summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: 781974c13d5c8dde65e772bc0c4c3f952fc0f958 (plain)
  1. #!/usr/bin/perl
  2. use warnings;
  3. use strict;
  4. use IkiWiki;
  5. use IkiWiki::UserInfo;
  6. use open qw{:utf8 :std};
  7. use Encode;
  8. package IkiWiki;
  9. sub printheader ($) { #{{{
  10. my $session=shift;
  11. if ($config{sslcookie}) {
  12. print $session->header(-charset => 'utf-8',
  13. -cookie => $session->cookie(-secure => 1));
  14. } else {
  15. print $session->header(-charset => 'utf-8');
  16. }
  17. } #}}}
  18. sub showform ($$$$;@) { #{{{
  19. my $form=shift;
  20. my $buttons=shift;
  21. my $session=shift;
  22. my $cgi=shift;
  23. if (exists $hooks{formbuilder}) {
  24. run_hooks(formbuilder => sub {
  25. shift->(form => $form, cgi => $cgi, session => $session,
  26. buttons => $buttons);
  27. });
  28. }
  29. printheader($session);
  30. print misctemplate($form->title, $form->render(submit => $buttons), @_);
  31. }
  32. sub redirect ($$) { #{{{
  33. my $q=shift;
  34. my $url=shift;
  35. if (! $config{w3mmode}) {
  36. print $q->redirect($url);
  37. }
  38. else {
  39. print "Content-type: text/plain\n";
  40. print "W3m-control: GOTO $url\n\n";
  41. }
  42. } #}}}
  43. sub check_canedit ($$$;$) { #{{{
  44. my $page=shift;
  45. my $q=shift;
  46. my $session=shift;
  47. my $nonfatal=shift;
  48. my $canedit;
  49. run_hooks(canedit => sub {
  50. return if defined $canedit;
  51. my $ret=shift->($page, $q, $session);
  52. if (defined $ret) {
  53. if ($ret eq "") {
  54. $canedit=1;
  55. }
  56. elsif (ref $ret eq 'CODE') {
  57. $ret->() unless $nonfatal;
  58. $canedit=0;
  59. }
  60. elsif (defined $ret) {
  61. error($ret) unless $nonfatal;
  62. $canedit=0;
  63. }
  64. }
  65. });
  66. return $canedit;
  67. } #}}}
  68. sub decode_cgi_utf8 ($) { #{{{
  69. my $cgi = shift;
  70. foreach my $f ($cgi->param) {
  71. $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
  72. }
  73. } #}}}
  74. # Check if the user is signed in. If not, redirect to the signin form and
  75. # save their place to return to later.
  76. sub needsignin ($$) { #{{{
  77. my $q=shift;
  78. my $session=shift;
  79. if (! defined $session->param("name") ||
  80. ! userinfo_get($session->param("name"), "regdate")) {
  81. $session->param(postsignin => $ENV{QUERY_STRING});
  82. cgi_signin($q, $session);
  83. cgi_savesession($session);
  84. exit;
  85. }
  86. } #}}}
  87. sub cgi_signin ($$) { #{{{
  88. my $q=shift;
  89. my $session=shift;
  90. decode_cgi_utf8($q);
  91. eval q{use CGI::FormBuilder};
  92. error($@) if $@;
  93. my $form = CGI::FormBuilder->new(
  94. title => "signin",
  95. name => "signin",
  96. charset => "utf-8",
  97. method => 'POST',
  98. required => 'NONE',
  99. javascript => 0,
  100. params => $q,
  101. action => $config{cgiurl},
  102. header => 0,
  103. template => {type => 'div'},
  104. stylesheet => baseurl()."style.css",
  105. );
  106. my $buttons=["Login"];
  107. if ($q->param("do") ne "signin" && !$form->submitted) {
  108. $form->text(gettext("You need to log in first."));
  109. }
  110. $form->field(name => "do", type => "hidden", value => "signin",
  111. force => 1);
  112. run_hooks(formbuilder_setup => sub {
  113. shift->(form => $form, cgi => $q, session => $session,
  114. buttons => $buttons);
  115. });
  116. if ($form->submitted) {
  117. $form->validate;
  118. }
  119. showform($form, $buttons, $session, $q);
  120. } #}}}
  121. sub cgi_postsignin ($$) { #{{{
  122. my $q=shift;
  123. my $session=shift;
  124. # Continue with whatever was being done before the signin process.
