summaryrefslogtreecommitdiff
path: root/IkiWiki/Plugin/editpage.pm
blob: 68f43bf16614483e9120fe94f45c84890704a0c2 (plain)
  1. #!/usr/bin/perl
  2. package IkiWiki::Plugin::editpage;
  3. use warnings;
  4. use strict;
  5. use IkiWiki;
  6. use open qw{:utf8 :std};
  7. sub import { #{{{
  8. hook(type => "getsetup", id => "editpage", call => \&getsetup);
  9. hook(type => "sessioncgi", id => "editpage", call => \&IkiWiki::cgi_editpage);
  10. } # }}}
  11. sub getsetup () { #{{{
  12. return
  13. plugin => {
  14. safe => 1,
  15. rebuild => 1,
  16. },
  17. } #}}}
  18. # Back to ikiwiki namespace for the rest, this code is very much
  19. # internal to ikiwiki even though it's separated into a plugin,
  20. # and other plugins use the functions below.
  21. package IkiWiki;
  22. sub check_canedit ($$$;$) { #{{{
  23. my $page=shift;
  24. my $q=shift;
  25. my $session=shift;
  26. my $nonfatal=shift;
  27. my $canedit;
  28. run_hooks(canedit => sub {
  29. return if defined $canedit;
  30. my $ret=shift->($page, $q, $session);
  31. if (defined $ret) {
  32. if ($ret eq "") {
  33. $canedit=1;
  34. }
  35. elsif (ref $ret eq 'CODE') {
  36. $ret->() unless $nonfatal;
  37. $canedit=0;
  38. }
  39. elsif (defined $ret) {
  40. error($ret) unless $nonfatal;
  41. $canedit=0;
  42. }
  43. }
  44. });
  45. return $canedit;
  46. } #}}}
  47. sub cgi_editpage ($$) { #{{{
  48. my $q=shift;
  49. my $session=shift;
  50. my $do=$q->param('do');
  51. return unless $do eq 'create' || $do eq 'edit';
  52. decode_cgi_utf8($q);
  53. my @fields=qw(do rcsinfo subpage from page type editcontent comments);
  54. my @buttons=("Save Page", "Preview", "Cancel");
  55. eval q{use CGI::FormBuilder};
  56. error($@) if $@;
  57. my $form = CGI::FormBuilder->new(
  58. fields => \@fields,
  59. charset => "utf-8",
  60. method => 'POST',
  61. required => [qw{editcontent}],
  62. javascript => 0,
  63. params => $q,
  64. action => $config{cgiurl},
  65. header => 0,
  66. table => 0,
  67. template => scalar template_params("editpage.tmpl"),
  68. wikiname => $config{wikiname},
  69. );
  70. decode_form_utf8($form);
  71. run_hooks(formbuilder_setup => sub {
  72. shift->(form => $form, cgi => $q, session => $session,
  73. buttons => \@buttons);
  74. });
  75. decode_form_utf8($form);
  76. # This untaint is safe because we check file_pruned and
  77. # wiki_file_regexp.
  78. my ($page)=$form->field('page')=~/$config{wiki_file_regexp}/;
  79. $page=possibly_foolish_untaint($page);
  80. my $absolute=($page =~ s#^/+##);
  81. if (! defined $page || ! length $page ||
  82. file_pruned($page, $config{srcdir})) {
  83. error("bad page name");
  84. }
  85. my $baseurl=$config{url}."/".htmlpage($page);
  86. my $from;
  87. if (defined $form->field('from')) {
  88. ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
  89. }
  90. my $file;
  91. my $type;
  92. if (exists $pagesources{$page} && $form->field("do") ne "create") {
  93. $file=$pagesources{$page};
  94. $type=pagetype($file);
  95. if (! defined $type || $type=~/^_/) {
  96. error(sprintf(gettext("%s is not an editable page"), $page));
  97. }
  98. if (! $form->submitted) {
  99. $form->field(name => "rcsinfo",
  100. value => rcs_prepedit($file), force => 1);
  101. }
  102. $form->field(name => "editcontent", validate => '/.*/');
  103. }
  104. else {
  105. $type=$form->param('type');
  106. if (defined $type && length $type && $hooks{htmlize}{$type}) {
  107. $type=possibly_foolish_untaint($type);
  108. }
  109. elsif (defined $from && exists $pagesources{$from}) {
  110. # favor the type of linking page
  111. $type=pagetype($pagesources{$from});
  112. }
  113. $type=$config{default_pageext} unless defined $type;
  114. $file=$page.".".$type;
  115. if (! $form->submitted) {
  116. $form->field(name => "rcsinfo", value => "", force => 1);
  117. }
  118. $form->field(name => "editcontent", validate => '/.+/');
  119. }
  120. $form->field(name => "do", type => 'hidden');
  121. $form->field(name => "sid", type => "hidden", value => $session->id,
  122. force => 1);
  123. $form->field(name => "from", type => 'hidden');
  124. $form->field(name => "rcsinfo", type => 'hidden');
  125. $form->field(name => "subpage", type => 'hidden');
  126. $form->field(name => "page", value => $page, force => 1);
  127. $form->field(name => "type", value => $type, force => 1);
  128. $form->field(name => "comments", type => "text", size => 80);
  129. $form->field(name => "editcontent", type => "textarea", rows => 20,
  130. cols => 80);
  131. $form->tmpl_param("can_commit", $config{rcs});
  132. $form->tmpl_param("indexlink", indexlink());
