summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 07e92322f4cbf94b9af112890077bd093f94b89d (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub printheader ($) { #{{{
  10. my $session=shift;
  11. if ($config{sslcookie}) {
  12. print $session->header(-charset => 'utf-8',
  13. -cookie => $session->cookie(-secure => 1));
  14. } else {
  15. print $session->header(-charset => 'utf-8');
  16. }
  17. } #}}}
  18. sub showform ($$$$;@) { #{{{
  19. my $form=shift;
  20. my $buttons=shift;
  21. my $session=shift;
  22. my $cgi=shift;
  23. if (exists $hooks{formbuilder}) {
  24. run_hooks(formbuilder => sub {
  25. shift->(form => $form, cgi => $cgi, session => $session,
  26. buttons => $buttons);
  27. });
  28. }
  29. printheader($session);
  30. print misctemplate($form->title, $form->render(submit => $buttons), @_);
  31. }
  32. sub redirect ($$) { #{{{
  33. my $q=shift;
  34. my $url=shift;
  35. if (! $config{w3mmode}) {
  36. print $q->redirect($url);
  37. }
  38. else {
  39. print "Content-type: text/plain\n";
  40. print "W3m-control: GOTO $url\n\n";
  41. }
  42. } #}}}
  43. sub check_canedit ($$$;$) { #{{{
  44. my $page=shift;
  45. my $q=shift;
  46. my $session=shift;
  47. my $nonfatal=shift;
  48. my $canedit;
  49. run_hooks(canedit => sub {
  50. return if defined $canedit;
  51. my $ret=shift->($page, $q, $session);
  52. if (defined $ret) {
  53. if ($ret eq "") {
  54. $canedit=1;
  55. }
  56. elsif (ref $ret eq 'CODE') {
  57. $ret->() unless $nonfatal;
  58. $canedit=0;
  59. }
  60. elsif (defined $ret) {
  61. error($ret) unless $nonfatal;
  62. $canedit=0;
  63. }
  64. }
  65. });
  66. return $canedit;
  67. } #}}}
  68. sub decode_cgi_utf8 ($) { #{{{
  69. # decode_form_utf8 method is needed for 5.10
  70. if ($] < 5.01) {
  71. my $cgi = shift;
  72. foreach my $f ($cgi->param) {
  73. $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
  74. }
  75. }
  76. } #}}}
  77. sub decode_form_utf8 ($) { #{{{
  78. if ($] >= 5.01) {
  79. my $form = shift;
  80. foreach my $f ($form->field) {
  81. $form->field(name => $f,
  82. value => decode_utf8($form->field($f)),
  83. force => 1,
  84. );
  85. }
  86. }
  87. } #}}}
  88. # Check if the user is signed in. If not, redirect to the signin form and
  89. # save their place to return to later.
  90. sub needsignin ($$) { #{{{
  91. my $q=shift;
  92. my $session=shift;
  93. if (! defined $session->param("name") ||
  94. ! userinfo_get($session->param("name"), "regdate")) {
  95. $session->param(postsignin => $ENV{QUERY_STRING});
  96. cgi_signin($q, $session);
  97. cgi_savesession($session);
  98. exit;
  99. }
  100. } #}}}
  101. sub cgi_signin ($$) { #{{{
  102. my $q=shift;
  103. my $session=shift;
  104. decode_cgi_utf8($q);
  105. eval q{use CGI::FormBuilder};
  106. error($@) if $@;
  107. my $form = CGI::FormBuilder->new(
  108. title => "signin",
  109. name => "signin",
  110. charset => "utf-8",
  111. method => 'POST',
  112. required => 'NONE',
  113. javascript => 0,
  114. params => $q,
  115. action => $config{cgiurl},
  116. header => 0,
  117. template => {type => 'div'},
  118. stylesheet => baseurl()."style.css",
  119. );
  120. my $buttons=["Login"];
  121. if ($q->param("do") ne "signin" && !$form->submitted) {
  122. $form->text(gettext("You need to log in first."));
  123. }
  124. $form->field(name => "do", type => "hidden", value => "signin",
  125. force => 1);
  126. decode_form_utf8($form);
  127. run_hooks(formbuilder_setup => sub {
  128. shift->(form => $form, cgi => $q, session => $session,
  129. buttons => $buttons);
  130. });
  131. decode_form_utf8($form);
  132. if ($form->submitted) {
  133. $form->validate;
  134. }
  135. showform($form, $buttons, $session, $q);
  136. } #}}}
  137. sub cgi_postsignin ($$) { #{{{
  138. my $q=shift;
  139. my $session=shift;
  140. # Continue with whatever was being done before the signin process.