  125. if (defined $session->param("postsignin")) {
  126. my $postsignin=CGI->new($session->param("postsignin"));
  127. $session->clear("postsignin");
  128. cgi($postsignin, $session);
  129. cgi_savesession($session);
  130. exit;
  131. }
  132. else {
  133. error(gettext("login failed, perhaps you need to turn on cookies?"));
  134. }
  135. } #}}}
  136. sub cgi_prefs ($$) { #{{{
  137. my $q=shift;
  138. my $session=shift;
  139. needsignin($q, $session);
  140. decode_cgi_utf8($q);
  141. # The session id is stored on the form and checked to
  142. # guard against CSRF.
  143. my $sid=$q->param('sid');
  144. if (! defined $sid) {
  145. $q->delete_all;
  146. }
  147. elsif ($sid ne $session->id) {
  148. error(gettext("Your login session has expired."));
  149. }
  150. eval q{use CGI::FormBuilder};
  151. error($@) if $@;
  152. my $form = CGI::FormBuilder->new(
  153. title => "preferences",
  154. name => "preferences",
  155. header => 0,
  156. charset => "utf-8",
  157. method => 'POST',
  158. validate => {
  159. email => 'EMAIL',
  160. },
  161. required => 'NONE',
  162. javascript => 0,
  163. params => $q,
  164. action => $config{cgiurl},
  165. template => {type => 'div'},
  166. stylesheet => baseurl()."style.css",
  167. fieldsets => [
  168. [login => gettext("Login")],
  169. [preferences => gettext("Preferences")],
  170. [admin => gettext("Admin")]
  171. ],
  172. );
  173. my $buttons=["Save Preferences", "Logout", "Cancel"];
  174. run_hooks(formbuilder_setup => sub {
  175. shift->(form => $form, cgi => $q, session => $session,
  176. buttons => $buttons);
  177. });
  178. $form->field(name => "do", type => "hidden", value => "prefs",
  179. force => 1);
  180. $form->field(name => "sid", type => "hidden", value => $session->id,
  181. force => 1);
  182. $form->field(name => "email", size => 50, fieldset => "preferences");
  183. $form->field(name => "banned_users", size => 50,
  184. fieldset => "admin");
  185. my $user_name=$session->param("name");
  186. if (! is_admin($user_name)) {
  187. $form->field(name => "banned_users", type => "hidden");
  188. }
  189. if (! $form->submitted) {
  190. $form->field(name => "email", force => 1,
  191. value => userinfo_get($user_name, "email"));
  192. if (is_admin($user_name)) {
  193. $form->field(name => "banned_users", force => 1,
  194. value => join(" ", get_banned_users()));
  195. }
  196. }
  197. if ($form->submitted eq 'Logout') {
  198. $session->delete();
  199. redirect($q, $config{url});
  200. return;
  201. }
  202. elsif ($form->submitted eq 'Cancel') {
  203. redirect($q, $config{url});
  204. return;
  205. }
  206. elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
  207. if (defined $form->field('email')) {
  208. userinfo_set($user_name, 'email', $form->field('email')) ||
  209. error("failed to set email");
  210. }
  211. if (is_admin($user_name)) {
  212. set_banned_users(grep { ! is_admin($_) }
  213. split(' ',
  214. $form->field("banned_users"))) ||
  215. error("failed saving changes");
  216. }
  217. $form->text(gettext("Preferences saved."));
  218. }
  219. showform($form, $buttons, $session, $q);
  220. } #}}}
  221. sub cgi_editpage ($$) { #{{{
  222. my $q=shift;
  223. my $session=shift;
  224. decode_cgi_utf8($q);
  225. my @fields=qw(do rcsinfo subpage from page type editcontent comments);
  226. my @buttons=("Save Page", "Preview", "Cancel");
  227. eval q{use CGI::FormBuilder};
  228. error($@) if $@;
  229. my $form = CGI::FormBuilder->new(
  230. title => "editpage",
  231. fields => \@fields,
  232. charset => "utf-8",
  233. method => 'POST',
  234. required => [qw{editcontent}],
  235. javascript => 0,
  236. params => $q,
  237. action => $config{cgiurl},
  238. header => 0,
  239. table => 0,
  240. template => scalar template_params("editpage.tmpl"),
  241. wikiname => $config{wikiname},
  242. );
  243. run_hooks(formbuilder_setup => sub {
  244. shift->(form => $form, cgi => $q, session => $session,
  245. buttons => \@buttons);
  246. });
  247. # This untaint is safe because titlepage removes any problematic
  248. # characters.
