header(-charset => 'utf-8',
  13. -cookie => $session->cookie(-httponly => 1, -secure => 1));
  14. } else {
  15. print $session->header(-charset => 'utf-8',
  16. -cookie => $session->cookie(-httponly => 1));
  17. }
  18. }
  19. sub showform ($$$$;@) {
  20. my $form=shift;
  21. my $buttons=shift;
  22. my $session=shift;
  23. my $cgi=shift;
  24. if (exists $hooks{formbuilder}) {
  25. run_hooks(formbuilder => sub {
  26. shift->(form => $form, cgi => $cgi, session => $session,
  27. buttons => $buttons);
  28. });
  29. }
  30. printheader($session);
  31. print misctemplate($form->title, $form->render(submit => $buttons), @_);
  32. }
  33. sub redirect ($$) {
  34. my $q=shift;
  35. my $url=shift;
  36. if (! $config{w3mmode}) {
  37. print $q->redirect($url);
  38. }
  39. else {
  40. print "Content-type: text/plain\n";
  41. print "W3m-control: GOTO $url\n\n";
  42. }
  43. }
  44. sub decode_cgi_utf8 ($) {
  45. # decode_form_utf8 method is needed for 5.10
  46. if ($] < 5.01) {
  47. my $cgi = shift;
  48. foreach my $f ($cgi->param) {
  49. $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
  50. }
  51. }
  52. }
  53. sub decode_form_utf8 ($) {
  54. if ($] >= 5.01) {
  55. my $form = shift;
  56. foreach my $f ($form->field) {
  57. $form->field(name => $f,
  58. value => decode_utf8($form->field($f)),
  59. force => 1,
  60. );
  61. }
  62. }
  63. }
  64. # Check if the user is signed in. If not, redirect to the signin form and
  65. # save their place to return to later.
  66. sub needsignin ($$) {
  67. my $q=shift;
  68. my $session=shift;
  69. if (! defined $session->param("name") ||
  70. ! userinfo_get($session->param("name"), "regdate")) {
  71. $session->param(postsignin => $ENV{QUERY_STRING});
  72. cgi_signin($q, $session);
  73. cgi_savesession($session);
  74. exit;
  75. }
  76. }
  77. sub cgi_signin ($$) {
  78. my $q=shift;
  79. my $session=shift;
  80. decode_cgi_utf8($q);
  81. eval q{use CGI::FormBuilder};
  82. error($@) if $@;
  83. my $form = CGI::FormBuilder->new(
  84. title => "signin",
  85. name => "signin",
  86. charset => "utf-8",
  87. method => 'POST',
  88. required => 'NONE',
  89. javascript => 0,
  90. params => $q,
  91. action => $config{cgiurl},
  92. header => 0,
  93. template => {type => 'div'},
  94. stylesheet => baseurl()."style.css",
  95. );
  96. my $buttons=["Login"];
  97. if ($q->param("do") ne "signin" && !$form->submitted) {
  98. $form->text(gettext("You need to log in first."));
  99. }
  100. $form->field(name => "do", type => "hidden", value => "signin",
  101. force => 1);
  102. decode_form_utf8($form);
  103. run_hooks(formbuilder_setup => sub {
  104. shift->(form => $form, cgi => $q, session => $session,
  105. buttons => $buttons);
  106. });
  107. decode_form_utf8($form);
  108. if ($form->submitted) {
  109. $form->validate;
  110. }
  111. showform($form, $buttons, $session, $q);
  112. }
  113. sub cgi_postsignin ($$) {
  114. my $q=shift;
  115. my $session=shift;
  116. # Continue with whatever was being done before the signin process.
  117. if (defined $session->param("postsignin")) {
  118. my $postsignin=CGI->new($session->param("postsignin"));
  119. $session->clear("postsignin");
  120. cgi($postsignin, $session);
  121. cgi_savesession($session);
  122. exit;
  123. }
  124. else {
  125. error(gettext("login failed, perhaps you need to turn on cookies?"));
  126. }
  127. }
  128. sub cgi_prefs ($$) {
  129. my $q=shift;
  130. my $session=shift;
  131. needsignin($q, $session);
  132. decode_cgi_utf8($q);
  133. # The session id is stored on the form and checked to
  134. # guard against CSRF.
