9 use open qw{:utf8 :std};
12 sub printheader ($) { #{{{
15 if ($config{sslcookie}) {
16 print $session->header(-charset => 'utf-8',
17 -cookie => $session->cookie(-secure => 1));
19 print $session->header(-charset => 'utf-8');
24 sub showform ($$$$;@) { #{{{
30 if (exists $hooks{formbuilder}) {
31 run_hooks(formbuilder => sub {
32 shift->(form => $form, cgi => $cgi, session => $session,
37 printheader($session);
38 print misctemplate($form->title, $form->render(submit => $buttons), @_);
41 sub redirect ($$) { #{{{
44 if (! $config{w3mmode}) {
45 print $q->redirect($url);
48 print "Content-type: text/plain\n";
49 print "W3m-control: GOTO $url\n\n";
53 sub check_canedit ($$$;$) { #{{{
60 run_hooks(canedit => sub {
61 return if defined $canedit;
62 my $ret=shift->($page, $q, $session);
67 elsif (ref $ret eq 'CODE') {
68 $ret->() unless $nonfatal;
71 elsif (defined $ret) {
72 error($ret) unless $nonfatal;
80 sub decode_cgi_utf8 ($) { #{{{
81 # decode_form_utf8 method is needed for 5.10
84 foreach my $f ($cgi->param) {
85 $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
90 sub decode_form_utf8 ($) { #{{{
93 foreach my $f ($form->field) {
94 $form->field(name => $f,
95 value => decode_utf8($form->field($f)),
102 # Check if the user is signed in. If not, redirect to the signin form and
103 # save their place to return to later.
104 sub needsignin ($$) { #{{{
108 if (! defined $session->param("name") ||
109 ! userinfo_get($session->param("name"), "regdate")) {
110 $session->param(postsignin => $ENV{QUERY_STRING});
111 cgi_signin($q, $session);
112 cgi_savesession($session);
117 sub cgi_signin ($$) { #{{{
122 eval q{use CGI::FormBuilder};
124 my $form = CGI::FormBuilder->new(
132 action => $config{cgiurl},
134 template => {type => 'div'},
135 stylesheet => baseurl()."style.css",
137 my $buttons=["Login"];
139 if ($q->param("do") ne "signin" && !$form->submitted) {
140 $form->text(gettext("You need to log in first."));
142 $form->field(name => "do", type => "hidden", value => "signin",
145 decode_form_utf8($form);
146 run_hooks(formbuilder_setup => sub {
147 shift->(form => $form, cgi => $q, session => $session,
148 buttons => $buttons);
150 decode_form_utf8($form);
152 if ($form->submitted) {
156 showform($form, $buttons, $session, $q);
159 sub cgi_postsignin ($$) { #{{{
163 # Continue with whatever was being done before the signin process.
164 if (defined $session->param("postsignin")) {
165 my $postsignin=CGI->new($session->param("postsignin"));
166 $session->clear("postsignin");
167 cgi($postsignin, $session);
168 cgi_savesession($session);
172 error(gettext("login failed, perhaps you need to turn on cookies?"));
176 sub cgi_prefs ($$) { #{{{
180 needsignin($q, $session);
183 # The session id is stored on the form and checked to
184 # guard against CSRF.
