X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/17fdb8028bfb2722c120b229c2131598affbddd6..db73f81258220fb64f96b6ba45793b6ded2861dd:/IkiWiki/CGI.pm
diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index 99cead64f..a05043478 100644
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -1,5 +1,7 @@
#!/usr/bin/perl
+package IkiWiki;
+
use warnings;
use strict;
use IkiWiki;
@@ -7,8 +9,6 @@ use IkiWiki::UserInfo;
use open qw{:utf8 :std};
use Encode;
-package IkiWiki;
-
sub printheader ($) { #{{{
my $session=shift;
@@ -18,7 +18,6 @@ sub printheader ($) { #{{{
} else {
print $session->header(-charset => 'utf-8');
}
-
} #}}}
sub showform ($$$$;@) { #{{{
@@ -227,20 +226,27 @@ sub cgi_prefs ($$) { #{{{
$form->field(name => "sid", type => "hidden", value => $session->id,
force => 1);
$form->field(name => "email", size => 50, fieldset => "preferences");
- $form->field(name => "banned_users", size => 50,
- fieldset => "admin");
my $user_name=$session->param("name");
+
+ # XXX deprecated, should be removed eventually
+ $form->field(name => "banned_users", size => 50, fieldset => "admin");
if (! is_admin($user_name)) {
$form->field(name => "banned_users", type => "hidden");
}
-
if (! $form->submitted) {
$form->field(name => "email", force => 1,
value => userinfo_get($user_name, "email"));
if (is_admin($user_name)) {
- $form->field(name => "banned_users", force => 1,
- value => join(" ", get_banned_users()));
+ my $value=join(" ", get_banned_users());
+ if (length $value) {
+ $form->field(name => "banned_users", force => 1,
+ value => join(" ", get_banned_users()),
+ comment => "deprecated; please move to banned_users in setup file");
+ }
+ else {
+ $form->field(name => "banned_users", type => "hidden");
+ }
}
}
@@ -258,12 +264,18 @@ sub cgi_prefs ($$) { #{{{
userinfo_set($user_name, 'email', $form->field('email')) ||
error("failed to set email");
}
+
+ # XXX deprecated, should be removed eventually
if (is_admin($user_name)) {
set_banned_users(grep { ! is_admin($_) }
split(' ',
$form->field("banned_users"))) ||
error("failed saving changes");
+ if (! length $form->field("banned_users")) {
+ $form->field(name => "banned_users", type => "hidden");
+ }
}
+
$form->text(gettext("Preferences saved."));
}
@@ -304,8 +316,9 @@ sub cgi_editpage ($$) { #{{{
# This untaint is safe because we check file_pruned.
my $page=$form->field('page');
$page=possibly_foolish_untaint($page);
+ my $absolute=($page =~ s#^/+##);
if (! defined $page || ! length $page ||
- file_pruned($page, $config{srcdir}) || $page=~/^\//) {
+ file_pruned($page, $config{srcdir})) {
error("bad page name");
}
@@ -415,7 +428,6 @@ sub cgi_editpage ($$) { #{{{
elsif ($form->submitted eq "Save Page") {
$form->tmpl_param("page_preview", "");
}
- $form->tmpl_param("page_conflict", "");
if ($form->submitted ne "Save Page" || ! $form->validate) {
if ($form->field("do") eq "create") {
@@ -424,7 +436,8 @@ sub cgi_editpage ($$) { #{{{
if (! defined $from || ! length $from ||
$from ne $form->field('from') ||
file_pruned($from, $config{srcdir}) ||
- $from=~/^\// ||
+ $from=~/^\// ||
+ $absolute ||
$form->submitted eq "Preview") {
@page_locs=$best_loc=$page;
}
@@ -530,7 +543,7 @@ sub cgi_editpage ($$) { #{{{
if ($form->field("do") ne "create" && ! $exists &&
! defined srcfile($file, 1)) {
- $form->tmpl_param("page_gone", 1);
