<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">#!/usr/bin/perl
# Ikiwiki email address as login
package IkiWiki::Plugin::emailauth;

use warnings;
use strict;
use IkiWiki 3.00;

sub import {
	hook(type =&gt; "getsetup", id =&gt; "emailauth", "call" =&gt; \&amp;getsetup);
	hook(type =&gt; "cgi", id =&gt; "emailauth", "call" =&gt; \&amp;cgi);
	hook(type =&gt; "formbuilder_setup", id =&gt; "emailauth", "call" =&gt; \&amp;formbuilder_setup);
	IkiWiki::loadplugin("loginselector");
	IkiWiki::Plugin::loginselector::register_login_plugin(
		"emailauth",
		\&amp;email_setup,
		\&amp;email_check_input,
		\&amp;email_auth,
	);
}

sub getsetup () {
	return
		plugin =&gt; {
			safe =&gt; 1,
			rebuild =&gt; 0,
			section =&gt; "auth",
		},
}

sub email_setup ($$) {
	my $q=shift;
	my $template=shift;

	return 1;
}

sub email_check_input ($) {
	my $cgi=shift;
	defined $cgi-&gt;param('do')
		&amp;&amp; $cgi-&gt;param("do") eq "signin"
		&amp;&amp; defined $cgi-&gt;param('Email_entry')
		&amp;&amp; length $cgi-&gt;param('Email_entry');
}

# Send login link to email.
sub email_auth ($$$$) {
	my $cgi=shift;
	my $session=shift;
	my $errordisplayer=shift;
	my $infodisplayer=shift;

	my $email=$cgi-&gt;param('Email_entry');
	unless ($email =~ /.\@./) {
		$errordisplayer-&gt;(gettext("Invalid email address."));
		return;
	}

	# Implicit account creation.
	my $userinfo=IkiWiki::userinfo_retrieve();
	if (! exists $userinfo-&gt;{$email} || ! ref $userinfo-&gt;{$email}) {
		IkiWiki::userinfo_setall($email, {
			'email' =&gt; $email,
			'regdate' =&gt; time,
		});
	}

	my $token=gentoken($email, $session);
	my $template=template("emailauth.tmpl");
	$template-&gt;param(
		wikiname =&gt; $config{wikiname},
		# Intentionally using short field names to keep link short.
		authurl =&gt; IkiWiki::cgiurl_abs(
			'e' =&gt; $email,
			'v' =&gt; $token,
		),
	);
	
	eval q{use Mail::Sendmail};
	error($@) if $@;
	my $shorturl=$config{url};
	$shorturl=~s/^https?:\/\///i;
	sendmail(
		To =&gt; $email,
		From =&gt; "$config{wikiname} admin &lt;".
			(defined $config{adminemail} ? $config{adminemail} : "")
			."&gt;",
		Subject =&gt; "$config{wikiname} login | $shorturl",
		Message =&gt; $template-&gt;output,
	) or error(gettext("Failed to send mail"));

	$infodisplayer-&gt;(gettext("You have been sent an email, with a link you can open to complete the login process."));
}

# Finish login process.
sub cgi ($$) {
	my $cgi=shift;

	my $email=$cgi-&gt;param('e');
	my $v=$cgi-&gt;param('v');
	if (defined $email &amp;&amp; defined $v &amp;&amp; length $email &amp;&amp; length $v) {
		my $token=gettoken($email);
		if ($token eq $v) {
			cleartoken($email);
			my $session=getsession($email);
			IkiWiki::cgi_postsignin($cgi, $session);
		}
		elsif (length $token ne length $cgi-&gt;param('v')) {
			error(gettext("Wrong login token length. Please check that you pasted in the complete login link from the email!"));
		}
		else {
			loginfailure();
		}
	}
}

sub formbuilder_setup (@) {
	my %params=@_;
	my $form=$params{form};
	my $session=$params{session};

	if ($form-&gt;title eq "preferences" &amp;&amp;
	    IkiWiki::emailuser($session-&gt;param("name"))) {
		$form-&gt;field(name =&gt; "email", disabled =&gt; 1);
	}
}

# Generates the token that will be used in the authurl to log the user in.
# This needs to be hard to guess, and relatively short. Generating a cgi
# session id will make it as hard to guess as any cgi session.
#
# Store token in userinfo; this allows the user to log in
# using a different browser session, if it takes a while for the
# email to get to them.
#
# The postsignin value from the session is also stored in the userinfo
# to allow resuming in a different browser session.
sub gentoken ($$) {
	my $email=shift;
	my $session=shift;
	eval q{use CGI::Session};
	error($@) if $@;
	my $token = CGI::Session-&gt;new-&gt;id;
	IkiWiki::userinfo_set($email, "emailauthexpire", time+(60*60*24));
	IkiWiki::userinfo_set($email, "emailauth", $token);
	IkiWiki::userinfo_set($email, "emailauthpostsignin", defined $session-&gt;param("postsignin") ? $session-&gt;param("postsignin") : "");
	return $token;
}

# Gets the token, checking for expiry.
sub gettoken ($) {
	my $email=shift;
	my $val=IkiWiki::userinfo_get($email, "emailauth");
	my $expire=IkiWiki::userinfo_get($email, "emailauthexpire");
	if (! length $val || time &gt; $expire) {
		loginfailure();
	}
	return $val;
}

# Generate a session to use after successful login.
sub getsession ($) {
	my $email=shift;

	IkiWiki::lockwiki();
	IkiWiki::loadindex();
	my $session=IkiWiki::cgi_getsession();

	my $postsignin=IkiWiki::userinfo_get($email, "emailauthpostsignin");
	IkiWiki::userinfo_set($email, "emailauthpostsignin", "");
	if (defined $postsignin &amp;&amp; length $postsignin) {
		$session-&gt;param(postsignin =&gt; $postsignin);
	}

	$session-&gt;param(name =&gt; $email);
	my $nickname=$email;
	$nickname=~s/@.*//;
	$session-&gt;param(nickname =&gt; Encode::decode_utf8($nickname));

	IkiWiki::cgi_savesession($session);

	return $session;
}

sub cleartoken ($) {
	my $email=shift;
	IkiWiki::userinfo_set($email, "emailauthexpire", 0);
	IkiWiki::userinfo_set($email, "emailauth", "");
}

sub loginfailure () {
	error "Bad email authentication token. Please retry login.";
}

1
</pre></body></html>