]> git.vanrenterghem.biz Git - git.ikiwiki.info.git/blobdiff - IkiWiki/Plugin/attachment.pm
add refresh hook
[git.ikiwiki.info.git] / IkiWiki / Plugin / attachment.pm
index cb762e453e9f92c368fed3784c1ad5820455e6f6..720078be15cfcd51399f375815b4d22e1a2e8d7b 100644 (file)
@@ -11,6 +11,40 @@ sub import { #{{{
        hook(type => "formbuilder", id => "attachment", call => \&formbuilder);
 } # }}}
 
+sub check_canattach ($$;$) { #{{{
+       my $session=shift;
+       my $dest=shift; # where it's going to be put, under the srcdir
+       my $file=shift; # the path to the attachment currently
+
+       # Don't allow an attachment to be uploaded with the same name as an
+       # existing page.
+       if (exists $pagesources{$dest} && $pagesources{$dest} ne $dest) {
+               error(sprintf(gettext("there is already a page named %s"), $dest));
+       }
+
+       # Use a special pagespec to test that the attachment is valid.
+       my $allowed=1;
+       foreach my $admin (@{$config{adminuser}}) {
+               my $allowed_attachments=IkiWiki::userinfo_get($admin, "allowed_attachments");
+               if (defined $allowed_attachments &&
+                   length $allowed_attachments) {
+                       $allowed=pagespec_match($dest,
+                               $allowed_attachments,
+                               file => $file,
+                               user => $session->param("name"),
+                               ip => $ENV{REMOTE_ADDR},
+                       );
+                       last if $allowed;
+               }
+       }
+       if (! $allowed) {
+               error(gettext("prohibited by allowed_attachments")." ($allowed)");
+       }
+       else {
+               return 1;
+       }
+} #}}}
+
 sub checkconfig () { #{{{
        $config{cgi_disable_uploads}=0;
 } #}}}
@@ -21,6 +55,8 @@ sub formbuilder_setup (@) { #{{{
        my $q=$params{cgi};
 
        if (defined $form->field("do") && $form->field("do") eq "edit") {
+               # Add attachment field, set type to multipart.
+               $form->enctype(&CGI::MULTIPART);
                $form->field(name => 'attachment', type => 'file');
                # These buttons are not put in the usual place, so
                # are not added to the normal formbuilder button list.
@@ -34,7 +70,8 @@ sub formbuilder_setup (@) { #{{{
                # Start with the attachments interface toggled invisible,
                # but if it was used, keep it open.
                if ($form->submitted ne "Upload Attachment" &&
-                   ! length $q->param("attachment_select")) {
+                   (! defined $q->param("attachment_select") ||
+                   ! length $q->param("attachment_select"))) {
                        $form->tmpl_param("attachments-class" => "toggleable");
                }
                else {
@@ -86,8 +123,20 @@ sub formbuilder (@) { #{{{
                # This is an (apparently undocumented) way to get the name
                # of the temp file that CGI writes the upload to.
                my $tempfile=$q->tmpFileName($filename);
-               
-               $filename=IkiWiki::titlepage(
+               if (! defined $tempfile || ! length $tempfile) {
+                       # perl 5.8 needs an alternative, awful method
+                       if ($q =~ /HASH/ && exists $q->{'.tmpfiles'}) {
+                               foreach my $key (keys(%{$q->{'.tmpfiles'}})) {
+                                       $tempfile=$q->tmpFileName(\$key);
+                                       last if defined $tempfile && length $tempfile;
+                               }
+                       }
+                       if (! defined $tempfile || ! length $tempfile) {
+                               error("CGI::tmpFileName failed to return the uploaded file name");
+                       }
+               }
+
+               $filename=IkiWiki::linkpage(
                        IkiWiki::possibly_foolish_untaint(
                                attachment_location($form->field('page')).
                                IkiWiki::basename($filename)));
@@ -98,25 +147,8 @@ sub formbuilder (@) { #{{{
                # Check that the user is allowed to edit a page with the
                # name of the attachment.
                IkiWiki::check_canedit($filename, $q, $session, 1);
-               
-               # Use a special pagespec to test that the attachment is valid.
-               my $allowed=1;
-               foreach my $admin (@{$config{adminuser}}) {
-                       my $allowed_attachments=IkiWiki::userinfo_get($admin, "allowed_attachments");
-                       if (defined $allowed_attachments &&
-                           length $allowed_attachments) {
-                               $allowed=pagespec_match($filename,
-                                       $allowed_attachments,
-                                       file => $tempfile,
-                                       user => $session->param("name"),
-                                       ip => $ENV{REMOTE_ADDR},
-                               );
-                               last if $allowed;
-                       }
-               }
-               if (! $allowed) {
-                       error(gettext("attachment rejected")." ($allowed)");
-               }
+               # And that the attachment itself is acceptable.
+               check_canattach($session, $filename, $tempfile);
 