  133. $form->tmpl_param("helponformattinglink",
  134. htmllink($page, $page, "ikiwiki/formatting",
  135. noimageinline => 1,
  136. linktext => "FormattingHelp"));
  137. if ($form->submitted eq "Cancel") {
  138. if ($form->field("do") eq "create" && defined $from) {
  139. redirect($q, "$config{url}/".htmlpage($from));
  140. }
  141. elsif ($form->field("do") eq "create") {
  142. redirect($q, $config{url});
  143. }
  144. else {
  145. redirect($q, "$config{url}/".htmlpage($page));
  146. }
  147. exit;
  148. }
  149. elsif ($form->submitted eq "Preview") {
  150. my $new=not exists $pagesources{$page};
  151. if ($new) {
  152. # temporarily record its type
  153. $pagesources{$page}=$page.".".$type;
  154. }
  155. my $content=$form->field('editcontent');
  156. run_hooks(editcontent => sub {
  157. $content=shift->(
  158. content => $content,
  159. page => $page,
  160. cgi => $q,
  161. session => $session,
  162. );
  163. });
  164. my $preview=htmlize($page, $page, $type,
  165. linkify($page, $page,
  166. preprocess($page, $page,
  167. filter($page, $page, $content), 0, 1)));
  168. run_hooks(format => sub {
  169. $preview=shift->(
  170. page => $page,
  171. content => $preview,
  172. );
  173. });
  174. $form->tmpl_param("page_preview", $preview);
  175. if ($new) {
  176. delete $pagesources{$page};
  177. }
  178. # previewing may have created files on disk
  179. saveindex();
  180. }
  181. elsif ($form->submitted eq "Save Page") {
  182. $form->tmpl_param("page_preview", "");
  183. }
  184. if ($form->submitted ne "Save Page" || ! $form->validate) {
  185. if ($form->field("do") eq "create") {
  186. my @page_locs;
  187. my $best_loc;
  188. if (! defined $from || ! length $from ||
  189. $from ne $form->field('from') ||
  190. file_pruned($from, $config{srcdir}) ||
  191. $from=~/^\// ||
  192. $absolute ||
  193. $form->submitted eq "Preview") {
  194. @page_locs=$best_loc=$page;
  195. }
  196. else {
  197. my $dir=$from."/";
  198. $dir=~s![^/]+/+$!!;
  199. if ((defined $form->field('subpage') && length $form->field('subpage')) ||
  200. $page eq gettext('discussion')) {
  201. $best_loc="$from/$page";
  202. }
  203. else {
  204. $best_loc=$dir.$page;
  205. }
  206. push @page_locs, $dir.$page;
  207. push @page_locs, "$from/$page";
  208. while (length $dir) {
  209. $dir=~s![^/]+/+$!!;
  210. push @page_locs, $dir.$page;
  211. }
  212. push @page_locs, "$config{userdir}/$page"
  213. if length $config{userdir};
  214. }
  215. @page_locs = grep {
  216. ! exists $pagecase{lc $_}
  217. } @page_locs;
  218. if (! @page_locs) {
  219. # hmm, someone else made the page in the
  220. # meantime?
  221. if ($form->submitted eq "Preview") {
  222. # let them go ahead with the edit
  223. # and resolve the conflict at save
  224. # time
  225. @page_locs=$page;
  226. }
  227. else {
  228. redirect($q, "$config{url}/".htmlpage($page));
  229. exit;
  230. }
  231. }
  232. my @editable_locs = grep {
  233. check_canedit($_, $q, $session, 1)
  234. } @page_locs;
  235. if (! @editable_locs) {
  236. # let it throw an error this time
  237. map { check_canedit($_, $q, $session) } @page_locs;
  238. }
  239. my @page_types;
  240. if (exists $hooks{htmlize}) {
  241. @page_types=grep { !/^_/ }
  242. keys %{$hooks{htmlize}};
  243. }
  244. $form->tmpl_param("page_select", 1);
  245. $form->field(name => "page", type => 'select',
  246. options => [ map { [ $_, pagetitle($_, 1) ] } @editable_locs ],
  247. value => $best_loc);
  248. $form->field(name => "type", type => 'select',
  249. options => \@page_types);
  250. $form->title(sprintf(gettext("creating %s"), pagetitle($page)));
  251. }
  252. elsif ($form->field("do") eq "edit") {
  253. check_canedit($page, $q, $session);
  254. if (! defined $form->field('editcontent') ||
  255. ! length $form->field('editcontent')) {
  256. my $content="";
  257. if (exists $pagesources{$page}) {
  258. $content=readfile(srcfile($pagesources{$page}));
  259. $content=~s/\n/\r\n/g;
  260. }
  261. $form->field(name => "editcontent", value => $content,
  262. force => 1);
  263. }
  264. $form->tmpl_param("page_select", 0);
  265. $form->field(name => "page", type => 'hidden');
  266. $form->field(name => "type", type => 'hidden');
  267. $form->title(sprintf(gettext("editing %s"), pagetitle($page)));
  268. }
  269. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  270. }
  271. else {
  272. # save page
  273. check_canedit($page, $q, $session);
  274. # The session id is stored on the form and checked to
  275. # guard against CSRF. But only if the user is logged in,
  276. # as anonok can allow anonymous edits.