185 my $sid=$q->param('sid');
186 if (! defined $sid) {
189 elsif ($sid ne $session->id) {
190 error(gettext("Your login session has expired."));
193 eval q{use CGI::FormBuilder};
195 my $form = CGI::FormBuilder->new(
196 title => "preferences",
197 name => "preferences",
207 action => $config{cgiurl},
208 template => {type => 'div'},
209 stylesheet => baseurl()."style.css",
211 [login => gettext("Login")],
212 [preferences => gettext("Preferences")],
213 [admin => gettext("Admin")]
216 my $buttons=["Save Preferences", "Logout", "Cancel"];
218 decode_form_utf8($form);
219 run_hooks(formbuilder_setup => sub {
220 shift->(form => $form, cgi => $q, session => $session,
221 buttons => $buttons);
223 decode_form_utf8($form);
225 $form->field(name => "do", type => "hidden", value => "prefs",
227 $form->field(name => "sid", type => "hidden", value => $session->id,
229 $form->field(name => "email", size => 50, fieldset => "preferences");
230 $form->field(name => "banned_users", size => 50,
231 fieldset => "admin");
233 my $user_name=$session->param("name");
234 if (! is_admin($user_name)) {
235 $form->field(name => "banned_users", type => "hidden");
238 if (! $form->submitted) {
239 $form->field(name => "email", force => 1,
240 value => userinfo_get($user_name, "email"));
241 if (is_admin($user_name)) {
242 $form->field(name => "banned_users", force => 1,
243 value => join(" ", get_banned_users()));
247 if ($form->submitted eq 'Logout') {
249 redirect($q, $config{url});
252 elsif ($form->submitted eq 'Cancel') {
253 redirect($q, $config{url});
256 elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
257 if (defined $form->field('email')) {
258 userinfo_set($user_name, 'email', $form->field('email')) ||
259 error("failed to set email");
261 if (is_admin($user_name)) {
262 set_banned_users(grep { ! is_admin($_) }
264 $form->field("banned_users"))) ||
265 error("failed saving changes");
267 $form->text(gettext("Preferences saved."));
270 showform($form, $buttons, $session, $q);
273 sub cgi_editpage ($$) { #{{{
279 my @fields=qw(do rcsinfo subpage from page type editcontent comments);
280 my @buttons=("Save Page", "Preview", "Cancel");
281 eval q{use CGI::FormBuilder};
283 my $form = CGI::FormBuilder->new(
287 required => [qw{editcontent}],
290 action => $config{cgiurl},
293 template => scalar template_params("editpage.tmpl"),
294 wikiname => $config{wikiname},
297 decode_form_utf8($form);
298 run_hooks(formbuilder_setup => sub {
299 shift->(form => $form, cgi => $q, session => $session,
300 buttons => \@buttons);
302 decode_form_utf8($form);
304 # This untaint is safe because we check file_pruned.
305 my $page=$form->field('page');
306 $page=possibly_foolish_untaint($page);
307 my $absolute=($page =~ s#^/+##);
308 if (! defined $page || ! length $page ||
309 file_pruned($page, $config{srcdir})) {
310 error("bad page name");
313 my $baseurl=$config{url}."/".htmlpage($page);
316 if (defined $form->field('from')) {
317 ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
322 if (exists $pagesources{$page} && $form->field("do") ne "create") {
323 $file=$pagesources{$page};
324 $type=pagetype($file);
325 if (! defined $type || $type=~/^_/) {
326 error(sprintf(gettext("%s is not an editable page"), $page));
328 if (! $form->submitted) {
329 $form->field(name => "rcsinfo",
330 value => rcs_prepedit($file), force => 1);
332 $form->field(name => "editcontent", validate => '/.*/');
335 $type=$form->param('type');
336 if (defined $type && length $type && $hooks{htmlize}{$type}) {
337 $type=possibly_foolish_untaint($type);
339 elsif (defined $from && exists $pagesources{$from}) {
340 # favor the type of linking page
341 $type=pagetype($pagesources{$from});
343 $type=$config{default_pageext} unless defined $type;
344 $file=$page.".".$type;
345 if (! $form->submitted) {
346 $form->field(name => "rcsinfo", value => "", force => 1);
348 $form->field(name => "editcontent", validate => '/.+/');
351 $form->field(name => "do", type => 'hidden');
352 $form->field(name => "sid", type => "hidden", value => $session->id,
354 $form->field(name => "from", type => 'hidden');
355 $form->field(name => "rcsinfo", type => 'hidden');
356 $form->field(name => "subpage", type => 'hidden');
357 $form->field(name => "page", value => $page, force => 1);
358 $form->field(name => "type", value => $type, force => 1);
359 $form->field(name => "comments", type => "text", size => 80);
360 $form->field(name => "editcontent", type => "textarea", rows => 20,
362 $form->tmpl_param("can_commit", $config{rcs});
363 $form->tmpl_param("indexlink", indexlink());