                # Needed for fast_file_copy and for rendering below.
                require IkiWiki::Render;
@@ -132,7 +164,14 @@ sub formbuilder (@) { #{{{
                else {
                        my $fh=$q->upload('attachment');
                        if (! defined $fh || ! ref $fh) {
-                               error("failed to get filehandle");
+                               # needed by old CGI versions
+                               $fh=$q->param('attachment');
+                               if (! defined $fh || ! ref $fh) {
+                                       # even that doesn't always work,
+                                       # fall back to opening the tempfile
+                                       $fh=undef;
+                                       open($fh, "<", $tempfile) || error("failed to open \"$tempfile\": $!");
+                               }
                        }
                        binmode($fh);
                        writefile($filename, $config{srcdir}, undef, 1, sub {
@@ -154,8 +193,10 @@ sub formbuilder (@) { #{{{
                IkiWiki::saveindex();
        }
        elsif ($form->submitted eq "Insert Links") {
+               my $page=quotemeta($q->param("page"));
                my $add="";
                foreach my $f ($q->param("attachment_select")) {
+                       $f=~s/^$page\///;
                        $add.="[[$f]]\n";
                }
                $form->field(name => 'editcontent',
@@ -168,7 +209,7 @@ sub formbuilder (@) { #{{{
        $form->tmpl_param("attachment_list" => [attachment_list($form->field('page'))]);
 } # }}}
 
-sub attachment_location ($) {
+sub attachment_location ($) { #{{{
        my $page=shift;
        
        # Put the attachment in a subdir of the page it's attached
@@ -177,9 +218,9 @@ sub attachment_location ($) {
        $page.="/" if length $page;
        
        return $page;
-}
+} #}}}
 
-sub attachment_list ($) {
+sub attachment_list ($) { #{{{
        my $page=shift;
        my $loc=attachment_location($page);
 
@@ -201,9 +242,9 @@ sub attachment_list ($) {
        # Sort newer attachments to the top of the list, so a newly-added
        # attachment appears just before the form used to add it.
        return sort { $b->{mtime_raw} <=> $a->{mtime_raw} || $a->{link} cmp $b->{link} } @ret;
-}
+} #}}}
 
-my %units=(            # size in bytes
+my %units=( #{{{       # size in bytes
        B               => 1,
        byte            => 1,
        KB              => 2 ** 10,
@@ -235,7 +276,7 @@ my %units=(         # size in bytes
        # ikiwiki, if you find you need larger data quantities, either modify
        # yourself to add them, or travel back in time to 2008 and kill me.
        #   -- Joey
-);
+); #}}}
 
 sub parsesize ($) { #{{{
        my $size=shift;
@@ -364,6 +405,9 @@ sub match_virusfree ($$;@) { #{{{
        waitpid $pid, 0;
        $SIG{PIPE}="DEFAULT";
        if ($sigpipe || $?) {
+               if (! length $reason) {
+                       $reason="virus checker $IkiWiki::config{virus_checker}; failed with no output";
+               }
                return IkiWiki::FailReason->new("file seems to contain a virus ($reason)");
        }
        else {
@@ -394,6 +438,9 @@ sub match_user ($$;@) { #{{{
        if (defined $params{user} && lc $params{user} eq lc $user) {
                return IkiWiki::SuccessReason->new("user is $user");
        }
+       elsif (! defined $params{user}) {
+               return IkiWiki::FailReason->new("not logged in");
+       }
        else {
                return IkiWiki::FailReason->new("user is $params{user}, not $user");
        }