+ $form->tmpl_param("message", template("editpagegone.tmpl")->output);
$form->field(name => "do", value => "create", force => 1);
$form->tmpl_param("page_select", 0);
$form->field(name => "page", type => 'hidden');
@@ -540,7 +553,7 @@ sub cgi_editpage ($$) { #{{{
return;
}
elsif ($form->field("do") eq "create" && $exists) {
- $form->tmpl_param("creation_conflict", 1);
+ $form->tmpl_param("message", template("editcreationconflict.tmpl")->output);
$form->field(name => "do", value => "edit", force => 1);
$form->tmpl_param("page_select", 0);
$form->field(name => "page", type => 'hidden');
@@ -573,8 +586,9 @@ sub cgi_editpage ($$) { #{{{
if ($@) {
$form->field(name => "rcsinfo", value => rcs_prepedit($file),
force => 1);
- $form->tmpl_param("failed_save", 1);
- $form->tmpl_param("error_message", $@);
+ my $mtemplate=template("editfailedsave.tmpl");
+ $mtemplate->param(error_message => $@);
+ $form->tmpl_param("message", $mtemplate->output);
$form->field("editcontent", value => $content, force => 1);
$form->tmpl_param("page_select", 0);
$form->field(name => "page", type => 'hidden');
@@ -618,7 +632,7 @@ sub cgi_editpage ($$) { #{{{
if (defined $conflict) {
$form->field(name => "rcsinfo", value => rcs_prepedit($file),
force => 1);
- $form->tmpl_param("page_conflict", 1);
+ $form->tmpl_param("message", template("editconflict.tmpl")->output);
$form->field("editcontent", value => $conflict, force => 1);
$form->field("do", "edit", force => 1);
$form->tmpl_param("page_select", 0);
@@ -636,6 +650,25 @@ sub cgi_editpage ($$) { #{{{
}
}
} #}}}
+
+sub check_banned ($$) { #{{{
+ my $q=shift;
+ my $session=shift;
+
+ my $name=$session->param("name");
+ if (defined $name) {
+ # XXX banned in userinfo is deprecated, should be removed
+ # eventually, and only banned_users be checked.
+ if (userinfo_get($session->param("name"), "banned") ||
+ grep { $name eq $_ } @{$config{banned_users}}) {
+ print $q->header(-status => "403 Forbidden");
+ $session->delete();
+ print gettext("You are banned.");
+ cgi_savesession($session);
+ exit;
+ }
+ }
+}
sub cgi_getsession ($) { #{{{
my $q=shift;
@@ -645,8 +678,14 @@ sub cgi_getsession ($) { #{{{
CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname}));
my $oldmask=umask(077);
- my $session = CGI::Session->new("driver:DB_File", $q,
- { FileName => "$config{wikistatedir}/sessions.db" });
+ my $session = eval {
+ CGI::Session->new("driver:DB_File", $q,
+ { FileName => "$config{wikistatedir}/sessions.db" })
+ };
+ if (! $session || $@) {
+ error($@." ".CGI::Session->errstr());
+ }
+
umask($oldmask);
return $session;
@@ -714,14 +753,8 @@ sub cgi (;$$) { #{{{
}
}
- if (defined $session->param("name") &&
- userinfo_get($session->param("name"), "banned")) {
- print $q->header(-status => "403 Forbidden");
- $session->delete();
- print gettext("You are banned.");
- cgi_savesession($session);
- }
-
+ check_banned($q, $session);
+
run_hooks(sessioncgi => sub { shift->($q, $session) });
if ($do eq 'signin') {
@@ -742,4 +775,14 @@ sub cgi (;$$) { #{{{
}
} #}}}
+# Does not need to be called directly; all errors will go through here.
+sub cgierror ($) { #{{{
+ my $message=shift;
+
+ print "Content-type: text/html\n\n";
+ print misctemplate(gettext("Error"),
+ "<p class=\"error\">".gettext("Error").": $message</p>");
+ die $@;
+} #}}}
+
1