X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/6c8cf5dd571662f981227489f7c4652a1a1f10cd..7071d0b58667e36f22ddc95cc6602dcb1700438a:/IkiWiki/CGI.pm?ds=inline diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm index 3ac984d30..a05043478 100644 --- a/IkiWiki/CGI.pm +++ b/IkiWiki/CGI.pm @@ -1,202 +1,174 @@ #!/usr/bin/perl +package IkiWiki; + use warnings; use strict; +use IkiWiki; +use IkiWiki::UserInfo; +use open qw{:utf8 :std}; +use Encode; -package IkiWiki; +sub printheader ($) { #{{{ + my $session=shift; + + if ($config{sslcookie}) { + print $session->header(-charset => 'utf-8', + -cookie => $session->cookie(-secure => 1)); + } else { + print $session->header(-charset => 'utf-8'); + } +} #}}} + +sub showform ($$$$;@) { #{{{ + my $form=shift; + my $buttons=shift; + my $session=shift; + my $cgi=shift; + + if (exists $hooks{formbuilder}) { + run_hooks(formbuilder => sub { + shift->(form => $form, cgi => $cgi, session => $session, + buttons => $buttons); + }); + } + + printheader($session); + print misctemplate($form->title, $form->render(submit => $buttons), @_); +} + +sub redirect ($$) { #{{{ + my $q=shift; + my $url=shift; + if (! $config{w3mmode}) { + print $q->redirect($url); + } + else { + print "Content-type: text/plain\n"; + print "W3m-control: GOTO $url\n\n"; + } +} #}}} -sub page_locked ($$;$) { #{{{ +sub check_canedit ($$$;$) { #{{{ my $page=shift; + my $q=shift; my $session=shift; my $nonfatal=shift; - my $user=$session->param("name"); - return if length $user && is_admin($user); - - foreach my $admin (@{$config{adminuser}}) { - my $locked_pages=userinfo_get($admin, "locked_pages"); - if (globlist_match($page, userinfo_get($admin, "locked_pages"))) { - return 1 if $nonfatal; - error(htmllink("", $page, 1)." is locked by ". - htmllink("", $admin, 1)." and cannot be edited."); + my $canedit; + run_hooks(canedit => sub { + return if defined $canedit; + my $ret=shift->($page, $q, $session); + if (defined $ret) { + if ($ret eq "") { + $canedit=1; + } + elsif (ref $ret eq 'CODE') { + $ret->() unless $nonfatal; + $canedit=0; + } + elsif (defined $ret) { + error($ret) unless $nonfatal; + $canedit=0; + } + } + }); + return $canedit; +} #}}} + +sub decode_cgi_utf8 ($) { #{{{ + # decode_form_utf8 method is needed for 5.10 + if ($] < 5.01) { + my $cgi = shift; + foreach my $f ($cgi->param) { + $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f)); } } +} #}}} - return 0; +sub decode_form_utf8 ($) { #{{{ + if ($] >= 5.01) { + my $form = shift; + foreach my $f ($form->field) { + $form->field(name => $f, + value => decode_utf8($form->field($f)), + force => 1, + ); + } + } } #}}} -sub cgi_recentchanges ($) { #{{{ +# Check if the user is signed in. If not, redirect to the signin form and +# save their place to return to later. +sub needsignin ($$) { #{{{ my $q=shift; - - my $template=HTML::Template->new( - filename => "$config{templatedir}/recentchanges.tmpl" - ); - $template->param( - title => "RecentChanges", - indexlink => indexlink(), - wikiname => $config{wikiname}, - changelog => [rcs_recentchanges(100)], - ); - print $q->header, $template->output; -} #}}} + my $session=shift; + + if (! defined $session->param("name") || + ! userinfo_get($session->param("name"), "regdate")) { + $session->param(postsignin => $ENV{QUERY_STRING}); + cgi_signin($q, $session); + cgi_savesession($session); + exit; + } +} #}}} sub cgi_signin ($$) { #{{{ my $q=shift; my $session=shift; + decode_cgi_utf8($q); eval q{use CGI::FormBuilder}; + error($@) if $@; my $form = CGI::FormBuilder->new( title => "signin", - fields => [qw(do page from name password confirm_password email)], - header => 1, + name => "signin", + charset => "utf-8", method => 'POST', - validate => { - confirm_password => { - perl => q{eq $form->field("password")}, - }, - email => 'EMAIL', - }, required => 'NONE', javascript => 0, params => $q, - action => $q->request_uri, + action => $config{cgiurl}, header => 0, - template => (-e "$config{templatedir}/signin.tmpl" ? - "$config{templatedir}/signin.tmpl" : "") + template => {type => 'div'}, + stylesheet => baseurl()."style.css", ); + my $buttons=["Login"]; - $form->field(name => "name", required => 0); - $form->field(name => "do", type => "hidden"); - $form->field(name => "page", type => "hidden"); - $form->field(name => "from", type => "hidden"); - $form->field(name => "password", type => "password", required => 0); - $form->field(name => "confirm_password", type => "password", required => 0); - $form->field(name => "email", required => 0); - if ($q->param("do") ne "signin") { - $form->text("You need to log in first."); + if ($q->param("do") ne "signin" && !