  277. if (defined $session->param("name")) {
  278. my $sid=$q->param('sid');
  279. if (! defined $sid || $sid ne $session->id) {
  280. error(gettext("Your login session has expired."));
  281. }
  282. }
  283. my $exists=-e "$config{srcdir}/$file";
  284. if ($form->field("do") ne "create" && ! $exists &&
  285. ! defined srcfile($file, 1)) {
  286. $form->tmpl_param("message", template("editpagegone.tmpl")->output);
  287. $form->field(name => "do", value => "create", force => 1);
  288. $form->tmpl_param("page_select", 0);
  289. $form->field(name => "page", type => 'hidden');
  290. $form->field(name => "type", type => 'hidden');
  291. $form->title(sprintf(gettext("editing %s"), $page));
  292. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  293. exit;
  294. }
  295. elsif ($form->field("do") eq "create" && $exists) {
  296. $form->tmpl_param("message", template("editcreationconflict.tmpl")->output);
  297. $form->field(name => "do", value => "edit", force => 1);
  298. $form->tmpl_param("page_select", 0);
  299. $form->field(name => "page", type => 'hidden');
  300. $form->field(name => "type", type => 'hidden');
  301. $form->title(sprintf(gettext("editing %s"), $page));
  302. $form->field("editcontent",
  303. value => readfile("$config{srcdir}/$file").
  304. "\n\n\n".$form->field("editcontent"),
  305. force => 1);
  306. showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
  307. exit;
  308. }
  309. my $content=$form->field('editcontent');
  310. run_hooks(editcontent => sub {
  311. $content=shift->(
  312. content => $content,
  313. page => $page,
  314. cgi => $q,
  315. session => $session,
  316. );
  317. });
  318. $content=~s/\r\n/\n/g;
  319. $content=~s/\r/\n/g;
  320. $content.="\n" if $content !~ /\n$/;
  321. $config{cgi}=0; # avoid cgi error message
  322. eval { writefile($file, $config{srcdir}, $content) };
  323. $config{cgi}=1;
  324. if ($@) {
  325. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  326. force => 1);
  327. my $mtemplate=template("editfailedsave.tmpl");
  328. $mtemplate->param(error_message => $@);
  329. $form->tmpl_param("message", $mtemplate->output);
  330. $form->field("editcontent", value => $content, force => 1);
  331. $form->tmpl_param("page_select", 0);
  332. $form->field(name => "page", type => 'hidden');
  333. $form->field(name => "type", type => 'hidden');
  334. $form->title(sprintf(gettext("editing %s"), $page));
  335. showform($form, \@buttons, $session, $q,
  336. forcebaseurl => $baseurl);
  337. exit;
  338. }
  339. my $conflict;
  340. if ($config{rcs}) {
  341. my $message="";
  342. if (defined $form->field('comments') &&
  343. length $form->field('comments')) {
  344. $message=$form->field('comments');
  345. }
  346. if (! $exists) {
  347. rcs_add($file);
  348. }
  349. # Prevent deadlock with post-commit hook by
  350. # signaling to it that it should not try to
  351. # do anything.
  352. disable_commit_hook();
  353. $conflict=rcs_commit($file, $message,
  354. $form->field("rcsinfo"),
  355. $session->param("name"), $ENV{REMOTE_ADDR});
  356. enable_commit_hook();
  357. rcs_update();
  358. }
  359. # Refresh even if there was a conflict, since other changes
  360. # may have been committed while the post-commit hook was
  361. # disabled.
  362. require IkiWiki::Render;
  363. refresh();
  364. saveindex();
  365. if (defined $conflict) {
  366. $form->field(name => "rcsinfo", value => rcs_prepedit($file),
  367. force => 1);
  368. $form->tmpl_param("message", template("editconflict.tmpl")->output);
  369. $form->field("editcontent", value => $conflict, force => 1);
  370. $form->field("do", "edit", force => 1);
  371. $form->tmpl_param("page_select", 0);
  372. $form->field(name => "page", type => 'hidden');
  373. $form->field(name => "type", type => 'hidden');
  374. $form->title(sprintf(gettext("editing %s"), $page));
  375. showform($form, \@buttons, $session, $q,
  376. forcebaseurl => $baseurl);
  377. }
  378. else {
  379. # The trailing question mark tries to avoid broken
  380. # caches and get the most recent version of the page.
  381. redirect($q, "$config{url}/".htmlpage($page)."?updated");
  382. }
  383. }
  384. exit;
  385. } #}}}
  386. 1