  249. my ($page)=$form->field('page');
  250. $page=titlepage(possibly_foolish_untaint($page));
  251. if (! defined $page || ! length $page ||
  252. file_pruned($page, $config{srcdir}) || $page=~/^\//) {
  253. error("bad page name");
  254. }
  255. my $baseurl=$config{url}."/".htmlpage($page);
  256. my $from;
  257. if (defined $form->field('from')) {
  258. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  259. }
  260. my $file;
  261. my $type;
  262. if (exists $pagesources{$page} && $form->field("do") ne "create") {
  263. $file=$pagesources{$page};
  264. $type=pagetype($file);
  265. if (! defined $type || $type=~/^_/) {
  266. error(sprintf(gettext("%s is not an editable page"), $page));
  267. }
  268. if (! $form->submitted) {
  269. $form->field(name => "rcsinfo",
  270. value => rcs_prepedit($file), force => 1);
  271. }
  272. $form->field(name => "editcontent", validate => '/.*/');
  273. }
  274. else {
  275. $type=$form->param('type');
  276. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  277. $type=possibly_foolish_untaint($type);
  278. }
  279. elsif (defined $from && exists $pagesources{$from}) {
  280. # favor the type of linking page
  281. $type=pagetype($pagesources{$from});
  282. }
  283. $type=$config{default_pageext} unless defined $type;
  284. $file=$page.".".$type;
  285. if (! $form->submitted) {
  286. $form->field(name => "rcsinfo", value => "", force => 1);
  287. }
  288. $form->field(name => "editcontent", validate => '/.+/');
  289. }
  290. $form->field(name => "do", type => 'hidden');
  291. $form->field(name => "sid", type => "hidden", value => $session->id,
  292. force => 1);
  293. $form->field(name => "from", type => 'hidden');
  294. $form->field(name => "rcsinfo", type => 'hidden');
  295. $form->field(name => "subpage", type => 'hidden');
  296. $form->field(name => "page", value => pagetitle($page, 1), force => 1);
  297. $form->field(name => "type", value => $type, force => 1);
  298. $form->field(name => "comments", type => "text", size => 80);
  299. $form->field(name => "editcontent", type => "textarea", rows => 20,
  300. cols => 80);
  301. $form->tmpl_param("can_commit", $config{rcs});
  302. $form->tmpl_param("indexlink", indexlink());
  303. $form->tmpl_param("helponformattinglink",
  304. htmllink($page, $page, "ikiwiki/formatting",
  305. noimageinline => 1,
  306. linktext => "FormattingHelp"));
  307. if ($form->submitted eq "Cancel") {
  308. if ($form->field("do") eq "create" && defined $from) {
  309. redirect($q, "$config{url}/".htmlpage($from));
  310. }
  311. elsif ($form->field("do") eq "create") {
  312. redirect($q, $config{url});
  313. }
  314. else {
  315. redirect($q, "$config{url}/".htmlpage($page));
  316. }
  317. return;
  318. }
  319. elsif ($form->submitted eq "Preview") {
  320. my $new=not exists $pagesources{$page};
  321. if ($new) {
  322. # temporarily record its type
  323. $pagesources{$page}=$page.".".$type;
  324. }
  325. my $content=$form->field('editcontent');
  326. run_hooks(editcontent => sub {
  327. $content=shift->(
  328. content => $content,
  329. page => $page,
  330. cgi => $q,
  331. session => $session,
  332. );
  333. });
  334. $form->tmpl_param("page_preview",
  335. htmlize($page, $type,
  336. linkify($page, $page,
  337. preprocess($page, $page,
  338. filter($page, $page, $content), 0, 1))));