364 $form->tmpl_param("helponformattinglink",
365 htmllink($page, $page, "ikiwiki/formatting",
367 linktext => "FormattingHelp"));
369 if ($form->submitted eq "Cancel") {
370 if ($form->field("do") eq "create" && defined $from) {
371 redirect($q, "$config{url}/".htmlpage($from));
373 elsif ($form->field("do") eq "create") {
374 redirect($q, $config{url});
377 redirect($q, "$config{url}/".htmlpage($page));
381 elsif ($form->submitted eq "Preview") {
382 my $new=not exists $pagesources{$page};
384 # temporarily record its type
385 $pagesources{$page}=$page.".".$type;
388 my $content=$form->field('editcontent');
390 run_hooks(editcontent => sub {
398 my $preview=htmlize($page, $page, $type,
399 linkify($page, $page,
400 preprocess($page, $page,
401 filter($page, $page, $content), 0, 1)));
402 run_hooks(format => sub {
408 $form->tmpl_param("page_preview", $preview);
411 delete $pagesources{$page};
413 # previewing may have created files on disk
416 elsif ($form->submitted eq "Save Page") {
417 $form->tmpl_param("page_preview", "");
419 $form->tmpl_param("page_conflict", "");
421 if ($form->submitted ne "Save Page" || ! $form->validate) {
422 if ($form->field("do") eq "create") {
425 if (! defined $from || ! length $from ||
426 $from ne $form->field('from') ||
427 file_pruned($from, $config{srcdir}) ||
430 $form->submitted eq "Preview") {
431 @page_locs=$best_loc=$page;
437 if ((defined $form->field('subpage') && length $form->field('subpage')) ||
438 $page eq gettext('discussion')) {
439 $best_loc="$from/$page";
442 $best_loc=$dir.$page;
445 push @page_locs, $dir.$page;
446 push @page_locs, "$from/$page";
447 while (length $dir) {
449 push @page_locs, $dir.$page;
452 push @page_locs, "$config{userdir}/$page"
453 if length $config{userdir};
457 ! exists $pagecase{lc $_}
460 # hmm, someone else made the page in the
462 if ($form->submitted eq "Preview") {
463 # let them go ahead with the edit
464 # and resolve the conflict at save
469 redirect($q, "$config{url}/".htmlpage($page));
474 my @editable_locs = grep {
475 check_canedit($_, $q, $session, 1)
477 if (! @editable_locs) {
478 # let it throw an error this time
479 map { check_canedit($_, $q, $session) } @page_locs;
483 if (exists $hooks{htmlize}) {
484 @page_types=grep { !/^_/ }
485 keys %{$hooks{htmlize}};
488 $form->tmpl_param("page_select", 1);
489 $form->field(name => "page", type => 'select',
490 options => [ map { [ $_, pagetitle($_, 1) ] } @editable_locs ],
492 $form->field(name => "type", type => 'select',
493 options => \@page_types);
494 $form->title(sprintf(gettext("creating %s"), pagetitle($page)));
497 elsif ($form->field("do") eq "edit") {
498 check_canedit($page, $q, $session);
499 if (! defined $form->field('editcontent') ||
500 ! length $form->field('editcontent')) {
502 if (exists $pagesources{$page}) {
503 $content=readfile(srcfile($pagesources{$page}));
504 $content=~s/\n/\r\n/g;
506 $form->field(name => "editcontent", value => $content,
509 $form->tmpl_param("page_select", 0);
510 $form->field(name => "page", type => 'hidden');
511 $form->field(name => "type", type => 'hidden');
512 $form->title(sprintf(gettext("editing %s"), pagetitle($page)));
515 showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
519 check_canedit($page, $q, $session);
521 # The session id is stored on the form and checked to
522 # guard against CSRF. But only if the user is logged in,
523 # as anonok can allow anonymous edits.
524 if (defined $session->param("name")) {
525 my $sid=$q->param('sid');
526 if (! defined $sid || $sid ne $session->id) {
527 error(gettext("Your login session has expired."));
531 my $exists=-e "$config{srcdir}/$file";
533 if ($form->field("do") ne "create" && ! $exists &&
534 ! defined srcfile($file, 1)) {
535 $form->tmpl_param("page_gone", 1);
536 $form->field(name => "do", value => "create", force => 1);
537 $form->tmpl_param("page_select", 0);
538 $form->field(name => "page", type => 'hidden');
539 $form->field(name => "type", type => 'hidden');
540 $form->title(sprintf(gettext("editing %s"), $page));
541 showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
544 elsif ($form->field("do") eq "create" && $exists) {
545 $form->tmpl_param("creation_conflict", 1);
546 $form->field(name => "do", value => "edit", force => 1);
547 $form->tmpl_param("page_select", 0);
548 $form->field(name => "page", type => 'hidden');
549 $form->field(name => "type", type => 'hidden');
550 $form->title(sprintf(gettext("editing %s"), $page));
551 $form->field("editcontent",
552 value => readfile("$config{srcdir}/$file").
