X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/613a54a3cb48ff0bd00c02d44304ce08b6725343..97d921ca676d51279b9fdfbaa7501fc8ebf8a027:/IkiWiki/CGI.pm diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm index a3486cbb4..2c5b4a84d 100644 --- a/IkiWiki/CGI.pm +++ b/IkiWiki/CGI.pm @@ -9,19 +9,20 @@ use IkiWiki::UserInfo; use open qw{:utf8 :std}; use Encode; -sub printheader ($) { #{{{ +sub printheader ($) { my $session=shift; - if ($config{sslcookie}) { + if (($ENV{HTTPS} && lc $ENV{HTTPS} ne "off") || $config{sslcookie}) { print $session->header(-charset => 'utf-8', -cookie => $session->cookie(-httponly => 1, -secure => 1)); - } else { + } + else { print $session->header(-charset => 'utf-8', -cookie => $session->cookie(-httponly => 1)); } -} #}}} +} -sub showform ($$$$;@) { #{{{ +sub prepform { my $form=shift; my $buttons=shift; my $session=shift; @@ -34,13 +35,68 @@ sub showform ($$$$;@) { #{{{ }); } + return $form; +} + +sub showform ($$$$;@) { + my $form=prepform(@_); + shift; + my $buttons=shift; + my $session=shift; + my $cgi=shift; + printheader($session); - print misctemplate($form->title, $form->render(submit => $buttons), @_); + print cgitemplate($cgi, $form->title, + $form->render(submit => $buttons), @_); +} + +sub cgitemplate ($$$;@) { + my $cgi=shift; + my $title=shift; + my $content=shift; + my %params=@_; + + my $template=template("page.tmpl"); + + my $page=""; + if (exists $params{page}) { + $page=delete $params{page}; + $params{forcebaseurl}=urlto($page); + } + run_hooks(pagetemplate => sub { + shift->( + page => $page, + destpage => $page, + template => $template, + ); + }); + templateactions($template, ""); + + my $baseurl = baseurl(); + + $template->param( + dynamic => 1, + title => $title, + wikiname => $config{wikiname}, + content => $content, + baseurl => $baseurl, + html5 => $config{html5}, + %params, + ); + + return $template->output; } -sub redirect ($$) { #{{{ +sub redirect ($$) { my $q=shift; - my $url=shift; + eval q{use URI}; + + my $topurl = $config{cgiurl}; + if (defined $q && ! $config{w3mmode} && ! $config{reverse_proxy}) { + $topurl = $q->url; + } + + my $url=URI->new(urlabs(shift, $topurl)); if (! $config{w3mmode}) { print $q->redirect($url); } @@ -48,48 +104,61 @@ sub redirect ($$) { #{{{ print "Content-type: text/plain\n"; print "W3m-control: GOTO $url\n\n"; } -} #}}} +} -sub decode_cgi_utf8 ($) { #{{{ - # decode_form_utf8 method is needed for 5.10 +sub decode_cgi_utf8 ($) { + # decode_form_utf8 method is needed for 5.01 if ($] < 5.01) { my $cgi = shift; foreach my $f ($cgi->param) { - $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f)); + $cgi->param($f, map { decode_utf8 $_ } + @{$cgi->param_fetch($f)}); } } -} #}}} +} -sub decode_form_utf8 ($) { #{{{ +sub safe_decode_utf8 ($) { + my $octets = shift; + if (!Encode::is_utf8($octets)) { + return decode_utf8($octets); + } + else { + return $octets; + } +} + +sub decode_form_utf8 ($) { if ($] >= 5.01) { my $form = shift; foreach my $f ($form->field) { + my @value=map { safe_decode_utf8($_) } $form->field($f); $form->field(name => $f, - value => decode_utf8($form->field($f)), + value => \@value, force => 1, ); } } -} #}}} +} # Check if the user is signed in. If not, redirect to the signin form and # save their place to return to later. -sub needsignin ($$) { #{{{ +sub needsignin ($$) { my $q=shift; my $session=shift; - if (! defined $session->param("name") || + if (! length $session->param("name") || ! userinfo_get($session->param("name"), "regdate")) { - $session->param(postsignin => $ENV{QUERY_STRING}); + $session->param(postsignin => $q->query_string); cgi_signin($q, $session); cgi_savesession($session); exit; } -} #}}} +} -sub cgi_signin ($$) { #{{{ +sub cgi_signin ($$;$) { my $q=shift; my $session=shift; + my $returnhtml=shift; decode_cgi_utf8($q); eval q{use CGI::FormBuilder}; @@ -102,16 +171,13 @@ sub cgi_signin ($$) { #{{{ required => 'NONE', javascript => 0, params => $q, - action => $config{cgiurl}, + action => cgiurl(), header => 0, template => {type => 'div'}, - stylesheet => baseurl()."style.css", + stylesheet => 1, ); my $buttons=["Login"]; - if ($q->param("do") ne "signin" && !