IkiWiki/Plugin/remove.pm

   1 #!/usr/bin/perl
   2 package IkiWiki::Plugin::remove;
   3
   4 use warnings;
   5 use strict;
   6 use IkiWiki 3.00;
   7
   8 sub import {
   9         hook(type => "getsetup", id => "remove", call => \&getsetup);
  10         hook(type => "formbuilder_setup", id => "remove", call => \&formbuilder_setup);
  11         hook(type => "formbuilder", id => "remove", call => \&formbuilder);
  12         hook(type => "sessioncgi", id => "remove", call => \&sessioncgi);
  13
  14 }
  15
  16 sub getsetup () {
  17         return
  18                 plugin => {
  19                         safe => 1,
  20                         rebuild => 0,
  21                         section => "web",
  22                 },
  23 }
  24
  25 sub allowed_dirs {
  26         no warnings 'once';
  27         return grep { defined $_ } (
  28                 $config{srcdir},
  29                 $IkiWiki::Plugin::transient::transientdir,
  30         );
  31 }
  32
  33 sub check_canremove ($$$) {
  34         my $page=shift;
  35         my $q=shift;
  36         my $session=shift;
  37
  38         # Must be a known source file.
  39         if (! exists $pagesources{$page}) {
  40                 error(sprintf(gettext("%s does not exist"),
  41                         htmllink("", "", $page, noimageinline => 1)));
  42         }
  43
  44         # Must exist in either the srcdir or a suitable underlay (e.g.
  45         # transient underlay), and be a regular file.
  46         my $file=$pagesources{$page};
  47         my $dir;
  48
  49         foreach my $srcdir (allowed_dirs()) {
  50                 if (-e "$srcdir/$file") {
  51                         $dir = $srcdir;
  52                         last;
  53                 }
  54         }
  55
  56         if (! defined $dir) {
  57                 error(sprintf(gettext("%s is not in the srcdir, so it cannot be deleted"), $file));
  58         }
  59         elsif (-l "$dir/$file" && ! -f _) {
  60                 error(sprintf(gettext("%s is not a file"), $file));
  61         }
  62
  63         # If a user can't upload an attachment, don't let them delete it.
  64         # This is sorta overkill, but better safe than sorry.
  65         if (! defined pagetype($pagesources{$page})) {
  66                 if (IkiWiki::Plugin::attachment->can("check_canattach")) {
  67                         IkiWiki::Plugin::attachment::check_canattach($session, $page, "$dir/$file");
  68                 }
  69                 else {
  70                         error("removal of attachments is not allowed");
  71                 }
  72         }
  73
  74         my $canremove;
  75         IkiWiki::run_hooks(canremove => sub {
  76                 return if defined $canremove;
  77                 my $ret=shift->(page => $page, cgi => $q, session => $session);
  78                 if (defined $ret) {
  79                         if ($ret eq "") {
  80                                 $canremove=1;
  81                         }
  82                         elsif (ref $ret eq 'CODE') {
  83                                 $ret->();
  84                                 $canremove=0;
  85                         }
  86                         elsif (defined $ret) {
  87                                 error($ret);
  88                                 $canremove=0;
  89                         }
  90                 }
  91         });
  92         return defined $canremove ? $canremove : 1;
  93 }
  94
  95 sub formbuilder_setup (@) {
  96         my %params=@_;
  97         my $form=$params{form};
  98         my $q=$params{cgi};
  99
 100         if (defined $form->field("do") && ($form->field("do") eq "edit" ||
 101             $form->field("do") eq "create")) {
 102                 # Removal button for the page, and also for attachments.
 103                 push @{$params{buttons}}, "Remove" if $form->field("do") eq "edit";
 104                 $form->tmpl_param("field-remove" => '<input name="_submit" type="submit" value="Remove Attachments" />');
 105         }
 106 }
 107
 108 sub confirmation_form ($$) {
 109         my $q=shift;
 110         my $session=shift;
 111
 112         eval q{use CGI::FormBuilder};
 113         error($@) if $@;
 114         my $f = CGI::FormBuilder->new(
 115                 name => "remove",
 116                 header => 0,
 117                 charset => "utf-8",
 118                 method => 'POST',
 119                 javascript => 0,
 120                 params => $q,
 121                 action => IkiWiki::cgiurl(),
 122                 stylesheet => 1,
 123                 fields => [qw{do page}],
 124         );
 125
 126         $f->field(name => "sid", type => "hidden", value => $session->id,
 127                 force => 1);
 128         $f->field(name => "do", type => "hidden", value => "remove", force => 1);
 129
 130         return $f, ["Remove", "Cancel"];
 131 }
 132
 133 sub removal_confirm ($$@) {
 134         my $q=shift;
 135         my $session=shift;
 136         my $attachment=shift;
 137         my @pages=@_;
 138
 139         # Special case for unsaved attachments.
 140         foreach my $page (@pages) {
 141                 if ($attachment && IkiWiki::Plugin::attachment->can("is_held_attachment")) {
 142                         my $f=IkiWiki::Plugin::attachment::is_held_attachment($page);
 143                         if (defined $f) {
 144                                 require IkiWiki::Render;
 145                                 IkiWiki::prune($f, "$config{wikistatedir}/attachments");
 146                         }
 147                 }
 148         }
 149         @pages=grep { exists $pagesources{$_} } @pages;
 150         return unless @pages;
 151
 152         foreach my $page (@pages) {
 153                 IkiWiki::check_canedit($page, $q, $session);
 154                 check_canremove($page, $q, $session);
 155         }
 156
 157         # Save current form state to allow returning to it later
 158         # without losing any edits.
