9 use open qw{:utf8 :std};
12 sub printheader ($) { #{{{
15 if ($config{sslcookie}) {
16 print $session->header(-charset => 'utf-8',
17 -cookie => $session->cookie(-httponly => 1, -secure => 1));
19 print $session->header(-charset => 'utf-8',
20 -cookie => $session->cookie(-httponly => 1));
24 sub showform ($$$$;@) { #{{{
30 if (exists $hooks{formbuilder}) {
31 run_hooks(formbuilder => sub {
32 shift->(form => $form, cgi => $cgi, session => $session,
37 printheader($session);
38 print misctemplate($form->title, $form->render(submit => $buttons), @_);
41 sub redirect ($$) { #{{{
44 if (! $config{w3mmode}) {
45 print $q->redirect($url);
48 print "Content-type: text/plain\n";
49 print "W3m-control: GOTO $url\n\n";
53 sub decode_cgi_utf8 ($) { #{{{
54 # decode_form_utf8 method is needed for 5.10
57 foreach my $f ($cgi->param) {
58 $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
63 sub decode_form_utf8 ($) { #{{{
66 foreach my $f ($form->field) {
67 $form->field(name => $f,
68 value => decode_utf8($form->field($f)),
75 # Check if the user is signed in. If not, redirect to the signin form and
76 # save their place to return to later.
77 sub needsignin ($$) { #{{{
81 if (! defined $session->param("name") ||
82 ! userinfo_get($session->param("name"), "regdate")) {
83 $session->param(postsignin => $ENV{QUERY_STRING});
84 cgi_signin($q, $session);
85 cgi_savesession($session);
90 sub cgi_signin ($$) { #{{{
95 eval q{use CGI::FormBuilder};
97 my $form = CGI::FormBuilder->new(
105 action => $config{cgiurl},
107 template => {type => 'div'},
108 stylesheet => baseurl()."style.css",
110 my $buttons=["Login"];
112 if ($q->param("do") ne "signin" && !$form->submitted) {
113 $form->text(gettext("You need to log in first."));
115 $form->field(name => "do", type => "hidden", value => "signin",
118 decode_form_utf8($form);
119 run_hooks(formbuilder_setup => sub {
120 shift->(form => $form, cgi => $q, session => $session,
121 buttons => $buttons);
123 decode_form_utf8($form);
125 if ($form->submitted) {
129 showform($form, $buttons, $session, $q);
132 sub cgi_postsignin ($$) { #{{{
136 # Continue with whatever was being done before the signin process.
137 if (defined $session->param("postsignin")) {
138 my $postsignin=CGI->new($session->param("postsignin"));
139 $session->clear("postsignin");
140 cgi($postsignin, $session);
141 cgi_savesession($session);
145 error(gettext("login failed, perhaps you need to turn on cookies?"));
149 sub cgi_prefs ($$) { #{{{
153 needsignin($q, $session);
156 # The session id is stored on the form and checked to
157 # guard against CSRF.