$form->submitted) { + $form->text(gettext("You need to log in first.")); } + $form->field(name => "do", type => "hidden", value => "signin", + force => 1); + decode_form_utf8($form); + run_hooks(formbuilder_setup => sub { + shift->(form => $form, cgi => $q, session => $session, + buttons => $buttons); + }); + decode_form_utf8($form); + if ($form->submitted) { - # Set required fields based on how form was submitted. - my %required=( - "Login" => [qw(name password)], - "Register" => [qw(name password confirm_password email)], - "Mail Password" => [qw(name)], - ); - foreach my $opt (@{$required{$form->submitted}}) { - $form->field(name => $opt, required => 1); - } - - # Validate password differently depending on how - # form was submitted. - if ($form->submitted eq 'Login') { - $form->field( - name => "password", - validate => sub { - length $form->field("name") && - shift eq userinfo_get($form->field("name"), 'password'); - }, - ); - $form->field(name => "name", validate => '/^\w+$/'); - } - else { - $form->field(name => "password", validate => 'VALUE'); - } - # And make sure the entered name exists when logging - # in or sending email, and does not when registering. - if ($form->submitted eq 'Register') { - $form->field( - name => "name", - validate => sub { - my $name=shift; - length $name && - ! userinfo_get($name, "regdate"); - }, - ); - } - else { - $form->field( - name => "name", - validate => sub { - my $name=shift; - length $name && - userinfo_get($name, "regdate"); - }, - ); - } - } - else { - # First time settings. - $form->field(name => "name", comment => "use FirstnameLastName"); - $form->field(name => "confirm_password", comment => "(only needed"); - $form->field(name => "email", comment => "for registration)"); - if ($session->param("name")) { - $form->field(name => "name", value => $session->param("name")); - } + $form->validate; } - if ($form->submitted && $form->validate) { - if ($form->submitted eq 'Login') { - $session->param("name", $form->field("name")); - if (defined $form->field("do") && - $form->field("do") ne 'signin') { - print $q->redirect( - "$config{cgiurl}?do=".$form->field("do"). - "&page=".$form->field("page"). - "&from=".$form->field("from"));; - } - else { - print $q->redirect($config{url}); - } - } - elsif ($form->submitted eq 'Register') { - my $user_name=$form->field('name'); - if (userinfo_setall($user_name, { - 'email' => $form->field('email'), - 'password' => $form->field('password'), - 'regdate' => time - })) { - $form->field(name => "confirm_password", type => "hidden"); - $form->field(name => "email", type => "hidden"); - $form->text("Registration successful. Now you can Login."); - print $session->header(); - print misctemplate($form->title, $form->render(submit => ["Login"])); - } - else { - error("Error saving registration."); - } - } - elsif ($form->submitted eq 'Mail Password') { - my $user_name=$form->field("name"); - my $template=HTML::Template->new( - filename => "$config{templatedir}/passwordmail.tmpl" - ); - $template->param( - user_name => $user_name, - user_password => userinfo_get($user_name, "password"), - wikiurl => $config{url}, - wikiname => $config{wikiname}, - REMOTE_ADDR => $ENV{REMOTE_ADDR}, - ); - - eval q{use Mail::Sendmail}; - my ($fromhost) = $config{cgiurl} =~ m!/([^/]+)!; - sendmail( - To => userinfo_get($user_name, "email"), - From => "$config{wikiname} admin <".(getpwuid($>))[0]."@".