  141. if (defined $session->param("postsignin")) {
  142. my $postsignin=CGI->new($session->param("postsignin"));
  143. $session->clear("postsignin");
  144. cgi($postsignin, $session);
  145. cgi_savesession($session);
  146. exit;
  147. }
  148. else {
  149. error(gettext("login failed, perhaps you need to turn on cookies?"));
  150. }
  151. } #}}}
  152. sub cgi_prefs ($$) { #{{{
  153. my $q=shift;
  154. my $session=shift;
  155. needsignin($q, $session);
  156. decode_cgi_utf8($q);
  157. # The session id is stored on the form and checked to
  158. # guard against CSRF.
  159. my $sid=$q->param('sid');
  160. if (! defined $sid) {
  161. $q->delete_all;
  162. }
  163. elsif ($sid ne $session->id) {
  164. error(gettext("Your login session has expired."));
  165. }
  166. eval q{use CGI::FormBuilder};
  167. error($@) if $@;
  168. my $form = CGI::FormBuilder->new(
  169. title => "preferences",
  170. name => "preferences",
  171. header => 0,
  172. charset => "utf-8",
  173. method => 'POST',
  174. validate => {
  175. email => 'EMAIL',
  176. },
  177. required => 'NONE',
  178. javascript => 0,
  179. params => $q,
  180. action => $config{cgiurl},
  181. template => {type => 'div'},
  182. stylesheet => baseurl()."style.css",
  183. fieldsets => [
  184. [login => gettext("Login")],
  185. [preferences => gettext("Preferences")],
  186. [admin => gettext("Admin")]
  187. ],
  188. );
  189. my $buttons=["Save Preferences", "Logout", "Cancel"];
  190. decode_form_utf8($form);
  191. run_hooks(formbuilder_setup => sub {
  192. shift->(form => $form, cgi => $q, session => $session,
  193. buttons => $buttons);
  194. });
  195. decode_form_utf8($form);
  196. $form->field(name => "do", type => "hidden", value => "prefs",
  197. force => 1);
  198. $form->field(name => "sid", type => "hidden", value => $session->id,
  199. force => 1);
  200. $form->field(name => "email", size => 50, fieldset => "preferences");
  201. $form->field(name => "banned_users", size => 50,
  202. fieldset => "admin");
  203. my $user_name=$session->param("name");
  204. if (! is_admin($user_name)) {
  205. $form->field(name => "banned_users", type => "hidden");
  206. }
  207. if (! $form->submitted) {
  208. $form->field(name => "email", force => 1,
  209. value => userinfo_get($user_name, "email"));
  210. if (is_admin($user_name)) {
  211. $form->field(name => "banned_users", force => 1,
  212. value => join(" ", get_banned_users()));
  213. }
  214. }
  215. if ($form->submitted eq 'Logout') {
  216. $session->delete();
  217. redirect($q, $config{url});
  218. return;
  219. }
  220. elsif ($form->submitted eq 'Cancel') {
  221. redirect($q, $config{url});
  222. return;
  223. }
  224. elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
  225. if (defined $form->field('email')) {
  226. userinfo_set($user_name, 'email', $form->field('email')) ||
  227. error("failed to set email");
  228. }
  229. if (is_admin($user_name)) {
  230. set_banned_users(grep { ! is_admin($_) }
  231. split(' ',
  232. $form->field("banned_users"))) ||
  233. error("failed saving changes");
  234. }
  235. $form->text(gettext("Preferences saved."));
  236. }
  237. showform($form, $buttons, $session, $q);
  238. } #}}}
  239. sub cgi_editpage ($$) { #{{{
  240. my $q=shift;
  241. my $session=shift;
  242. decode_cgi_utf8($q);
  243. my @fields=qw(do rcsinfo subpage from page type editcontent comments);
  244. my @buttons=("Save Page", "Preview", "Cancel");
  245. eval q{use CGI::FormBuilder};
  246. error($@) if $@;
  247. my $form = CGI::FormBuilder->new(
  248. fields => \@fields,
  249. charset => "utf-8",
  250. method => 'POST',
  251. required => [qw{editcontent}],
  252. javascript => 0,