158 my $sid=$q->param('sid');
159 if (! defined $sid) {
162 elsif ($sid ne $session->id) {
163 error(gettext("Your login session has expired."));
166 eval q{use CGI::FormBuilder};
168 my $form = CGI::FormBuilder->new(
169 title => "preferences",
170 name => "preferences",
180 action => $config{cgiurl},
181 template => {type => 'div'},
182 stylesheet => baseurl()."style.css",
184 [login => gettext("Login")],
185 [preferences => gettext("Preferences")],
186 [admin => gettext("Admin")]
189 my $buttons=["Save Preferences", "Logout", "Cancel"];
191 decode_form_utf8($form);
192 run_hooks(formbuilder_setup => sub {
193 shift->(form => $form, cgi => $q, session => $session,
194 buttons => $buttons);
196 decode_form_utf8($form);
198 $form->field(name => "do", type => "hidden", value => "prefs",
200 $form->field(name => "sid", type => "hidden", value => $session->id,
202 $form->field(name => "email", size => 50, fieldset => "preferences");
204 my $user_name=$session->param("name");
206 # XXX deprecated, should be removed eventually
207 $form->field(name => "banned_users", size => 50, fieldset => "admin");
208 if (! is_admin($user_name)) {
209 $form->field(name => "banned_users", type => "hidden");
211 if (! $form->submitted) {
212 $form->field(name => "email", force => 1,
213 value => userinfo_get($user_name, "email"));
214 if (is_admin($user_name)) {
215 my $value=join(" ", get_banned_users());
217 $form->field(name => "banned_users", force => 1,
218 value => join(" ", get_banned_users()),
219 comment => "deprecated; please move to banned_users in setup file");
222 $form->field(name => "banned_users", type => "hidden");
227 if ($form->submitted eq 'Logout') {
229 redirect($q, $config{url});
232 elsif ($form->submitted eq 'Cancel') {
233 redirect($q, $config{url});
236 elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
237 if (defined $form->field('email')) {
238 userinfo_set($user_name, 'email', $form->field('email')) ||
239 error("failed to set email");
242 # XXX deprecated, should be removed eventually
243 if (is_admin($user_name)) {
244 set_banned_users(grep { ! is_admin($_) }
246 $form->field("banned_users"))) ||
247 error("failed saving changes");
248 if (! length $form->field("banned_users")) {
249 $form->field(name => "banned_users", type => "hidden");
253 $form->text(gettext("Preferences saved."));
256 showform($form, $buttons, $session, $q);
259 sub check_banned ($$) { #{{{
263 my $name=$session->param("name");
265 # XXX banned in userinfo is deprecated, should be removed
266 # eventually, and only banned_users be checked.
267 if (userinfo_get($session->param("name"), "banned") ||
268 grep { $name eq $_ } @{$config{banned_users}}) {
269 print $q->header(-status => "403 Forbidden");
271 print gettext("You are banned.");
272 cgi_savesession($session);
278 sub cgi_getsession ($) { #{{{
281 eval q{use CGI::Session; use HTML::Entities};
283 CGI::Session->name("ikiwiki_session_".encode_entities($config{wikiname}));
285 my $oldmask=umask(077);
287 CGI::Session->new("driver:DB_File", $q,
288 { FileName => "$config{wikistatedir}/sessions.db" })
290 if (! $session || $@) {
291 error($@." ".CGI::Session->errstr());
299 # The session id is stored on the form and checked to
300 # guard against CSRF. But only if the user is logged in,
301 # as anonok can allow anonymous edits.
302 sub checksessionexpiry ($$) { # {{{
306 if (defined $session->param("name")) {
307 if (! defined $sid || $sid ne $session->id) {
308 error(gettext("Your login session has expired."));
313 sub cgi_savesession ($) { #{{{
316 # Force session flush with safe umask.
317 my $oldmask=umask(077);
328 $CGI::DISABLE_UPLOADS=$config{cgi_disable_uploads};
333 binmode(STDIN, ":utf8");
335 run_hooks(cgi => sub { shift->($q) });
338 my $do=$q->param('do');
339 if (! defined $do || ! length $do) {
340 my $error = $q->cgi_error;
342 error("Request not processed: $error");
345 error("\"do\" parameter missing");
349 # Need to lock the wiki before getting a session.
354 $session=cgi_getsession($q);
357 # Auth hooks can sign a user in.
358 if ($do ne 'signin' && ! defined $session->param("name")) {
359 run_hooks(auth => sub {
360 shift->($q, $session)
362 if (defined $session->param("name")) {
363 # Make sure whatever user was authed is in the
365 if (! userinfo_get($session->param("name"), "regdate")) {
366 userinfo_setall($session->param("name"), {
370 }) || error("failed adding user");
375 check_banned($q, $session);
377 run_hooks(sessioncgi => sub { shift->($q, $session) });
379 if ($do eq 'signin') {
380 cgi_signin($q, $session);
381 cgi_savesession($session);
383 elsif ($do eq 'prefs') {
384 cgi_prefs($q, $session);
386 elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
387 cgi_postsignin($q, $session);
390 error("unknown do parameter");
394 # Does not need to be called directly; all errors will go through here.
395 sub cgierror ($) { #{{{
398 print "Content-type: text/html\n\n";
399 print misctemplate(gettext("Error"),
400 "<p class=\"error\">".gettext("Error").": $message</p>");