summaryrefslogtreecommitdiff
path: root/IkiWiki/Plugin/attachment.pm
blob: e08aa36771b8bb927f9a8a5ba50189f545fae8bb (plain)
  1. #!/usr/bin/perl
  2. package IkiWiki::Plugin::attachment;
  3. use warnings;
  4. use strict;
  5. use IkiWiki 2.00;
  6. sub import { #{{{
  7. hook(type => "checkconfig", id => "attachment", call => \&checkconfig);
  8. hook(type => "formbuilder_setup", id => "attachment", call => \&formbuilder_setup);
  9. hook(type => "formbuilder", id => "attachment", call => \&formbuilder);
  10. } # }}}
  11. sub check_canattach ($$;$) {
  12. my $session=shift;
  13. my $dest=shift; # where it's going to be put, under the srcdir
  14. my $file=shift; # the path to the attachment currently
  15. # Don't allow an attachment to be uploaded with the same name as an
  16. # existing page.
  17. if (exists $pagesources{$dest} && $pagesources{$dest} ne $dest) {
  18. error(sprintf(gettext("there is already a page named %s"), $dest));
  19. }
  20. # Use a special pagespec to test that the attachment is valid.
  21. my $allowed=1;
  22. foreach my $admin (@{$config{adminuser}}) {
  23. my $allowed_attachments=IkiWiki::userinfo_get($admin, "allowed_attachments");
  24. if (defined $allowed_attachments &&
  25. length $allowed_attachments) {
  26. $allowed=pagespec_match($dest,
  27. $allowed_attachments,
  28. file => $file,
  29. user => $session->param("name"),
  30. ip => $ENV{REMOTE_ADDR},
  31. );
  32. last if $allowed;
  33. }
  34. }
  35. if (! $allowed) {
  36. error(gettext("prohibited by allowed_attachments")." ($allowed)");
  37. }
  38. else {
  39. return 1;
  40. }
  41. }
  42. sub checkconfig () { #{{{
  43. $config{cgi_disable_uploads}=0;
  44. } #}}}
  45. sub formbuilder_setup (@) { #{{{
  46. my %params=@_;
  47. my $form=$params{form};
  48. my $q=$params{cgi};
  49. if (defined $form->field("do") && $form->field("do") eq "edit") {
  50. # Add attachment field, set type to multipart.
  51. $form->enctype(&CGI::MULTIPART);
  52. $form->field(name => 'attachment', type => 'file');
  53. # These buttons are not put in the usual place, so
  54. # are not added to the normal formbuilder button list.
  55. $form->tmpl_param("field-upload" => '<input name="_submit" type="submit" value="Upload Attachment" />');
  56. $form->tmpl_param("field-link" => '<input name="_submit" type="submit" value="Insert Links" />');
  57. # Add the javascript from the toggle plugin;
  58. # the attachments interface uses it to toggle visibility.
  59. require IkiWiki::Plugin::toggle;
  60. $form->tmpl_param("javascript" => $IkiWiki::Plugin::toggle::javascript);
  61. # Start with the attachments interface toggled invisible,
  62. # but if it was used, keep it open.
  63. if ($form->submitted ne "Upload Attachment" &&
  64. (! defined $q->param("attachment_select") ||
  65. ! length $q->param("attachment_select"))) {
  66. $form->tmpl_param("attachments-class" => "toggleable");
  67. }
  68. else {
  69. $form->tmpl_param("attachments-class" => "toggleable-open");
  70. }
  71. }
  72. elsif ($form->title eq "preferences") {
  73. my $session=$params{session};
  74. my $user_name=$session->param("name");
  75. $form->field(name => "allowed_attachments", size => 50,
  76. fieldset => "admin",
  77. comment => "(".
  78. htmllink("", "",
  79. "ikiwiki/PageSpec/attachment",
  80. noimageinline => 1,
  81. linktext => "Enhanced PageSpec",
  82. ).")"