  339. if ($new) {
  340. delete $pagesources{$page};
  341. }
  342. # previewing may have created files on disk
  343. saveindex();
  344. }
  345. elsif ($form->submitted eq "Save Page") {
  346. $form->tmpl_param("page_preview", "");
  347. }
  348. $form->tmpl_param("page_conflict", "");
  349. if ($form->submitted ne "Save Page" || ! $form->validate) {
  350. if ($form->field("do") eq "create") {
  351. my @page_locs;
  352. my $best_loc;
  353. if (! defined $from || ! length $from ||
  354. $from ne $form->field('from') ||
  355. file_pruned($from, $config{srcdir}) ||
  356. $from=~/^\// ||
  357. $form->submitted eq "Preview") {
  358. @page_locs=$best_loc=$page;
  359. }
  360. else {
  361. my $dir=$from."/";
  362. $dir=~s![^/]+/+$!!;
  363. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  364. $page eq gettext('discussion')) {
  365. $best_loc="$from/$page";
  366. }
  367. else {
  368. $best_loc=$dir.$page;
  369. }
  370. push @page_locs, $dir.$page;
  371. push @page_locs, "$from/$page";
  372. while (length $dir) {
  373. $dir=~s![^/]+/+$!!;
  374. push @page_locs, $dir.$page;
  375. }
  376. push @page_locs, "$config{userdir}/$page"
  377. if length $config{userdir};
  378. }
  379. @page_locs = grep {
  380. ! exists $pagecase{lc $_}
  381. } @page_locs;
  382. if (! @page_locs) {
  383. # hmm, someone else made the page in the
  384. # meantime?
  385. if ($form->submitted eq "Preview") {
  386. # let them go ahead with the edit
  387. # and resolve the conflict at save
  388. # time
  389. @page_locs=$page;
  390. }
  391. else {
  392. redirect($q, "$config{url}/".htmlpage($page));
  393. return;
  394. }
  395. }
  396. my @editable_locs = grep {
  397. check_canedit($_, $q, $session, 1)
  398. } @page_locs;
  399. if (! @editable_locs) {
  400. # let it throw an error this time
  401. map { check_canedit($_, $q, $session) } @page_locs;
  402. }
  403. my @page_types;
  404. if (exists $hooks{htmlize}) {
  405. @page_types=grep { !/^_/ }
  406. keys %{$hooks{htmlize}};
  407. }
  408. $form->tmpl_param("page_select", 1);
  409. $form->field(name => "page", type => 'select',
  410. options => [ map { pagetitle($_, 1) } @editable_locs ],
  411. value => pagetitle($best_loc, 1));
  412. $form->field(name => "type", type => 'select',
  413. options => \@page_types);
  414. $form->title(sprintf(gettext("creating %s"), pagetitle($page)));
  415. }
  416. elsif ($form->field("do") eq "edit") {
  417. check_canedit($page, $q, $session);
  418. if (! defined $form->field('editcontent') ||
  419. ! length $form->field('editcontent')) {
  420. my $content="";
  421. if (exists $pagesources{$page}) {
  422. $content=readfile(srcfile($pagesources{$page}));
  423. $content=~s/\n/\r\n/g;
  424. }
  425. $form->field(name => "editcontent", value => $content,
  426. force => 1);
  427. }
  428. $form->tmpl_param("page_select", 0);
  429. $form->field(name => "page", type => 'hidden');
  430. $form->field(name => "type", type => 'hidden');
  431. $form->title(sprintf(gettext("editing %s"), pagetitle($page)));
  432. }
  433. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  434. }
  435. else {
  436. # save page
  437. check_canedit($page, $q, $session);
  438. # The session id is stored on the form and checked to
  439. # guard against CSRF. But only if the user is logged in,
  440. # as anonok can allow anonymous edits.