$fromhost.">", - Subject => "$config{wikiname} information", - Message => $template->output, - ) or error("Failed to send mail"); - - $form->text("Your password has been emailed to you."); - $form->field(name => "name", required => 0); - print $session->header(); - print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"])); - } + showform($form, $buttons, $session, $q); +} #}}} + +sub cgi_postsignin ($$) { #{{{ + my $q=shift; + my $session=shift; + + # Continue with whatever was being done before the signin process. + if (defined $session->param("postsignin")) { + my $postsignin=CGI->new($session->param("postsignin")); + $session->clear("postsignin"); + cgi($postsignin, $session); + cgi_savesession($session); + exit; } else { - print $session->header(); - print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"])); + error(gettext("login failed, perhaps you need to turn on cookies?")); } } #}}} @@ -204,158 +176,277 @@ sub cgi_prefs ($$) { #{{{ my $q=shift; my $session=shift; + needsignin($q, $session); + decode_cgi_utf8($q); + + # The session id is stored on the form and checked to + # guard against CSRF. + my $sid=$q->param('sid'); + if (! defined $sid) { + $q->delete_all; + } + elsif ($sid ne $session->id) { + error(gettext("Your login session has expired.")); + } + eval q{use CGI::FormBuilder}; + error($@) if $@; my $form = CGI::FormBuilder->new( title => "preferences", - fields => [qw(do name password confirm_password email locked_pages)], + name => "preferences", header => 0, + charset => "utf-8", method => 'POST', validate => { - confirm_password => { - perl => q{eq $form->field("password")}, - }, email => 'EMAIL', }, required => 'NONE', javascript => 0, params => $q, - action => $q->request_uri, - template => (-e "$config{templatedir}/prefs.tmpl" ? - "$config{templatedir}/prefs.tmpl" : "") + action => $config{cgiurl}, + template => {type => 'div'}, + stylesheet => baseurl()."style.css", + fieldsets => [ + [login => gettext("Login")], + [preferences => gettext("Preferences")], + [admin => gettext("Admin")] + ], ); - my @buttons=("Save Preferences", "Logout", "Cancel"); + my $buttons=["Save Preferences", "Logout", "Cancel"]; - my $user_name=$session->param("name"); - $form->field(name => "do", type => "hidden"); - $form->field(name => "name", disabled => 1, - value => $user_name, force => 1); - $form->field(name => "password", type => "password"); - $form->field(name => "confirm_password", type => "password"); - $form->field(name => "locked_pages", size => 50, - comment => "(".htmllink("", "GlobList", 1).")"); + decode_form_utf8($form); + run_hooks(formbuilder_setup => sub { + shift->(form => $form, cgi => $q, session => $session, + buttons => $buttons); + }); + decode_form_utf8($form); + $form->field(name => "do", type => "hidden", value => "prefs", + force => 1); + $form->field(name => "sid", type => "hidden", value => $session->id, + force => 1); + $form->field(name => "email", size => 50, fieldset => "preferences"); + + my $user_name=$session->param("name"); + + # XXX deprecated, should be removed eventually + $form->field(name => "banned_users", size => 50, fieldset => "admin"); if (! is_admin($user_name)) { - $form->field(name => "locked_pages", type => "hidden"); + $form->field(name => "banned_users", type => "hidden"); } - if (! $form->submitted) { $form->field(name => "email", force => 1, value => userinfo_get($user_name, "email")); - $form->field(name => "locked_pages", force => 1, - value => userinfo_get($user_name, "locked_pages")); + if (is_admin($user_name)) { + my $value=join(" ", get_banned_users()); + if (length $value) { + $form->field(name => "banned_users", force => 1, + value => join(" ", get_banned_users()), + comment => "deprecated; please move to banned_users in setup file"); + } + else { + $form->field(name => "banned_users", type => "hidden"); + } + } } if ($form->submitted eq 'Logout') { $session->delete(); - print $q->redirect($config{url}); + redirect($q, $config{url}); return; } elsif ($form->submitted eq 'Cancel') { - print $q->redirect($config{url}); + redirect($q, $config{url}); return; } - elsif ($form->submitted eq "Save Preferences" && $form->validate) { - foreach my $field (qw(password email locked_pages)) { - if (length $form->field($field)) { - userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field"); + elsif ($form->submitted eq 'Save Preferences' && $form->validate) { + if (defined $form->field('email')) { + userinfo_set($user_name, 'email', $form->field('email')) || + error("failed to set email"); + } + + # XXX