  253. params => $q,
  254. action => $config{cgiurl},
  255. header => 0,
  256. table => 0,
  257. template => scalar template_params("editpage.tmpl"),
  258. wikiname => $config{wikiname},
  259. );
  260. decode_form_utf8($form);
  261. run_hooks(formbuilder_setup => sub {
  262. shift->(form => $form, cgi => $q, session => $session,
  263. buttons => \@buttons);
  264. });
  265. decode_form_utf8($form);
  266. # This untaint is safe because titlepage removes any problematic
  267. # characters.
  268. my $page=$form->field('page');
  269. $page=titlepage(possibly_foolish_untaint($page));
  270. if (! defined $page || ! length $page ||
  271. file_pruned($page, $config{srcdir}) || $page=~/^\//) {
  272. error("bad page name");
  273. }
  274. my $baseurl=$config{url}."/".htmlpage($page);
  275. my $from;
  276. if (defined $form->field('from')) {
  277. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  278. }
  279. my $file;
  280. my $type;
  281. if (exists $pagesources{$page} && $form->field("do") ne "create") {
  282. $file=$pagesources{$page};
  283. $type=pagetype($file);
  284. if (! defined $type || $type=~/^_/) {
  285. error(sprintf(gettext("%s is not an editable page"), $page));
  286. }
  287. if (! $form->submitted) {
  288. $form->field(name => "rcsinfo",
  289. value => rcs_prepedit($file), force => 1);
  290. }
  291. $form->field(name => "editcontent", validate => '/.*/');
  292. }
  293. else {
  294. $type=$form->param('type');
  295. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  296. $type=possibly_foolish_untaint($type);
  297. }
  298. elsif (defined $from && exists $pagesources{$from}) {
  299. # favor the type of linking page
  300. $type=pagetype($pagesources{$from});
  301. }
  302. $type=$config{default_pageext} unless defined $type;
  303. $file=$page.".".$type;
  304. if (! $form->submitted) {
  305. $form->field(name => "rcsinfo", value => "", force => 1);
  306. }
  307. $form->field(name => "editcontent", validate => '/.+/');
  308. }
  309. $form->field(name => "do", type => 'hidden');
  310. $form->field(name => "sid", type => "hidden", value => $session->id,
  311. force => 1);
  312. $form->field(name => "from", type => 'hidden');
  313. $form->field(name => "rcsinfo", type => 'hidden');
  314. $form->field(name => "subpage", type => 'hidden');
  315. $form->field(name => "page", value => pagetitle($page, 1), force => 1);
  316. $form->field(name => "type", value => $type, force => 1);
  317. $form->field(name => "comments", type => "text", size => 80);
  318. $form->field(name => "editcontent", type => "textarea", rows => 20,
  319. cols => 80);
  320. $form->tmpl_param("can_commit", $config{rcs});
  321. $form->tmpl_param("indexlink", indexlink());
  322. $form->tmpl_param("helponformattinglink",
  323. htmllink($page, $page, "ikiwiki/formatting",
  324. noimageinline => 1,
  325. linktext => "FormattingHelp"));
  326. if ($form->submitted eq "Cancel") {
  327. if ($form->field("do") eq "create" && defined $from) {
  328. redirect($q, "$config{url}/".htmlpage($from));
  329. }
  330. elsif ($form->field("do") eq "create") {
  331. redirect($q, $config{url});
  332. }
  333. else {
  334. redirect($q, "$config{url}/".htmlpage($page));
  335. }
  336. return;
  337. }
  338. elsif ($form->submitted eq "Preview") {
  339. my $new=not exists $pagesources{$page};
  340. if ($new) {
  341. # temporarily record its type
  342. $pagesources{$page}=$page.".".$type;
  343. }
  344. my $content=$form->field('editcontent');
  345. run_hooks(editcontent => sub {
  346. $content=shift->(
  347. content => $content,
  348. page => $page,
  349. cgi => $q,
  350. session => $session,
  351. );
  352. });