  83. );
  84. if (! IkiWiki::is_admin($user_name)) {
  85. $form->field(name => "allowed_attachments", type => "hidden");
  86. }
  87. if (! $form->submitted) {
  88. $form->field(name => "allowed_attachments", force => 1,
  89. value => IkiWiki::userinfo_get($user_name, "allowed_attachments"));
  90. }
  91. if ($form->submitted && $form->submitted eq 'Save Preferences') {
  92. if (defined $form->field("allowed_attachments")) {
  93. IkiWiki::userinfo_set($user_name, "allowed_attachments",
  94. $form->field("allowed_attachments")) ||
  95. error("failed to set allowed_attachments");
  96. }
  97. }
  98. }
  99. } #}}}
  100. sub formbuilder (@) { #{{{
  101. my %params=@_;
  102. my $form=$params{form};
  103. my $q=$params{cgi};
  104. return if ! defined $form->field("do") || $form->field("do") ne "edit";
  105. my $filename=$q->param('attachment');
  106. if (defined $filename && length $filename &&
  107. ($form->submitted eq "Upload Attachment" || $form->submitted eq "Save Page")) {
  108. my $session=$params{session};
  109. # This is an (apparently undocumented) way to get the name
  110. # of the temp file that CGI writes the upload to.
  111. my $tempfile=$q->tmpFileName($filename);
  112. if (! defined $tempfile || ! length $tempfile) {
  113. # perl 5.8 needs an alternative, awful method
  114. if ($q =~ /HASH/ && exists $q->{'.tmpfiles'}) {
  115. foreach my $key (keys(%{$q->{'.tmpfiles'}})) {
  116. $tempfile=$q->tmpFileName(\$key);
  117. last if defined $tempfile && length $tempfile;
  118. }
  119. }
  120. if (! defined $tempfile || ! length $tempfile) {
  121. error("CGI::tmpFileName failed to return the uploaded file name");
  122. }
  123. }
  124. $filename=IkiWiki::linkpage(
  125. IkiWiki::possibly_foolish_untaint(
  126. attachment_location($form->field('page')).
  127. IkiWiki::basename($filename)));
  128. if (IkiWiki::file_pruned($filename, $config{srcdir})) {
  129. error(gettext("bad attachment filename"));
  130. }
  131. # Check that the user is allowed to edit a page with the
  132. # name of the attachment.
  133. IkiWiki::check_canedit($filename, $q, $session, 1);
  134. # And that the attachment itself is acceptable.
  135. check_canattach($session, $filename, $tempfile);
  136. # Needed for fast_file_copy and for rendering below.
  137. require IkiWiki::Render;
  138. # Move the attachment into place.
  139. # Try to use a fast rename; fall back to copying.
  140. IkiWiki::prep_writefile($filename, $config{srcdir});
  141. unlink($config{srcdir}."/".$filename);
  142. if (rename($tempfile, $config{srcdir}."/".$filename)) {
  143. # The temp file has tight permissions; loosen up.
  144. chmod(0666 & ~umask, $config{srcdir}."/".$filename);
  145. }
  146. else {
  147. my $fh=$q->upload('attachment');
  148. if (! defined $fh || ! ref $fh) {
  149. # needed by old CGI versions
  150. $fh=$q->param('attachment');
  151. if (! defined $fh || ! ref $fh) {
  152. # even that doesn't always work,
  153. # fall back to opening the tempfile
  154. $fh=undef;
  155. open($fh, "<", $tempfile) || error("failed to open \"$tempfile\": $!");
  156. }
  157. }
  158. binmode($fh);
  159. writefile($filename, $config{srcdir}, undef, 1, sub {
  160. IkiWiki::fast_file_copy($tempfile, $filename, $fh, @_);
  161. });
  162. }
  163. # Check the attachment in and trigger a wiki refresh.
  164. if ($config{rcs}) {
  165. IkiWiki::rcs_add($filename);
  166. IkiWiki::disable_commit_hook();
  167. IkiWiki::rcs_commit($filename, gettext("attachment upload"),
  168. IkiWiki::rcs_prepedit($filename),
  169. $session->param("name"), $ENV{REMOTE_ADDR});
  170. IkiWiki::enable_commit_hook();
  171. IkiWiki::rcs_update();
  172. }
  173. IkiWiki::refresh();
  174. IkiWiki::saveindex();
  175. }
  176. elsif ($form->submitted eq "Insert Links") {
  177. my $add="";
  178. foreach my $f ($q->param("attachment_select")) {
  179. $add.="[[$f]]\n";
  180. }
  181. $form->field(name => 'editcontent',
  182. value => $form->field('editcontent')."\n\n".$add,
  183. force => 1) if length $add;
  184. }
  185. # Generate the attachment list only after having added any new
  186. # attachments.
  187. $form->tmpl_param("attachment_list" => [attachment_list($form->field('page'))]);
  188. } # }}}
  189. sub attachment_location ($) {
  190. my $page=shift;
  191. # Put the attachment in a subdir of the page it's attached
  192. # to, unless that page is an "index" page.
