summaryrefslogtreecommitdiff
path: root/IkiWiki/CGI.pm
blob: a3486cbb40034cafc2fcdedd32c828626261339d (plain)
  1. #!/usr/bin/perl
  2. package IkiWiki;
  3. use warnings;
  4. use strict;
  5. use IkiWiki;
  6. use IkiWiki::UserInfo;
  7. use open qw{:utf8 :std};
  8. use Encode;
  9. sub printheader ($) { #{{{
  10. my $session=shift;
  11. if ($config{sslcookie}) {
  12. print $session->header(-charset => 'utf-8',
  13. -cookie => $session->cookie(-httponly => 1, -secure => 1));
  14. } else {
  15. print $session->header(-charset => 'utf-8',
  16. -cookie => $session->cookie(-httponly => 1));
  17. }
  18. } #}}}
  19. sub showform ($$$$;@) { #{{{
  20. my $form=shift;
  21. my $buttons=shift;
  22. my $session=shift;
  23. my $cgi=shift;
  24. if (exists $hooks{formbuilder}) {
  25. run_hooks(formbuilder => sub {
  26. shift->(form => $form, cgi => $cgi, session => $session,
  27. buttons => $buttons);
  28. });
  29. }
  30. printheader($session);
  31. print misctemplate($form->title, $form->render(submit => $buttons), @_);
  32. }
  33. sub redirect ($$) { #{{{
  34. my $q=shift;
  35. my $url=shift;
  36. if (! $config{w3mmode}) {
  37. print $q->redirect($url);
  38. }
  39. else {
  40. print "Content-type: text/plain\n";
  41. print "W3m-control: GOTO $url\n\n";
  42. }
  43. } #}}}
  44. sub decode_cgi_utf8 ($) { #{{{
  45. # decode_form_utf8 method is needed for 5.10
  46. if ($] < 5.01) {
  47. my $cgi = shift;
  48. foreach my $f ($cgi->param) {
  49. $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
  50. }
  51. }
  52. } #}}}
  53. sub decode_form_utf8 ($) { #{{{
  54. if ($] >= 5.01) {
  55. my $form = shift;
  56. foreach my $f ($form->field) {
  57. $form->field(name => $f,
  58. value => decode_utf8($form->field($f)),
  59. force => 1,
  60. );
  61. }
  62. }
  63. } #}}}
  64. # Check if the user is signed in. If not, redirect to the signin form and
  65. # save their place to return to later.
  66. sub needsignin ($$) { #{{{
  67. my $q=shift;
  68. my $session=shift;
  69. if (! defined $session->param("name") ||
  70. ! userinfo_get($session->param("name"), "regdate")) {
  71. $session->param(postsignin => $ENV{QUERY_STRING});
  72. cgi_signin($q, $session);
  73. cgi_savesession($session);
  74. exit;
  75. }
  76. } #}}}
  77. sub cgi_signin ($$) { #{{{
  78. my $q=shift;
  79. my $session=shift;
  80. decode_cgi_utf8($q);
  81. eval q{use CGI::FormBuilder};
  82. error($@) if $@;
  83. my $form = CGI::FormBuilder->new(
  84. title => "signin",
  85. name => "signin",
  86. charset => "utf-8",
  87. method => 'POST',
  88. required => 'NONE',
  89. javascript => 0,
  90. params => $q,
  91. action => $config{cgiurl},
  92. header => 0,
  93. template => {type => 'div'},
  94. stylesheet => baseurl()."style.css",
  95. );
  96. my $buttons=["Login"];
  97. if ($q->param("do") ne "signin" && !$form->submitted) {
  98. $form->text(gettext("You need to log in first."));
  99. }
  100. $form->field(name => "do", type => "hidden", value => "signin",
  101. force => 1);
  102. decode_form_utf8($form);
  103. run_hooks(formbuilder_setup => sub {
  104. shift->(form => $form, cgi => $q, session => $session,
  105. buttons => $buttons);
  106. });
  107. decode_form_utf8($form);
  108. if ($form->submitted) {
  109. $form->validate;
  110. }
  111. showform($form, $buttons, $session, $q);
  112. } #}}}
  113. sub cgi_postsignin ($$) { #{{{
  114. my $q=shift;
  115. my $session=shift;
  116. # Continue with whatever was being done before the signin process.
