checksessionexpiry: rework

[git.ikiwiki.info.git] / IkiWiki / Plugin / editpage.pm

diff --git a/IkiWiki/Plugin/editpage.pm b/IkiWiki/Plugin/editpage.pm
index bb21ed2be486adce4de82dab3076b10a5f8e99ad..242624d77fb89ae03bed3b6970498673a6137613 100644 (file)
--- a/IkiWiki/Plugin/editpage.pm
+++ b/IkiWiki/Plugin/editpage.pm
@@ -8,6 +8,7 @@ use open qw{:utf8 :std};
 
 sub import { #{{{
        hook(type => "getsetup", id => "editpage", call => \&getsetup);
 
 sub import { #{{{
        hook(type => "getsetup", id => "editpage", call => \&getsetup);

+       hook(type => "refresh", id => "editpage", call => \&refresh);

         hook(type => "sessioncgi", id => "editpage", call => \&IkiWiki::cgi_editpage);
 } # }}}
 
         hook(type => "sessioncgi", id => "editpage", call => \&IkiWiki::cgi_editpage);
 } # }}}
 


@@ -19,6 +20,35 @@ sub getsetup () { #{{{
                },
 } #}}}
 
                },
 } #}}}
 

+sub refresh () {
+       if (exists $wikistate{editpage} && exists $wikistate{editpage}{previews}) {
+               # Expire old preview files after one hour.
+               my $expire=time - (60 * 60);
+
+               my @previews;
+               foreach my $file (@{$wikistate{editpage}{previews}}) {
+                       my $mtime=(stat("$config{destdir}/$file"))[9];
+                       if (defined $mtime && $mtime <= $expire) {
+                               # Avoid deleting a preview that was later saved.
+                               my $delete=1;
+                               foreach my $page (keys %renderedfiles) {
+                                       if (grep { $_ eq $file } @{$renderedfiles{$page}}) {
+                                               $delete=0;
+                                       }
+                               }
+                               if ($delete) {
+                                       debug(sprintf(gettext("removing old preview %s"), $file));
+                                       IkiWiki::prune("$config{destdir}/$file");
+                               }
+                       }
+                       elsif (defined $mtime) {
+                               push @previews, $file;
+                       }
+               }
+               $wikistate{editpage}{previews}=\@previews;
+       }
+}
+

 # Back to ikiwiki namespace for the rest, this code is very much
 # internal to ikiwiki even though it's separated into a plugin,
 # and other plugins use the functions below.
 # Back to ikiwiki namespace for the rest, this code is very much
 # internal to ikiwiki even though it's separated into a plugin,
 # and other plugins use the functions below.


@@ -85,17 +115,18 @@ sub cgi_editpage ($$) { #{{{
        });
        decode_form_utf8($form);
        
        });
        decode_form_utf8($form);
        

-       # This untaint is safe because we check file_pruned.
-       my $page=$form->field('page');
+       # This untaint is safe because we check file_pruned and
+       # wiki_file_regexp.
+       my ($page)=$form->field('page')=~/$config{wiki_file_regexp}/;

        $page=possibly_foolish_untaint($page);
        my $absolute=($page =~ s#^/+##);
        if (! defined $page || ! length $page ||
            file_pruned($page, $config{srcdir})) {
        $page=possibly_foolish_untaint($page);
        my $absolute=($page =~ s#^/+##);
        if (! defined $page || ! length $page ||
            file_pruned($page, $config{srcdir})) {

-               error("bad page name");
+               error(gettext("bad page name"));

        }
 
        }
 

-       my $baseurl=$config{url}."/".htmlpage($page);
-       
+       my $baseurl = urlto($page, undef, 1);
+

        my $from;
        if (defined $form->field('from')) {
                ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
        my $from;
        if (defined $form->field('from')) {
                ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;


@@ -125,7 +156,7 @@ sub cgi_editpage ($$) { #{{{
                        $type=pagetype($pagesources{$from});
                }
                $type=$config{default_pageext} unless defined $type;
                        $type=pagetype($pagesources{$from});
                }
                $type=$config{default_pageext} unless defined $type;

-               $file=$page.".".$type;
+               $file=newpagefile($page, $type);

                if (! $form->submitted) {
                        $form->field(name => "rcsinfo", value => "", force => 1);
                }
                if (! $form->submitted) {
                        $form->field(name => "rcsinfo", value => "", force => 1);
                }