  193. $page=~s/(^|\/)index//;
  194. $page.="/" if length $page;
  195. return $page;
  196. }
  197. sub attachment_list ($) {
  198. my $page=shift;
  199. my $loc=attachment_location($page);
  200. my @ret;
  201. foreach my $f (values %pagesources) {
  202. if (! defined IkiWiki::pagetype($f) &&
  203. $f=~m/^\Q$loc\E[^\/]+$/ &&
  204. -e "$config{srcdir}/$f") {
  205. push @ret, {
  206. "field-select" => '<input type="checkbox" name="attachment_select" value="'.$f.'" />',
  207. link => htmllink($page, $page, $f, noimageinline => 1),
  208. size => humansize((stat(_))[7]),
  209. mtime => displaytime($IkiWiki::pagemtime{$f}),
  210. mtime_raw => $IkiWiki::pagemtime{$f},
  211. };
  212. }
  213. }
  214. # Sort newer attachments to the top of the list, so a newly-added
  215. # attachment appears just before the form used to add it.
  216. return sort { $b->{mtime_raw} <=> $a->{mtime_raw} || $a->{link} cmp $b->{link} } @ret;
  217. }
  218. my %units=( # size in bytes
  219. B => 1,
  220. byte => 1,
  221. KB => 2 ** 10,
  222. kilobyte => 2 ** 10,
  223. K => 2 ** 10,
  224. KB => 2 ** 10,
  225. kilobyte => 2 ** 10,
  226. M => 2 ** 20,
  227. MB => 2 ** 20,
  228. megabyte => 2 ** 20,
  229. G => 2 ** 30,
  230. GB => 2 ** 30,
  231. gigabyte => 2 ** 30,
  232. T => 2 ** 40,
  233. TB => 2 ** 40,
  234. terabyte => 2 ** 40,
  235. P => 2 ** 50,
  236. PB => 2 ** 50,
  237. petabyte => 2 ** 50,
  238. E => 2 ** 60,
  239. EB => 2 ** 60,
  240. exabyte => 2 ** 60,
  241. Z => 2 ** 70,
  242. ZB => 2 ** 70,
  243. zettabyte => 2 ** 70,
  244. Y => 2 ** 80,
  245. YB => 2 ** 80,
  246. yottabyte => 2 ** 80,
  247. # ikiwiki, if you find you need larger data quantities, either modify
  248. # yourself to add them, or travel back in time to 2008 and kill me.
  249. # -- Joey
  250. );
  251. sub parsesize ($) { #{{{
  252. my $size=shift;
  253. no warnings;
  254. my $base=$size+0; # force to number
  255. use warnings;
  256. foreach my $unit (sort keys %units) {
  257. if ($size=~/[0-9\s]\Q$unit\E$/i) {
  258. return $base * $units{$unit};
  259. }
  260. }
  261. return $base;
  262. } #}}}
  263. sub humansize ($) { #{{{
  264. my $size=shift;
  265. foreach my $unit (reverse sort { $units{$a} <=> $units{$b} || $b cmp $a } keys %units) {
  266. if ($size / $units{$unit} > 0.25) {
  267. return (int($size / $units{$unit} * 10)/10).$unit;
  268. }
  269. }
  270. return $size; # near zero, or negative
  271. } #}}}
  272. package IkiWiki::PageSpec;
  273. sub match_maxsize ($$;@) { #{{{
  274. shift;
  275. my $maxsize=eval{IkiWiki::Plugin::attachment::parsesize(shift)};
  276. if ($@) {
  277. return IkiWiki::FailReason->new("unable to parse maxsize (or number too large)");
  278. }
  279. my %params=@_;
  280. if (! exists $params{file}) {
  281. return IkiWiki::FailReason->new("no file specified");
  282. }
  283. if (-s $params{file} > $maxsize) {
  284. return IkiWiki::FailReason->new("file too large (".(-s $params{file})." > $maxsize)");
  285. }
  286. else {
  287. return IkiWiki::SuccessReason->new("file not too large");
  288. }
  289. } #}}}
  290. sub match_minsize ($$;@) { #{{{
  291. shift;
  292. my $minsize=eval{IkiWiki::Plugin::attachment::parsesize(shift)};
  293. if ($@) {
  294. return IkiWiki::FailReason->new("unable to parse minsize (or number too large)");
  295. }
  296. my %params=@_;
  297. if (! exists $params{file}) {
  298. return IkiWiki::FailReason->new("no file specified");
  299. }
  300. if (-s $params{file} < $minsize) {
  301. return IkiWiki::FailReason->new("file too small");
  302. }
  303. else {
  304. return IkiWiki::SuccessReason->new("file not too small");
  305. }
  306. } #}}}
  307. sub match_mimetype ($$;@) { #{{{
  308. shift;
  309. my $wanted=shift;
  310. my %params=@_;
  311. if (! exists $params{file}) {
  312. return IkiWiki::FailReason->new("no file specified");
  313. }
  314. # Use ::magic to get the mime type, the idea is to only trust
  315. # data obtained by examining the actual file contents.