  117. if (defined $session->param("postsignin")) {
  118. my $postsignin=CGI->new($session->param("postsignin"));
  119. $session->clear("postsignin");
  120. cgi($postsignin, $session);
  121. cgi_savesession($session);
  122. exit;
  123. }
  124. else {
  125. error(gettext("login failed, perhaps you need to turn on cookies?"));
  126. }
  127. } #}}}
  128. sub cgi_prefs ($$) { #{{{
  129. my $q=shift;
  130. my $session=shift;
  131. needsignin($q, $session);
  132. decode_cgi_utf8($q);
  133. # The session id is stored on the form and checked to
  134. # guard against CSRF.
  135. my $sid=$q->param('sid');
  136. if (! defined $sid) {
  137. $q->delete_all;
  138. }
  139. elsif ($sid ne $session->id) {
  140. error(gettext("Your login session has expired."));
  141. }
  142. eval q{use CGI::FormBuilder};
  143. error($@) if $@;
  144. my $form = CGI::FormBuilder->new(
  145. title => "preferences",
  146. name => "preferences",
  147. header => 0,
  148. charset => "utf-8",
  149. method => 'POST',
  150. validate => {
  151. email => 'EMAIL',
  152. },
  153. required => 'NONE',
  154. javascript => 0,
  155. params => $q,
  156. action => $config{cgiurl},
  157. template => {type => 'div'},
  158. stylesheet => baseurl()."style.css",
  159. fieldsets => [
  160. [login => gettext("Login")],
  161. [preferences => gettext("Preferences")],
  162. [admin => gettext("Admin")]
  163. ],
  164. );
  165. my $buttons=["Save Preferences", "Logout", "Cancel"];
  166. decode_form_utf8($form);
  167. run_hooks(formbuilder_setup => sub {
  168. shift->(form => $form, cgi => $q, session => $session,
  169. buttons => $buttons);
  170. });
  171. decode_form_utf8($form);
  172. $form->field(name => "do", type => "hidden", value => "prefs",
  173. force => 1);
  174. $form->field(name => "sid", type => "hidden", value => $session->id,
  175. force => 1);
  176. $form->field(name => "email", size => 50, fieldset => "preferences");
  177. my $user_name=$session->param("name");
  178. # XXX deprecated, should be removed eventually
  179. $form->field(name => "banned_users", size => 50, fieldset => "admin");
  180. if (! is_admin($user_name)) {
  181. $form->field(name => "banned_users", type => "hidden");
  182. }
  183. if (! $form->submitted) {
  184. $form->field(name => "email", force => 1,
  185. value => userinfo_get($user_name, "email"));
  186. if (is_admin($user_name)) {
  187. my $value=join(" ", get_banned_users());
  188. if (length $value) {
  189. $form->field(name => "banned_users", force => 1,
  190. value => join(" ", get_banned_users()),
  191. comment => "deprecated; please move to banned_users in setup file");
  192. }
  193. else {
  194. $form->field(name => "banned_users", type => "hidden");
  195. }
  196. }
  197. }
  198. if ($form->submitted eq 'Logout') {
  199. $session->delete();
  200. redirect($q, $config{url});
  201. return;
  202. }
  203. elsif ($form->submitted eq 'Cancel') {
  204. redirect($q, $config{url});
  205. return;
  206. }
  207. elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
  208. if (defined $form->field('email')) {
  209. userinfo_set($user_name, 'email', $form->field('email')) ||
  210. error("failed to set email");
  211. }
  212. # XXX deprecated, should be removed eventually
  213. if (is_admin($user_name)) {
  214. set_banned_users(grep { ! is_admin($_) }
  215. split(' ',
  216. $form->field("banned_users"))) ||
  217. error("failed saving changes");
  218. if (! length $form->field("banned_users")) {
  219. $form->field(name => "banned_users", type => "hidden");
  220. }
  221. }
  222. $form->text(gettext("Preferences saved."));
  223. }
  224. showform($form, $buttons, $session, $q);
  225. } #}}}
  226. sub check_banned ($$) { #{{{
  227. my $q=shift;
  228. my $session=shift;
  229. my $name=$session->param("name");
  230. if (defined $name) {
  231. # XXX banned in userinfo is deprecated, should be removed
  232. # eventually, and only banned_users be checked.