  353. my $preview=htmlize($page, $page, $type,
  354. linkify($page, $page,
  355. preprocess($page, $page,
  356. filter($page, $page, $content), 0, 1)));
  357. run_hooks(format => sub {
  358. $preview=shift->(
  359. page => $page,
  360. content => $preview,
  361. );
  362. });
  363. $form->tmpl_param("page_preview", $preview);
  364. if ($new) {
  365. delete $pagesources{$page};
  366. }
  367. # previewing may have created files on disk
  368. saveindex();
  369. }
  370. elsif ($form->submitted eq "Save Page") {
  371. $form->tmpl_param("page_preview", "");
  372. }
  373. $form->tmpl_param("page_conflict", "");
  374. if ($form->submitted ne "Save Page" || ! $form->validate) {
  375. if ($form->field("do") eq "create") {
  376. my @page_locs;
  377. my $best_loc;
  378. if (! defined $from || ! length $from ||
  379. $from ne $form->field('from') ||
  380. file_pruned($from, $config{srcdir}) ||
  381. $from=~/^\// ||
  382. $form->submitted eq "Preview") {
  383. @page_locs=$best_loc=$page;
  384. }
  385. else {
  386. my $dir=$from."/";
  387. $dir=~s![^/]+/+$!!;
  388. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  389. $page eq gettext('discussion')) {
  390. $best_loc="$from/$page";
  391. }
  392. else {
  393. $best_loc=$dir.$page;
  394. }
  395. push @page_locs, $dir.$page;
  396. push @page_locs, "$from/$page";
  397. while (length $dir) {
  398. $dir=~s![^/]+/+$!!;
  399. push @page_locs, $dir.$page;
  400. }
  401. push @page_locs, "$config{userdir}/$page"
  402. if length $config{userdir};
  403. }
  404. @page_locs = grep {
  405. ! exists $pagecase{lc $_}
  406. } @page_locs;
  407. if (! @page_locs) {
  408. # hmm, someone else made the page in the
  409. # meantime?
  410. if ($form->submitted eq "Preview") {
  411. # let them go ahead with the edit
  412. # and resolve the conflict at save
  413. # time
  414. @page_locs=$page;
  415. }
  416. else {
  417. redirect($q, "$config{url}/".htmlpage($page));
  418. return;
  419. }
  420. }
  421. my @editable_locs = grep {
  422. check_canedit($_, $q, $session, 1)
  423. } @page_locs;
  424. if (! @editable_locs) {
  425. # let it throw an error this time
  426. map { check_canedit($_, $q, $session) } @page_locs;
  427. }
  428. my @page_types;
  429. if (exists $hooks{htmlize}) {
  430. @page_types=grep { !/^_/ }
  431. keys %{$hooks{htmlize}};
  432. }
  433. $form->tmpl_param("page_select", 1);
  434. $form->field(name => "page", type => 'select',
  435. options => [ map { pagetitle($_, 1) } @editable_locs ],
  436. value => pagetitle($best_loc, 1));
  437. $form->field(name => "type", type => 'select',
  438. options => \@page_types);
  439. $form->title(sprintf(gettext("creating %s"), pagetitle($page)));
  440. }
  441. elsif ($form->field("do") eq "edit") {
  442. check_canedit($page, $q, $session);
  443. if (! defined $form->field('editcontent') ||
  444. ! length $form->field('editcontent')) {
  445. my $content="";
  446. if (exists $pagesources{$page}) {
  447. $content=readfile(srcfile($pagesources{$page}));
  448. $content=~s/\n/\r\n/g;
  449. }
  450. $form->field(name => "editcontent", value => $content,
  451. force => 1);
  452. }
  453. $form->tmpl_param("page_select", 0);
  454. $form->field(name => "page", type => 'hidden');
  455. $form->field(name => "type", type => 'hidden');
  456. $form->title(sprintf(gettext("editing %s"), pagetitle($page)));
  457. }
  458. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  459. }
  460. else {
  461. # save page
  462. check_canedit($page, $q, $session);
  463. # The session id is stored on the form and checked to
  464. # guard against CSRF. But only if the user is logged in,
  465. # as anonok can allow anonymous edits.