  316. eval q{use File::MimeInfo::Magic};
  317. if ($@) {
  318. return IkiWiki::FailReason->new("failed to load File::MimeInfo::Magic ($@); cannot check MIME type");
  319. }
  320. my $mimetype=File::MimeInfo::Magic::magic($params{file});
  321. if (! defined $mimetype) {
  322. $mimetype="unknown";
  323. }
  324. my $regexp=IkiWiki::glob2re($wanted);
  325. if ($mimetype!~/^$regexp$/i) {
  326. return IkiWiki::FailReason->new("file MIME type is $mimetype, not $wanted");
  327. }
  328. else {
  329. return IkiWiki::SuccessReason->new("file MIME type is $mimetype");
  330. }
  331. } #}}}
  332. sub match_virusfree ($$;@) { #{{{
  333. shift;
  334. my $wanted=shift;
  335. my %params=@_;
  336. if (! exists $params{file}) {
  337. return IkiWiki::FailReason->new("no file specified");
  338. }
  339. if (! exists $IkiWiki::config{virus_checker} ||
  340. ! length $IkiWiki::config{virus_checker}) {
  341. return IkiWiki::FailReason->new("no virus_checker configured");
  342. }
  343. # The file needs to be fed into the virus checker on stdin,
  344. # because the file is not world-readable, and if clamdscan is
  345. # used, clamd would fail to read it.
  346. eval q{use IPC::Open2};
  347. error($@) if $@;
  348. open (IN, "<", $params{file}) || return IkiWiki::FailReason->new("failed to read file");
  349. binmode(IN);
  350. my $sigpipe=0;
  351. $SIG{PIPE} = sub { $sigpipe=1 };
  352. my $pid=open2(\*CHECKER_OUT, "<&IN", $IkiWiki::config{virus_checker});
  353. my $reason=<CHECKER_OUT>;
  354. chomp $reason;
  355. 1 while (<CHECKER_OUT>);
  356. close(CHECKER_OUT);
  357. waitpid $pid, 0;
  358. $SIG{PIPE}="DEFAULT";
  359. if ($sigpipe || $?) {
  360. if (! length $reason) {
  361. $reason="virus checker $IkiWiki::config{virus_checker}; failed with no output";
  362. }
  363. return IkiWiki::FailReason->new("file seems to contain a virus ($reason)");
  364. }
  365. else {
  366. return IkiWiki::SuccessReason->new("file seems virusfree ($reason)");
  367. }
  368. } #}}}
  369. sub match_ispage ($$;@) { #{{{
  370. my $filename=shift;
  371. if (defined IkiWiki::pagetype($filename)) {
  372. return IkiWiki::SuccessReason->new("file is a wiki page");
  373. }
  374. else {
  375. return IkiWiki::FailReason->new("file is not a wiki page");
  376. }
  377. } #}}}
  378. sub match_user ($$;@) { #{{{
  379. shift;
  380. my $user=shift;
  381. my %params=@_;
  382. if (! exists $params{user}) {
  383. return IkiWiki::FailReason->new("no user specified");
  384. }
  385. if (defined $params{user} && lc $params{user} eq lc $user) {
  386. return IkiWiki::SuccessReason->new("user is $user");
  387. }
  388. elsif (! defined $params{user}) {
  389. return IkiWiki::FailReason->new("not logged in");
  390. }
  391. else {
  392. return IkiWiki::FailReason->new("user is $params{user}, not $user");
  393. }
  394. } #}}}
  395. sub match_ip ($$;@) { #{{{
  396. shift;
  397. my $ip=shift;
  398. my %params=@_;
  399. if (! exists $params{ip}) {
  400. return IkiWiki::FailReason->new("no IP specified");
  401. }
  402. if (defined $params{ip} && lc $params{ip} eq lc $ip) {
  403. return IkiWiki::SuccessReason->new("IP is $ip");
  404. }
  405. else {
  406. return IkiWiki::FailReason->new("IP is $params{ip}, not $ip");
  407. }
  408. } #}}}
  409. 1