  233. if (userinfo_get($session->param("name"), "banned") ||
  234. grep { $name eq $_ } @{$config{banned_users}}) {
  235. print $q->header(-status => "403 Forbidden");
  236. $session->delete();
  237. print gettext("You are banned.");
  238. cgi_savesession($session);
  239. exit;
  240. }
  241. }
  242. }
  243. sub cgi_getsession ($) { #{{{
  244. my $q=shift;
  245. eval q{use CGI::Session; use HTML::Entities};
  246. error($@) if $@;
  247. CGI::Session->name("ikiwiki_session_".encode_entities($config{wikiname}));
  248. my $oldmask=umask(077);
  249. my $session = eval {
  250. CGI::Session->new("driver:DB_File", $q,
  251. { FileName => "$config{wikistatedir}/sessions.db" })
  252. };
  253. if (! $session || $@) {
  254. error($@." ".CGI::Session->errstr());
  255. }
  256. umask($oldmask);
  257. return $session;
  258. } #}}}
  259. # The session id is stored on the form and checked to
  260. # guard against CSRF. But only if the user is logged in,
  261. # as anonok can allow anonymous edits.
  262. sub checksessionexpiry ($$) { # {{{
  263. my $session = shift;
  264. my $sid = shift;
  265. if (defined $session->param("name")) {
  266. if (! defined $sid || $sid ne $session->id) {
  267. error(gettext("Your login session has expired."));
  268. }
  269. }
  270. } # }}}
  271. sub cgi_savesession ($) { #{{{
  272. my $session=shift;
  273. # Force session flush with safe umask.
  274. my $oldmask=umask(077);
  275. $session->flush;
  276. umask($oldmask);
  277. } #}}}
  278. sub cgi (;$$) { #{{{
  279. my $q=shift;
  280. my $session=shift;
  281. eval q{use CGI};
  282. error($@) if $@;
  283. $CGI::DISABLE_UPLOADS=$config{cgi_disable_uploads};
  284. if (! $q) {
  285. binmode(STDIN);
  286. $q=CGI->new;
  287. binmode(STDIN, ":utf8");
  288. run_hooks(cgi => sub { shift->($q) });
  289. }
  290. my $do=$q->param('do');
  291. if (! defined $do || ! length $do) {
  292. my $error = $q->cgi_error;
  293. if ($error) {
  294. error("Request not processed: $error");
  295. }
  296. else {
  297. error("\"do\" parameter missing");
  298. }
  299. }
  300. # Need to lock the wiki before getting a session.
  301. lockwiki();
  302. loadindex();
  303. if (! $session) {
  304. $session=cgi_getsession($q);
  305. }
  306. # Auth hooks can sign a user in.
  307. if ($do ne 'signin' && ! defined $session->param("name")) {
  308. run_hooks(auth => sub {
  309. shift->($q, $session)
  310. });
  311. if (defined $session->param("name")) {
  312. # Make sure whatever user was authed is in the
  313. # userinfo db.
  314. if (! userinfo_get($session->param("name"), "regdate")) {
  315. userinfo_setall($session->param("name"), {
  316. email => "",
  317. password => "",
  318. regdate => time,
  319. }) || error("failed adding user");
  320. }
  321. }
  322. }
  323. check_banned($q, $session);
  324. run_hooks(sessioncgi => sub { shift->($q, $session) });
  325. if ($do eq 'signin') {
  326. cgi_signin($q, $session);
  327. cgi_savesession($session);
  328. }
  329. elsif ($do eq 'prefs') {
  330. cgi_prefs($q, $session);
  331. }
  332. elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
  333. cgi_postsignin($q, $session);
  334. }
  335. else {
  336. error("unknown do parameter");
  337. }
  338. } #}}}
  339. # Does not need to be called directly; all errors will go through here.
  340. sub cgierror ($) { #{{{
  341. my $message=shift;
  342. print "Content-type: text/html\n\n";
  343. print misctemplate(gettext("Error"),
  344. "<p class=\"error\">".gettext("Error").": $message</p>");
  345. die $@;
  346. } #}}}
  347. 1