@@ -152,13 +183,13 @@ sub cgi_editpage ($$) { #{{{
        
        if ($form->submitted eq "Cancel") {
                if ($form->field("do") eq "create" && defined $from) {
        
        if ($form->submitted eq "Cancel") {
                if ($form->field("do") eq "create" && defined $from) {

-                       redirect($q, "$config{url}/".htmlpage($from));
+                       redirect($q, urlto($from, undef, 1));

                }
                elsif ($form->field("do") eq "create") {
                        redirect($q, $config{url});
                }
                else {
                }
                elsif ($form->field("do") eq "create") {
                        redirect($q, $config{url});
                }
                else {

-                       redirect($q, "$config{url}/".htmlpage($page));
+                       redirect($q, urlto($page, undef, 1));

                }
                exit;
        }
                }
                exit;
        }


@@ -168,6 +199,7 @@ sub cgi_editpage ($$) { #{{{
                        # temporarily record its type
                        $pagesources{$page}=$page.".".$type;
                }
                        # temporarily record its type
                        $pagesources{$page}=$page.".".$type;
                }

+               my %wasrendered=map { $_ => 1 } @{$renderedfiles{$page}};

 
                my $content=$form->field('editcontent');
 
 
                my $content=$form->field('editcontent');
 


@@ -190,11 +222,19 @@ sub cgi_editpage ($$) { #{{{
                        );
                });
                $form->tmpl_param("page_preview", $preview);
                        );
                });
                $form->tmpl_param("page_preview", $preview);

-       
+               

                if ($new) {
                        delete $pagesources{$page};
                }
                if ($new) {
                        delete $pagesources{$page};
                }

-               # previewing may have created files on disk
+
+               # Previewing may have created files on disk.
+               # Keep a list of these to be deleted later.
+               my %previews = map { $_ => 1 } @{$wikistate{editpage}{previews}};
+               foreach my $f (@{$renderedfiles{$page}}) {
+                       $previews{$f}=1 unless $wasrendered{$f};
+               }
+               @{$wikistate{editpage}{previews}} = keys %previews;
+               $renderedfiles{$page}=[keys %wasrendered];

                saveindex();
        }
        elsif ($form->submitted eq "Save Page") {
                saveindex();
        }
        elsif ($form->submitted eq "Save Page") {


@@ -210,7 +250,7 @@ sub cgi_editpage ($$) { #{{{
                            file_pruned($from, $config{srcdir}) ||
                            $from=~/^\// || 
                            $absolute ||
                            file_pruned($from, $config{srcdir}) ||
                            $from=~/^\// || 
                            $absolute ||

-                           $form->submitted eq "Preview") {
+                           $form->submitted) {

                                @page_locs=$best_loc=$page;
                        }
                        else {
                                @page_locs=$best_loc=$page;
                        }
                        else {


@@ -249,7 +289,7 @@ sub cgi_editpage ($$) { #{{{
                                        @page_locs=$page;
                                }
                                else {
                                        @page_locs=$page;
                                }
                                else {

-                                       redirect($q, "$config{url}/".htmlpage($page));
+                                       redirect($q, urlto($page, undef, 1));

                                        exit;
                                }
                        }
                                        exit;
                                }
                        }


@@ -300,16 +340,7 @@ sub cgi_editpage ($$) { #{{{
        else {
                # save page
                check_canedit($page, $q, $session);
        else {
                # save page
                check_canedit($page, $q, $session);

-       
-               # The session id is stored on the form and checked to
-               # guard against CSRF. But only if the user is logged in,
-               # as anonok can allow anonymous edits.
-               if (defined $session->param("name")) {
-                       my $sid=$q->param('sid');
-                       if (! defined $sid || $sid ne $session->id) {
-                               error(gettext("Your login session has expired."));
-                       }
-               }
+               checksessionexpiry($q, $session, $q->param('sid'));

 
                my $exists=-e "$config{srcdir}/$file";
 
 
                my $exists=-e "$config{srcdir}/$file";
 


@@ -417,7 +448,7 @@ sub cgi_editpage ($$) { #{{{
                else {
                        # The trailing question mark tries to avoid broken
                        # caches and get the most recent version of the page.
                else {
                        # The trailing question mark tries to avoid broken
                        # caches and get the most recent version of the page.

-                       redirect($q, "$config{url}/".htmlpage($page)."?updated");
+                       redirect($q, urlto($page, undef, 1)."?updated");

                }
        }
 
                }
        }