553 "\n\n\n".$form->field("editcontent"),
555 showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
559 my $content=$form->field('editcontent');
560 run_hooks(editcontent => sub {
568 $content=~s/\r\n/\n/g;
570 $content.="\n" if $content !~ /\n$/;
572 $config{cgi}=0; # avoid cgi error message
573 eval { writefile($file, $config{srcdir}, $content) };
576 $form->field(name => "rcsinfo", value => rcs_prepedit($file),
578 $form->tmpl_param("failed_save", 1);
579 $form->tmpl_param("error_message", $@);
580 $form->field("editcontent", value => $content, force => 1);
581 $form->tmpl_param("page_select", 0);
582 $form->field(name => "page", type => 'hidden');
583 $form->field(name => "type", type => 'hidden');
584 $form->title(sprintf(gettext("editing %s"), $page));
585 showform($form, \@buttons, $session, $q,
586 forcebaseurl => $baseurl);
593 if (defined $form->field('comments') &&
594 length $form->field('comments')) {
595 $message=$form->field('comments');
602 # Prevent deadlock with post-commit hook by
603 # signaling to it that it should not try to
605 disable_commit_hook();
606 $conflict=rcs_commit($file, $message,
607 $form->field("rcsinfo"),
608 $session->param("name"), $ENV{REMOTE_ADDR});
609 enable_commit_hook();
613 # Refresh even if there was a conflict, since other changes
614 # may have been committed while the post-commit hook was
616 require IkiWiki::Render;
620 if (defined $conflict) {
621 $form->field(name => "rcsinfo", value => rcs_prepedit($file),
623 $form->tmpl_param("page_conflict", 1);
624 $form->field("editcontent", value => $conflict, force => 1);
625 $form->field("do", "edit", force => 1);
626 $form->tmpl_param("page_select", 0);
627 $form->field(name => "page", type => 'hidden');
628 $form->field(name => "type", type => 'hidden');
629 $form->title(sprintf(gettext("editing %s"), $page));
630 showform($form, \@buttons, $session, $q,
631 forcebaseurl => $baseurl);
635 # The trailing question mark tries to avoid broken
636 # caches and get the most recent version of the page.
637 redirect($q, "$config{url}/".htmlpage($page)."?updated");
642 sub cgi_getsession ($) { #{{{
645 eval q{use CGI::Session};
647 CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname}));
649 my $oldmask=umask(077);
651 CGI::Session->new("driver:DB_File", $q,
652 { FileName => "$config{wikistatedir}/sessions.db" })
654 if (! $session || $@) {
655 error($@." ".CGI::Session->errstr());
663 sub cgi_savesession ($) { #{{{
666 # Force session flush with safe umask.
667 my $oldmask=umask(077);
678 $CGI::DISABLE_UPLOADS=$config{cgi_disable_uploads};
683 binmode(STDIN, ":utf8");
685 run_hooks(cgi => sub { shift->($q) });
688 my $do=$q->param('do');
689 if (! defined $do || ! length $do) {
690 my $error = $q->cgi_error;
692 error("Request not processed: $error");
695 error("\"do\" parameter missing");
699 # Need to lock the wiki before getting a session.
704 $session=cgi_getsession($q);
707 # Auth hooks can sign a user in.
708 if ($do ne 'signin' && ! defined $session->param("name")) {
709 run_hooks(auth => sub {
710 shift->($q, $session)
712 if (defined $session->param("name")) {
713 # Make sure whatever user was authed is in the
715 if (! userinfo_get($session->param("name"), "regdate")) {
716 userinfo_setall($session->param("name"), {
720 }) || error("failed adding user");
725 if (defined $session->param("name") &&
726 userinfo_get($session->param("name"), "banned")) {
727 print $q->header(-status => "403 Forbidden");
729 print gettext("You are banned.");
730 cgi_savesession($session);
733 run_hooks(sessioncgi => sub { shift->($q, $session) });
735 if ($do eq 'signin') {
736 cgi_signin($q, $session);
737 cgi_savesession($session);
739 elsif ($do eq 'prefs') {
740 cgi_prefs($q, $session);
742 elsif ($do eq 'create' || $do eq 'edit') {
743 cgi_editpage($q, $session);
745 elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
746 cgi_postsignin($q, $session);
749 error("unknown do parameter");
753 # Does not need tobe called directly; all errors will go through here.
754 sub cgierror ($) { #{{{
757 print "Content-type: text/html\n\n";
758 print misctemplate(gettext("Error"),
759 "<p class=\"error\">".gettext("Error").": $message</p>");