  441. if (defined $session->param("name")) {
  442. my $sid=$q->param('sid');
  443. if (! defined $sid || $sid ne $session->id) {
  444. error(gettext("Your login session has expired."));
  445. }
  446. }
  447. my $exists=-e "$config{srcdir}/$file";
  448. if ($form->field("do") ne "create" && ! $exists &&
  449. ! defined srcfile($file, 1)) {
  450. $form->tmpl_param("page_gone", 1);
  451. $form->field(name => "do", value => "create", force => 1);
  452. $form->tmpl_param("page_select", 0);
  453. $form->field(name => "page", type => 'hidden');
  454. $form->field(name => "type", type => 'hidden');
  455. $form->title(sprintf(gettext("editing %s"), $page));
  456. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  457. return;
  458. }
  459. elsif ($form->field("do") eq "create" && $exists) {
  460. $form->tmpl_param("creation_conflict", 1);
  461. $form->field(name => "do", value => "edit", force => 1);
  462. $form->tmpl_param("page_select", 0);
  463. $form->field(name => "page", type => 'hidden');
  464. $form->field(name => "type", type => 'hidden');
  465. $form->title(sprintf(gettext("editing %s"), $page));
  466. $form->field("editcontent",
  467. value => readfile("$config{srcdir}/$file").
  468. "\n\n\n".$form->field("editcontent"),
  469. force => 1);
  470. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  471. return;
  472. }
  473. my $content=$form->field('editcontent');
  474. run_hooks(editcontent => sub {
  475. $content=shift->(
  476. content => $content,
  477. page => $page,
  478. cgi => $q,
  479. session => $session,
  480. );
  481. });
  482. $content=~s/\r\n/\n/g;
  483. $content=~s/\r/\n/g;
  484. $content.="\n" if $content !~ /\n$/;
  485. $config{cgi}=0; # avoid cgi error message
  486. eval { writefile($file, $config{srcdir}, $content) };
  487. $config{cgi}=1;
  488. if ($@) {
  489. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  490. force => 1);
  491. $form->tmpl_param("failed_save", 1);
  492. $form->tmpl_param("error_message", $@);
  493. $form->field("editcontent", value => $content, force => 1);
  494. $form->tmpl_param("page_select", 0);
  495. $form->field(name => "page", type => 'hidden');
  496. $form->field(name => "type", type => 'hidden');
  497. $form->title(sprintf(gettext("editing %s"), $page));
  498. showform($form, \@buttons, $session, $q,
  499. forcebaseurl => $baseurl);
  500. return;
  501. }
  502. my $conflict;
  503. if ($config{rcs}) {
  504. my $message="";
  505. if (defined $form->field('comments') &&
  506. length $form->field('comments')) {
  507. $message=$form->field('comments');
  508. }
  509. if (! $exists) {
  510. rcs_add($file);
  511. }
  512. # Prevent deadlock with post-commit hook by
  513. # signaling to it that it should not try to
  514. # do anything.