  135. my $sid=$q->param('sid');
  136. if (! defined $sid) {
  137. $q->delete_all;
  138. }
  139. elsif ($sid ne $session->id) {
  140. error(gettext("Your login session has expired."));
  141. }
  142. eval q{use CGI::FormBuilder};
  143. error($@) if $@;
  144. my $form = CGI::FormBuilder->new(
  145. title => "preferences",
  146. name => "preferences",
  147. header => 0,
  148. charset => "utf-8",
  149. method => 'POST',
  150. validate => {
  151. email => 'EMAIL',
  152. },
  153. required => 'NONE',
  154. javascript => 0,
  155. params => $q,
  156. action => $config{cgiurl},
  157. template => {type => 'div'},
  158. stylesheet => baseurl()."style.css",
  159. fieldsets => [
  160. [login => gettext("Login")],
  161. [preferences => gettext("Preferences")],
  162. [admin => gettext("Admin")]
  163. ],
  164. );
  165. my $buttons=["Save Preferences", "Logout", "Cancel"];
  166. decode_form_utf8($form);
  167. run_hooks(formbuilder_setup => sub {
  168. shift->(form => $form, cgi => $q, session => $session,
  169. buttons => $buttons);
  170. });
  171. decode_form_utf8($form);
  172. $form->field(name => "do", type => "hidden", value => "prefs",
  173. force => 1);
  174. $form->field(name => "sid", type => "hidden", value => $session->id,
  175. force => 1);
  176. $form->field(name => "email", size => 50, fieldset => "preferences");
  177. my $user_name=$session->param("name");
  178. if (! $form->submitted) {
  179. $form->field(name => "email", force => 1,
  180. value => userinfo_get($user_name, "email"));
  181. }
  182. if ($form->submitted eq 'Logout') {
  183. $session->delete();
  184. redirect($q, $config{url});
  185. return;
  186. }
  187. elsif ($form->submitted eq 'Cancel') {
  188. redirect($q, $config{url});
  189. return;
  190. }
  191. elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
  192. if (defined $form->field('email')) {
  193. userinfo_set($user_name, 'email', $form->field('email')) ||
  194. error("failed to set email");
  195. }
  196. $form->text(gettext("Preferences saved."));
  197. }
  198. showform($form, $buttons, $session, $q);
  199. }
  200. sub check_banned ($$) {
  201. my $q=shift;
  202. my $session=shift;
  203. my $name=$session->param("name");
  204. if (defined $name) {
  205. if (grep { $name eq $_ } @{$config{banned_users}}) {
  206. print $q->header(-status => "403 Forbidden");
  207. $session->delete();
  208. print gettext("You are banned.");
  209. cgi_savesession($session);
  210. exit;
  211. }
  212. }
  213. }
  214. sub cgi_getsession ($) {
  215. my $q=shift;
  216. eval q{use CGI::Session; use HTML::Entities};
  217. error($@) if $@;
  218. CGI::Session->name("ikiwiki_session_".encode_entities($config{wikiname}));
  219. my $oldmask=umask(077);
  220. my $session = eval {
  221. CGI::Session->new("driver:DB_File", $q,
  222. { FileName => "$config{wikistatedir}/sessions.db" })
  223. };
  224. if (! $session || $@) {
  225. error($@." ".CGI::Session->errstr());
  226. }
  227. umask($oldmask);
  228. return $session;
  229. }
  230. # To guard against CSRF, the user's session id (sid)
  231. # can be stored on a form. This function will check
  232. # (for logged in users) that the sid on the form matches
  233. # the session id in the cookie.
  234. sub checksessionexpiry ($$) {
  235. my $q=shift;
  236. my $session = shift;
  237. if (defined $session->param("name")) {
  238. my $sid=$q->param('sid');
  239. if (! defined $sid || $sid ne $session->id) {
  240. error(gettext("Your login session has expired."));
  241. }
  242. }
  243. }
  244. sub cgi_savesession ($) {
  245. my $session=shift;
  246. # Force session flush with safe umask.
  247. my $oldmask=umask(077);
  248. $session->flush;
  249. umask($oldmask);
  250. }
  251. sub cgi (;$$) {
  252. my $q=shift;
  253. my $session=shift;
  254. eval q{use CGI};
  255. error($@) if $@;
  256. $CGI::DISABLE_UPLOADS=$config{cgi_disable_uploads};
  257. if (! $q) {
  258. binmode(STDIN);
  259. $q=CGI->new;
  260. binmode(STDIN, ":utf8");
  261. run_hooks(cgi => sub { shift->($q) });
  262. }
  263. my $do=$q->param('do');
  264. if (! defined $do || ! length $do) {
  265. my $error = $q->cgi_error;
  266. if ($error) {
  267. error("Request not processed: $error");
  268. }
  269. else {
  270. error("\"do\" parameter missing");
  271. }
  272. }
  273. # Need to lock the wiki before getting a session.
  274. lockwiki();
  275. loadindex();
  276. if (! $session) {
  277. $session=cgi_getsession($q);
  278. }
  279. # Auth hooks can sign a user in.
  280. if ($do ne 'signin' && ! defined $session->param("name")) {
  281. run_hooks(auth => sub {
  282. shift->($q, $session)
  283. });
  284. if (defined $session->param("name")) {
  285. # Make sure whatever user was authed is in the
  286. # userinfo db.
  287. if (! userinfo_get($session->param("name"), "regdate")) {
  288. userinfo_setall($session->param("name"), {
  289. email => "",
  290. password => "",
  291. regdate => time,
  292. }) || error("failed adding user");
  293. }
  294. }
  295. }
  296. check_banned($q, $session);
  297. run_hooks(sessioncgi => sub { shift->($q, $session) });
  298. if ($do eq 'signin') {
  299. cgi_signin($q, $session);
  300. cgi_savesession($session);
  301. }
  302. elsif ($do eq 'prefs') {
  303. cgi_prefs($q, $session);
  304. }
  305. elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
  306. cgi_postsignin($q, $session);
  307. }
  308. else {
  309. error("unknown do parameter");
  310. }
  311. }
  312. # Does not need to be called directly; all errors will go through here.
  313. sub cgierror ($) {
  314. my $message=shift;
  315. print "Content-type: text/html\n\n";
  316. print misctemplate(gettext("Error"),
  317. "<p class=\"error\">".gettext("Error").": $message</p>");
  318. die $@;
  319. }
  320. 1