  466. if (defined $session->param("name")) {
  467. my $sid=$q->param('sid');
  468. if (! defined $sid || $sid ne $session->id) {
  469. error(gettext("Your login session has expired."));
  470. }
  471. }
  472. my $exists=-e "$config{srcdir}/$file";
  473. if ($form->field("do") ne "create" && ! $exists &&
  474. ! defined srcfile($file, 1)) {
  475. $form->tmpl_param("page_gone", 1);
  476. $form->field(name => "do", value => "create", force => 1);
  477. $form->tmpl_param("page_select", 0);
  478. $form->field(name => "page", type => 'hidden');
  479. $form->field(name => "type", type => 'hidden');
  480. $form->title(sprintf(gettext("editing %s"), $page));
  481. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  482. return;
  483. }
  484. elsif ($form->field("do") eq "create" && $exists) {
  485. $form->tmpl_param("creation_conflict", 1);
  486. $form->field(name => "do", value => "edit", force => 1);
  487. $form->tmpl_param("page_select", 0);
  488. $form->field(name => "page", type => 'hidden');
  489. $form->field(name => "type", type => 'hidden');
  490. $form->title(sprintf(gettext("editing %s"), $page));
  491. $form->field("editcontent",
  492. value => readfile("$config{srcdir}/$file").
  493. "\n\n\n".$form->field("editcontent"),
  494. force => 1);
  495. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  496. return;
  497. }
  498. my $content=$form->field('editcontent');
  499. run_hooks(editcontent => sub {
  500. $content=shift->(
  501. content => $content,
  502. page => $page,
  503. cgi => $q,
  504. session => $session,
  505. );
  506. });
  507. $content=~s/\r\n/\n/g;
  508. $content=~s/\r/\n/g;
  509. $content.="\n" if $content !~ /\n$/;
  510. $config{cgi}=0; # avoid cgi error message
  511. eval { writefile($file, $config{srcdir}, $content) };
  512. $config{cgi}=1;
  513. if ($@) {
  514. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  515. force => 1);
  516. $form->tmpl_param("failed_save", 1);
  517. $form->tmpl_param("error_message", $@);
  518. $form->field("editcontent", value => $content, force => 1);
  519. $form->tmpl_param("page_select", 0);
  520. $form->field(name => "page", type => 'hidden');
  521. $form->field(name => "type", type => 'hidden');
  522. $form->title(sprintf(gettext("editing %s"), $page));
  523. showform($form, \@buttons, $session, $q,
  524. forcebaseurl => $baseurl);
  525. return;
  526. }
  527. my $conflict;
  528. if ($config{rcs}) {
  529. my $message="";
  530. if (defined $form->field('comments') &&
  531. length $form->field('comments')) {
  532. $message=$form->field('comments');
  533. }
  534. if (! $exists) {
  535. rcs_add($file);
  536. }
  537. # Prevent deadlock with post-commit hook by
  538. # signaling to it that it should not try to
  539. # do anything.
  540. disable_commit_hook();
  541. $conflict=rcs_commit($file, $message,
  542. $form->field("rcsinfo"),
  543. $session->param("name"), $ENV{REMOTE_ADDR});
  544. enable_commit_hook();
  545. rcs_update();
  546. }
  547. # Refresh even if there was a conflict, since other changes
  548. # may have been committed while the post-commit hook was
  549. # disabled.