  515. disable_commit_hook();
  516. $conflict=rcs_commit($file, $message,
  517. $form->field("rcsinfo"),
  518. $session->param("name"), $ENV{REMOTE_ADDR});
  519. enable_commit_hook();
  520. rcs_update();
  521. }
  522. # Refresh even if there was a conflict, since other changes
  523. # may have been committed while the post-commit hook was
  524. # disabled.
  525. require IkiWiki::Render;
  526. refresh();
  527. saveindex();
  528. if (defined $conflict) {
  529. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  530. force => 1);
  531. $form->tmpl_param("page_conflict", 1);
  532. $form->field("editcontent", value => $conflict, force => 1);
  533. $form->field("do", "edit", force => 1);
  534. $form->tmpl_param("page_select", 0);
  535. $form->field(name => "page", type => 'hidden');
  536. $form->field(name => "type", type => 'hidden');
  537. $form->title(sprintf(gettext("editing %s"), $page));
  538. showform($form, \@buttons, $session, $q,
  539. forcebaseurl => $baseurl);
  540. return;
  541. }
  542. else {
  543. # The trailing question mark tries to avoid broken
  544. # caches and get the most recent version of the page.
  545. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  546. }
  547. }
  548. } #}}}
  549. sub cgi_getsession ($) { #{{{
  550. my $q=shift;
  551. eval q{use CGI::Session};
  552. CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname}));
  553. my $oldmask=umask(077);
  554. my $session = CGI::Session->new("driver:DB_File", $q,
  555. { FileName => "$config{wikistatedir}/sessions.db" });
  556. umask($oldmask);
  557. return $session;
  558. } #}}}
  559. sub cgi_savesession ($) { #{{{
  560. my $session=shift;
  561. # Force session flush with safe umask.
  562. my $oldmask=umask(077);
  563. $session->flush;
  564. umask($oldmask);
  565. } #}}}
  566. sub cgi (;$$) { #{{{
  567. my $q=shift;
  568. my $session=shift;
  569. if (! $q) {
  570. eval q{use CGI};
  571. error($@) if $@;
  572. $q=CGI->new;
  573. run_hooks(cgi => sub { shift->($q) });
  574. }
  575. my $do=$q->param('do');
  576. if (! defined $do || ! length $do) {
  577. my $error = $q->cgi_error;
  578. if ($error) {
  579. error("Request not processed: $error");
  580. }
  581. else {
  582. error("\"do\" parameter missing");
  583. }
  584. }
  585. # Need to lock the wiki before getting a session.
  586. lockwiki();
  587. loadindex();
  588. if (! $session) {
  589. $session=cgi_getsession($q);
  590. }
  591. # Auth hooks can sign a user in.
  592. if ($do ne 'signin' && ! defined $session->param("name")) {
  593. run_hooks(auth => sub {
  594. shift->($q, $session)
  595. });
  596. if (defined $session->param("name")) {
  597. # Make sure whatever user was authed is in the
  598. # userinfo db.
  599. if (! userinfo_get($session->param("name"), "regdate")) {
  600. userinfo_setall($session->param("name"), {
  601. email => "",
  602. password => "",
  603. regdate => time,
  604. }) || error("failed adding user");
  605. }
  606. }
  607. }
  608. if (defined $session->param("name") &&
  609. userinfo_get($session->param("name"), "banned")) {
  610. print $q->header(-status => "403 Forbidden");
  611. $session->delete();
  612. print gettext("You are banned.");
  613. cgi_savesession($session);
  614. }
  615. run_hooks(sessioncgi => sub { shift->($q, $session) });
  616. if ($do eq 'signin') {
  617. cgi_signin($q, $session);
  618. cgi_savesession($session);
  619. }
  620. elsif ($do eq 'prefs') {
  621. cgi_prefs($q, $session);
  622. }
  623. elsif ($do eq 'create' || $do eq 'edit') {
  624. cgi_editpage($q, $session);
  625. }
  626. elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
  627. cgi_postsignin($q, $session);
  628. }
  629. else {
  630. error("unknown do parameter");
  631. }
  632. } #}}}
  633. 1