$form->submitted) { - $form->text(gettext("You need to log in first.")); - } $form->field(name => "do", type => "hidden", value => "signin", force => 1); @@ -126,10 +192,15 @@ sub cgi_signin ($$) { #{{{ $form->validate; } + if ($returnhtml) { + $form=prepform($form, $buttons, $session, $q); + return $form->render(submit => $buttons); + } + showform($form, $buttons, $session, $q); -} #}}} +} -sub cgi_postsignin ($$) { #{{{ +sub cgi_postsignin ($$) { my $q=shift; my $session=shift; @@ -142,11 +213,16 @@ sub cgi_postsignin ($$) { #{{{ exit; } else { - error(gettext("login failed, perhaps you need to turn on cookies?")); + if ($config{sslcookie} && ! $q->https()) { + error(gettext("probable misconfiguration: sslcookie is set, but you are attempting to login via http, not https")); + } + else { + error(gettext("Login succeeded, but I don't remember why you were logging in, so you'll have to navigate back to whatever you were doing. (This should not normally happen. Perhaps you need to enable cookies?)")); + } } -} #}}} +} -sub cgi_prefs ($$) { #{{{ +sub cgi_prefs ($$) { my $q=shift; my $session=shift; @@ -177,9 +253,9 @@ sub cgi_prefs ($$) { #{{{ required => 'NONE', javascript => 0, params => $q, - action => $config{cgiurl}, + action => cgiurl(), template => {type => 'div'}, - stylesheet => baseurl()."style.css", + stylesheet => 1, fieldsets => [ [login => gettext("Login")], [preferences => gettext("Preferences")], @@ -203,79 +279,87 @@ sub cgi_prefs ($$) { #{{{ my $user_name=$session->param("name"); - # XXX deprecated, should be removed eventually - $form->field(name => "banned_users", size => 50, fieldset => "admin"); - if (! is_admin($user_name)) { - $form->field(name => "banned_users", type => "hidden"); - } if (! $form->submitted) { $form->field(name => "email", force => 1, value => userinfo_get($user_name, "email")); - if (is_admin($user_name)) { - my $value=join(" ", get_banned_users()); - if (length $value) { - $form->field(name => "banned_users", force => 1, - value => join(" ", get_banned_users()), - comment => "deprecated; please move to banned_users in setup file"); - } - else { - $form->field(name => "banned_users", type => "hidden"); - } - } } if ($form->submitted eq 'Logout') { $session->delete(); - redirect($q, $config{url}); + redirect($q, baseurl(undef)); return; } elsif ($form->submitted eq 'Cancel') { - redirect($q, $config{url}); + redirect($q, baseurl(undef)); return; } elsif ($form->submitted eq 'Save Preferences' && $form->validate) { - if (defined $form->field('email')) { - userinfo_set($user_name, 'email', $form->field('email')) || + my $email = $form->field('email'); + if (defined $email) { + userinfo_set($user_name, 'email', $email) || error("failed to set email"); } - # XXX deprecated, should be removed eventually - if (is_admin($user_name)) { - set_banned_users(grep { ! is_admin($_) } - split(' ', - $form->field("banned_users"))) || - error("failed saving changes"); - if (! length $form->field("banned_users")) { - $form->field(name => "banned_users", type => "hidden"); - } - } - $form->text(gettext("Preferences saved.")); } - showform($form, $buttons, $session, $q); -} #}}} + showform($form, $buttons, $session, $q, + prefsurl => "", # avoid showing the preferences link + ); +} + +sub cgi_custom_failure ($$$) { + my $q=shift; + my $httpstatus=shift; + my $message=shift; + + print $q->header( + -status => $httpstatus, + -charset => 'utf-8', + ); + print $message; + + # Internet Explod^Hrer won't show custom 404 responses + # unless they're >= 512 bytes + print ' ' x 512; + + exit; +} -sub check_banned ($$) { #{{{ +sub check_banned ($$) { my $q=shift; my $session=shift; + my $banned=0; my $name=$session->param("name"); - if (defined $name) { - # XXX banned in userinfo is deprecated, should be removed - # eventually, and only banned_users be checked. - if (userinfo_get($session->param("name"), "banned") || - grep { $name eq $_ } @{$config{banned_users}}) { - print $q->header(-status => "403 Forbidden"); - $session->delete(); - print gettext("You are banned."); - cgi_savesession($session); - exit; + my $cloak=cloak($name) if defined $name; + if (defined $name && + grep { $name eq $_ || $cloak eq $_ } @{$config{banned_users}}) { + $banned=1; + } + + foreach my $b (@{$config{banned_users}}) { + if (pagespec_match("", $b, + ip => $session->remote_addr(), + name => defined $name ? $name : "") + || pagespec_match("", $b, + ip => cloak($session->remote_addr()), + name => defined $cloak ? $cloak : "")) { + $banned=1; + last; } } + + if ($banned) { + $session->delete(); + cgi_savesession($session); + cgi_custom_failure( + $q, "403 Forbidden", + gettext("You are banned.")); + } } -sub cgi_getsession ($) { #{{{ +sub cgi_getsession ($) { my $q=shift; eval q{use CGI::Session; use HTML::Entities}; @@ -288,44 +372,49 @@ sub cgi_getsession ($) { #{{{ { FileName => "$config{wikistatedir}/sessions.db" }) }; if (! $session || $@) { - error($@." ".CGI::Session->errstr()); + my $error = $@; + error($error." ".CGI::Session->errstr()); } umask($oldmask); return $session; -} #}}} +} -# The session id is stored on the form and checked to -# guard against CSRF. But only if the user is logged in, -# as anonok can allow anonymous edits. -sub checksessionexpiry ($$) { # {{{ +# To guard against CSRF, the user's session id (sid) +# can be stored on a form. This function will check +# (for logged in users) that the sid on the form matches +# the session id in the cookie. +sub checksessionexpiry ($$) { + my $q=shift; my $session = shift; - my $sid = shift; if (defined $session->param("name")) { - if (! defined $sid || $sid ne $session->id) { + my $sid=$q->param('sid'); + if (! defined $sid || $sid ne $session->id || ! length $session->param("name")) { error(gettext("Your login session has expired.")); } } -} # }}} +} -sub cgi_savesession ($) { #{{{ +sub cgi_savesession ($) { my $session=shift; # Force session flush with safe umask. my $oldmask=umask(077); $session->flush; umask($oldmask); -} #}}} +} -sub cgi (;$$) { #{{{ +sub cgi (;$$) { my $q=shift; my $session=shift; eval q{use CGI}; error($@) if $@; + no warnings "once"; $CGI::DISABLE_UPLOADS=$config{cgi_disable_uploads}; + use warnings; if (! $q) { binmode(STDIN); @@ -345,7 +434,7 @@ sub cgi (;$$) { #{{{ error("\"do\" parameter missing"); } } - + # Need to lock the wiki before getting a session. lockwiki(); loadindex(); @@ -355,16 +444,16 @@ sub cgi (;$$) { #{{{ } # Auth hooks can sign a user in. - if ($do ne 'signin' && ! defined $session->param("name")) { + if ($do ne 'signin' && ! length $session->param("name")) { run_hooks(auth => sub { shift->($q, $session) }); - if (defined $session->param("name")) { + if (length $session->param("name")) { # Make sure whatever user was authed is in the # userinfo db. if (! userinfo_get($session->param("name"), "regdate")) { userinfo_setall($session->param("name"), { - email => "", + email => defined $session->param("email") ? $session->param("email") : "", password => "", regdate => time, }) || error("failed adding user"); @@ -389,16 +478,20 @@ sub cgi (;$$) { #{{{ else { error("unknown do parameter"); } -} #}}} +} # Does not need to be called directly; all errors will go through here. -sub cgierror ($) { #{{{ +sub cgierror ($) { my $message=shift; + eval q{use HTML::Entities}; + $message = encode_entities($message); + print "Content-type: text/html\n\n"; - print misctemplate(gettext("Error"), + print cgitemplate(undef, gettext("Error"), "

".gettext("Error").": $message

"); - die $@; -} #}}} + + die $message; +} 1