- @page_locs = grep {
- ! exists $pagesources{lc($_)} &&
- ! page_locked($_, $session, 1)
- } @page_locs;
-
- if (! @page_locs) {
- # hmm, someone else made the page in the
- # meantime?
- print $q->redirect("$config{url}/".htmlpage($page));
- return;
- }
-
- $form->tmpl_param("page_select", 1);
- $form->field(name => "page", type => 'select',
- options => \@page_locs, value => $best_loc);
- $form->title("creating ".pagetitle($page));
- }
- elsif ($form->field("do") eq "edit") {
- page_locked($page, $session);
- if (! defined $form->field('editcontent') ||
- ! length $form->field('editcontent')) {
- my $content="";
- if (exists $pagesources{lc($page)}) {
- $content=readfile(srcfile($pagesources{lc($page)}));
- $content=~s/\n/\r\n/g;
- }
- $form->field(name => "editcontent", value => $content,
- force => 1);
- }
- $form->tmpl_param("page_select", 0);
- $form->field(name => "page", type => 'hidden');
- $form->title("editing ".pagetitle($page));
- }
-
- print $form->render(submit => \@buttons);
- }
- else {
- # save page
- page_locked($page, $session);
-
- # Decode utf-8 since FormBuilder does not
- require Encode;
- my $content=Encode::decode_utf8($form->field('editcontent'));
-
- $content=~s/\r\n/\n/g;
- $content=~s/\r/\n/g;
- writefile($file, $config{srcdir}, $content);
-
- my $message="web commit ";
- if (defined $session->param("name") &&
- length $session->param("name")) {
- $message.="by ".$session->param("name");
- }
- else {
- $message.="from $ENV{REMOTE_ADDR}";
- }
- if (defined $form->field('comments') &&
- length $form->field('comments')) {
- $message.=Encode::decode_utf8(": ".$form->field('comments'));
- }
-
- if ($config{rcs}) {
- if ($newfile) {
- rcs_add($file);
- }
- # prevent deadlock with post-commit hook
- unlockwiki();
- # presumably the commit will trigger an update
- # of the wiki
- my $conflict=rcs_commit($file, $message,
- $form->field("rcsinfo"));
-
- if (defined $conflict) {
- $form->field(name => "rcsinfo", value => rcs_prepedit($file),
- force => 1);
- $form->tmpl_param("page_conflict", 1);
- $form->field("editcontent", value => $conflict, force => 1);
- $form->field("do", "edit)");
- $form->tmpl_param("page_select", 0);
- $form->field(name => "page", type => 'hidden');
- $form->title("editing $page");
- print $form->render(submit => \@buttons);
- return;
- }
- }
- else {
- require IkiWiki::Render;
- refresh();
- saveindex();
+ return $session;
+} #}}}
+
+# To guard against CSRF, the user's session id (sid)
+# can be stored on a form. This function will check
+# (for logged in users) that the sid on the form matches
+# the session id in the cookie.
+sub checksessionexpiry ($$) { # {{{
+ my $q=shift;
+ my $session = shift;
+
+ if (defined $session->param("name")) {
+ my $sid=$q->param('sid');
+ if (! defined $sid || $sid ne $session->id) {
+ error(gettext("Your login session has expired."));