 159         # (But don't save what button was submitted, to avoid
 160         # looping back to here.)
 161         # Note: "_submit" is CGI::FormBuilder internals.
 162         $q->param(-name => "_submit", -value => "");
 163         $session->param(postremove => scalar $q->Vars);
 164         IkiWiki::cgi_savesession($session);
 165
 166         my ($f, $buttons)=confirmation_form($q, $session);
 167         $f->title(sprintf(gettext("confirm removal of %s"),
 168                 join(", ", map { pagetitle($_) } @pages)));
 169         $f->field(name => "page", type => "hidden", value => \@pages, force => 1);
 170         if (defined $attachment) {
 171                 $f->field(name => "attachment", type => "hidden",
 172                         value => $attachment, force => 1);
 173         }
 174
 175         IkiWiki::showform($f, $buttons, $session, $q);
 176         exit 0;
 177 }
 178
 179 sub postremove ($) {
 180         my $session=shift;
 181
 182         # Load saved form state and return to edit form.
 183         my $postremove=CGI->new($session->param("postremove"));
 184         $session->clear("postremove");
 185         IkiWiki::cgi_savesession($session);
 186         IkiWiki::cgi($postremove, $session);
 187 }
 188
 189 sub formbuilder (@) {
 190         my %params=@_;
 191         my $form=$params{form};
 192
 193         if (defined $form->field("do") && ($form->field("do") eq "edit" ||
 194             $form->field("do") eq "create")) {
 195                 my $q=$params{cgi};
 196                 my $session=$params{session};
 197
 198                 if ($form->submitted eq "Remove" && $form->field("do") eq "edit") {
 199                         removal_confirm($q, $session, 0, $form->field("page"));
 200                 }
 201                 elsif ($form->submitted eq "Remove Attachments") {
 202                         my @selected=map { Encode::decode_utf8($_) } $q->param("attachment_select");
 203                         if (! @selected) {
 204                                 error(gettext("Please select the attachments to remove."));
 205                         }
 206                         removal_confirm($q, $session, 1, @selected);
 207                 }
 208         }
 209 }
 210
 211 sub sessioncgi ($$) {
 212         my $q=shift;
 213
 214         if ($q->param("do") eq 'remove') {
 215                 my $session=shift;
 216                 my ($form, $buttons)=confirmation_form($q, $session);
 217                 IkiWiki::decode_form_utf8($form);
 218
 219                 if ($form->submitted eq 'Cancel') {
 220                         postremove($session);
 221                 }
 222                 elsif ($form->submitted eq 'Remove' && $form->validate) {
 223                         IkiWiki::checksessionexpiry($q, $session);
 224
 225                         my @pages=$form->field("page");
 226
 227                         # Validate removal by checking that the page exists,
 228                         # and that the user is allowed to edit(/remove) it.
 229                         my @files;
 230                         foreach my $page (@pages) {
 231                                 IkiWiki::check_canedit($page, $q, $session);
 232                                 check_canremove($page, $q, $session);
 233
 234                                 # This untaint is safe because of the
 235                                 # checks performed above, which verify the
 236                                 # page is a normal file, etc.
 237                                 push @files, IkiWiki::possibly_foolish_untaint($pagesources{$page});
 238                         }
 239
 240                         # Do removal, and update the wiki.
 241                         require IkiWiki::Render;
 242                         if ($config{rcs}) {
 243                                 IkiWiki::disable_commit_hook();
 244                         }
 245                         my $rcs_removed = 1;
 246
 247                         foreach my $file (@files) {
 248                                 foreach my $srcdir (allowed_dirs()) {
 249                                         if (-e "$srcdir/$file") {
 250                                                 if ($srcdir eq $config{srcdir} && $config{rcs}) {
 251                                                         IkiWiki::rcs_remove($file);
 252                                                         $rcs_removed = 1;
 253                                                 }
 254                                                 else {
 255                                                         IkiWiki::prune("$srcdir/$file", $srcdir);
 256                                                 }
 257                                         }
 258                                 }
 259                         }
 260
 261                         if ($config{rcs}) {
 262                                 if ($rcs_removed) {
 263                                         IkiWiki::rcs_commit_staged(
 264                                                 message => gettext("removed"),
 265                                                 session => $session,
 266                                         );
 267                                 }
 268                                 IkiWiki::enable_commit_hook();
 269                                 IkiWiki::rcs_update();
 270                         }
 271
 272                         IkiWiki::refresh();
 273                         IkiWiki::saveindex();
 274
 275                         if ($q->param("attachment")) {
 276                                 # Attachments were deleted, so redirect
 277                                 # back to the edit form.
 278                                 postremove($session);
 279                         }
 280                         else {
 281                                 # The page is gone, so redirect to parent
 282                                 # of the page.
 283                                 my $parent=IkiWiki::dirname($pages[0]);
 284                                 if (! exists $pagesources{$parent}) {
 285                                         $parent="index";
 286                                 }
 287                                 IkiWiki::redirect($q, urlto($parent));
 288                         }
 289                 }
 290                 else {
 291                         removal_confirm($q, $session, 0, $form->field("page"));
 292                 }
 293
 294                 exit 0;
 295         }
 296 }
 297
 298 1