X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/17fdb8028bfb2722c120b229c2131598affbddd6..2b602e2e9f06c79e969ae2e2fea64052edd82e6b:/IkiWiki/CGI.pm?ds=inline diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm index 99cead64f..a05043478 100644 --- a/IkiWiki/CGI.pm +++ b/IkiWiki/CGI.pm @@ -1,5 +1,7 @@ #!/usr/bin/perl +package IkiWiki; + use warnings; use strict; use IkiWiki; @@ -7,8 +9,6 @@ use IkiWiki::UserInfo; use open qw{:utf8 :std}; use Encode; -package IkiWiki; - sub printheader ($) { #{{{ my $session=shift; @@ -18,7 +18,6 @@ sub printheader ($) { #{{{ } else { print $session->header(-charset => 'utf-8'); } - } #}}} sub showform ($$$$;@) { #{{{ @@ -227,20 +226,27 @@ sub cgi_prefs ($$) { #{{{ $form->field(name => "sid", type => "hidden", value => $session->id, force => 1); $form->field(name => "email", size => 50, fieldset => "preferences"); - $form->field(name => "banned_users", size => 50, - fieldset => "admin"); my $user_name=$session->param("name"); + + # XXX deprecated, should be removed eventually + $form->field(name => "banned_users", size => 50, fieldset => "admin"); if (! is_admin($user_name)) { $form->field(name => "banned_users", type => "hidden"); } - if (! $form->submitted) { $form->field(name => "email", force => 1, value => userinfo_get($user_name, "email")); if (is_admin($user_name)) { - $form->field(name => "banned_users", force => 1, - value => join(" ", get_banned_users())); + my $value=join(" ", get_banned_users()); + if (length $value) { + $form->field(name => "banned_users", force => 1, + value => join(" ", get_banned_users()), + comment => "deprecated; please move to banned_users in setup file"); + } + else { + $form->field(name => "banned_users", type => "hidden"); + } } } @@ -258,12 +264,18 @@ sub cgi_prefs ($$) { #{{{ userinfo_set($user_name, 'email', $form->field('email')) || error("failed to set email"); } + + # XXX deprecated, should be removed eventually if (is_admin($user_name)) { set_banned_users(grep { ! is_admin($_) } split(' ', $form->field("banned_users"))) || error("failed saving changes"); + if (! length $form->field("banned_users")) { + $form->field(name => "banned_users", type => "hidden"); + } } + $form->text(gettext("Preferences saved.")); } @@ -304,8 +316,9 @@ sub cgi_editpage ($$) { #{{{ # This untaint is safe because we check file_pruned. my $page=$form->field('page'); $page=possibly_foolish_untaint($page); + my $absolute=($page =~ s#^/+##); if (! defined $page || ! length $page || - file_pruned($page, $config{srcdir}) || $page=~/^\//) { + file_pruned($page, $config{srcdir})) { error("bad page name"); } @@ -415,7 +428,6 @@ sub cgi_editpage ($$) { #{{{ elsif ($form->submitted eq "Save Page") { $form->tmpl_param("page_preview", ""); } - $form->tmpl_param("page_conflict", ""); if ($form->submitted ne "Save Page" || ! $form->validate) { if ($form->field("do") eq "create") { @@ -424,7 +436,8 @@ sub cgi_editpage ($$) { #{{{ if (! defined $from || ! length $from || $from ne $form->field('from') || file_pruned($from, $config{srcdir}) || - $from=~/^\// || + $from=~/^\// || + $absolute || $form->submitted eq "Preview") { @page_locs=$best_loc=$page; } @@ -530,7 +543,7 @@ sub cgi_editpage ($$) { #{{{ if ($form->field("do") ne "create" && ! $exists && ! defined srcfile($file, 1)) { - $form->tmpl_param("page_gone", 1); + $form->tmpl_param("message", template("editpagegone.tmpl")->output); $form->field(name => "do", value => "create", force => 1); $form->tmpl_param("page_select", 0); $form->field(name => "page", type => 'hidden'); @@ -540,7 +553,7 @@ sub cgi_editpage ($$) { #{{{ return; } elsif ($form->field("do") eq "create" && $exists) { - $form->tmpl_param("creation_conflict", 1); + $form->tmpl_param("message", template("editcreationconflict.tmpl")->output); $form->field(name => "do", value => "edit", force => 1); $form->tmpl_param("page_select", 0); $form->field(name => "page", type => 'hidden'); @@ -573,8 +586,9 @@ sub cgi_editpage ($$) { #{{{ if ($@) { $form->field(name => "rcsinfo", value => rcs_prepedit($file), force => 1); - $form->tmpl_param("failed_save", 1); - $form->tmpl_param("error_message", $@); + my $mtemplate=template("editfailedsave.tmpl"); + $mtemplate->param(error_message => $@); + $form->tmpl_param("message", $mtemplate->output); $form->field("editcontent", value => $content, force => 1); $form->tmpl_param("page_select", 0); $form->field(name => "page", type => 'hidden'); @@ -618,7 +632,7 @@ sub cgi_editpage ($$) { #{{{ if (defined $conflict) { $form->field(name => "rcsinfo", value => rcs_prepedit($file), force => 1); - $form->tmpl_param("page_conflict", 1); + $form->tmpl_param("message", template("editconflict.tmpl")->output); $form->field("editcontent", value => $conflict, force => 1); $form->field("do", "edit", force => 1); $form->tmpl_param("page_select", 0); @@ -636,6 +650,25 @@ sub cgi_editpage ($$) { #{{{ } } } #}}} + +sub check_banned ($$) { #{{{ + my $q=shift; + my $session=shift; + + my $name=$session->param("name"); + if (defined $name) { + # XXX banned in userinfo is deprecated, should be removed + # eventually, and only banned_users be checked. + if (userinfo_get($session->param("name"), "banned") || + grep { $name eq $_ } @{$config{banned_users}}) { + print $q->header(-status => "403 Forbidden"); + $session->delete(); + print gettext("You are banned."); + cgi_savesession($session); + exit; + } + } +} sub cgi_getsession ($) { #{{{ my $q=shift; @@ -645,8 +678,14 @@ sub cgi_getsession ($) { #{{{ CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname})); my $oldmask=umask(077); - my $session = CGI::Session->new("driver:DB_File", $q, - { FileName => "$config{wikistatedir}/sessions.db" }); + my $session = eval { + CGI::Session->new("driver:DB_File", $q, + { FileName => "$config{wikistatedir}/sessions.db" }) + }; + if (! $session || $@) { + error($@." ".CGI::Session->errstr()); + } + umask($oldmask); return $session; @@ -714,14 +753,8 @@ sub cgi (;$$) { #{{{ } } - if (defined $session->param("name") && - userinfo_get($session->param("name"), "banned")) { - print $q->header(-status => "403 Forbidden"); - $session->delete(); - print gettext("You are banned."); - cgi_savesession($session); - } - + check_banned($q, $session); + run_hooks(sessioncgi => sub { shift->($q, $session) }); if ($do eq 'signin') { @@ -742,4 +775,14 @@ sub cgi (;$$) { #{{{ } } #}}} +# Does not need to be called directly; all errors will go through here. +sub cgierror ($) { #{{{ + my $message=shift; + + print "Content-type: text/html\n\n"; + print misctemplate(gettext("Error"), + "

".gettext("Error").": $message

"); + die $@; +} #}}} + 1