  550. require IkiWiki::Render;
  551. refresh();
  552. saveindex();
  553. if (defined $conflict) {
  554. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  555. force => 1);
  556. $form->tmpl_param("page_conflict", 1);
  557. $form->field("editcontent", value => $conflict, force => 1);
  558. $form->field("do", "edit", force => 1);
  559. $form->tmpl_param("page_select", 0);
  560. $form->field(name => "page", type => 'hidden');
  561. $form->field(name => "type", type => 'hidden');
  562. $form->title(sprintf(gettext("editing %s"), $page));
  563. showform($form, \@buttons, $session, $q,
  564. forcebaseurl => $baseurl);
  565. return;
  566. }
  567. else {
  568. # The trailing question mark tries to avoid broken
  569. # caches and get the most recent version of the page.
  570. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  571. }
  572. }
  573. } #}}}
  574. sub cgi_getsession ($) { #{{{
  575. my $q=shift;
  576. eval q{use CGI::Session};
  577. error($@) if $@;
  578. CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname}));
  579. my $oldmask=umask(077);
  580. my $session = CGI::Session->new("driver:DB_File", $q,
  581. { FileName => "$config{wikistatedir}/sessions.db" });
  582. umask($oldmask);
  583. return $session;
  584. } #}}}
  585. sub cgi_savesession ($) { #{{{
  586. my $session=shift;
  587. # Force session flush with safe umask.
  588. my $oldmask=umask(077);
  589. $session->flush;
  590. umask($oldmask);
  591. } #}}}
  592. sub cgi (;$$) { #{{{
  593. my $q=shift;
  594. my $session=shift;
  595. eval q{use CGI};
  596. error($@) if $@;
  597. $CGI::DISABLE_UPLOADS=$config{cgi_disable_uploads};
  598. if (! $q) {
  599. binmode(STDIN);
  600. $q=CGI->new;
  601. binmode(STDIN, ":utf8");
  602. run_hooks(cgi => sub { shift->($q) });
  603. }
  604. my $do=$q->param('do');
  605. if (! defined $do || ! length $do) {
  606. my $error = $q->cgi_error;
  607. if ($error) {
  608. error("Request not processed: $error");
  609. }
  610. else {
  611. error("\"do\" parameter missing");
  612. }
  613. }
  614. # Need to lock the wiki before getting a session.
  615. lockwiki();
  616. loadindex();
  617. if (! $session) {
  618. $session=cgi_getsession($q);
  619. }
  620. # Auth hooks can sign a user in.
  621. if ($do ne 'signin' && ! defined $session->param("name")) {
  622. run_hooks(auth => sub {
  623. shift->($q, $session)
  624. });
  625. if (defined $session->param("name")) {
  626. # Make sure whatever user was authed is in the
  627. # userinfo db.
  628. if (! userinfo_get($session->param("name"), "regdate")) {
  629. userinfo_setall($session->param("name"), {
  630. email => "",
  631. password => "",
  632. regdate => time,
  633. }) || error("failed adding user");
  634. }
  635. }
  636. }
  637. if (defined $session->param("name") &&
  638. userinfo_get($session->param("name"), "banned")) {
  639. print $q->header(-status => "403 Forbidden");
  640. $session->delete();
  641. print gettext("You are banned.");
  642. cgi_savesession($session);
  643. }
  644. run_hooks(sessioncgi => sub { shift->($q, $session) });
  645. if ($do eq 'signin') {
  646. cgi_signin($q, $session);
  647. cgi_savesession($session);
  648. }
  649. elsif ($do eq 'prefs') {
  650. cgi_prefs($q, $session);
  651. }
  652. elsif ($do eq 'create' || $do eq 'edit') {
  653. cgi_editpage($q, $session);
  654. }
  655. elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
  656. cgi_postsignin($q, $session);
  657. }
  658. else {
  659. error("unknown do parameter");
  660. }
  661. } #}}}
  662. 1