deprecated, should be removed eventually + if (is_admin($user_name)) { + set_banned_users(grep { ! is_admin($_) } + split(' ', + $form->field("banned_users"))) || + error("failed saving changes"); + if (! length $form->field("banned_users")) { + $form->field(name => "banned_users", type => "hidden"); } } - $form->text("Preferences saved."); + + $form->text(gettext("Preferences saved.")); } - print $session->header(); - print misctemplate($form->title, $form->render(submit => \@buttons)); + showform($form, $buttons, $session, $q); } #}}} sub cgi_editpage ($$) { #{{{ my $q=shift; my $session=shift; + + decode_cgi_utf8($q); + my @fields=qw(do rcsinfo subpage from page type editcontent comments); + my @buttons=("Save Page", "Preview", "Cancel"); eval q{use CGI::FormBuilder}; + error($@) if $@; my $form = CGI::FormBuilder->new( - fields => [qw(do rcsinfo from page content comments)], - header => 1, + fields => \@fields, + charset => "utf-8", method => 'POST', - validate => { - content => '/.+/', - }, - required => [qw{content}], + required => [qw{editcontent}], javascript => 0, params => $q, - action => $q->request_uri, + action => $config{cgiurl}, + header => 0, table => 0, - template => "$config{templatedir}/editpage.tmpl" + template => scalar template_params("editpage.tmpl"), + wikiname => $config{wikiname}, ); - my @buttons=("Save Page", "Preview", "Cancel"); - my ($page)=$form->param('page')=~/$config{wiki_file_regexp}/; - if (! defined $page || ! length $page || $page ne $q->param('page') || - $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) { + decode_form_utf8($form); + run_hooks(formbuilder_setup => sub { + shift->(form => $form, cgi => $q, session => $session, + buttons => \@buttons); + }); + decode_form_utf8($form); + + # This untaint is safe because we check file_pruned. + my $page=$form->field('page'); + $page=possibly_foolish_untaint($page); + my $absolute=($page =~ s#^/+##); + if (! defined $page || ! length $page || + file_pruned($page, $config{srcdir})) { error("bad page name"); } - $page=lc($page); + + my $baseurl=$config{url}."/".htmlpage($page); + + my $from; + if (defined $form->field('from')) { + ($from)=$form->field('from')=~/$config{wiki_file_regexp}/; + } - my $file=$page.$config{default_pageext}; - my $newfile=1; - if (exists $pagesources{lc($page)}) { - $file=$pagesources{lc($page)}; - $newfile=0; + my $file; + my $type; + if (exists $pagesources{$page} && $form->field("do") ne "create") { + $file=$pagesources{$page}; + $type=pagetype($file); + if (! defined $type || $type=~/^_/) { + error(sprintf(gettext("%s is not an editable page"), $page)); + } + if (! $form->submitted) { + $form->field(name => "rcsinfo", + value => rcs_prepedit($file), force => 1); + } + $form->field(name => "editcontent", validate => '/.*/'); + } + else { + $type=$form->param('type'); + if (defined $type && length $type && $hooks{htmlize}{$type}) { + $type=possibly_foolish_untaint($type); + } + elsif (defined $from && exists $pagesources{$from}) { + # favor the type of linking page + $type=pagetype($pagesources{$from}); + } + $type=$config{default_pageext} unless defined $type; + $file=$page.".".$type; + if (! $form->submitted) { + $form->field(name => "rcsinfo", value => "", force => 1); + } + $form->field(name => "editcontent", validate => '/.+/'); } $form->field(name => "do", type => 'hidden'); + $form->field(name => "sid", type => "hidden", value => $session->id, + force => 1); $form->field(name => "from", type => 'hidden'); $form->field(name => "rcsinfo", type => 'hidden'); - $form->field(name => "page", value => "$page", force => 1); + $form->field(name => "subpage", type => 'hidden'); + $form->field(name => "page", value => $page, force => 1); + $form->field(name => "type", value => $type, force => 1); $form->field(name => "comments", type => "text", size => 80); - $form->field(name => "content", type => "textarea", rows => 20, + $form->field(name => "editcontent", type => "textarea", rows => 20, cols => 80); $form->tmpl_param("can_commit", $config{rcs}); $form->tmpl_param("indexlink", indexlink()); $form->tmpl_param("helponformattinglink", - htmllink("", "HelpOnFormatting", 1)); - if (! $form->submitted) { - $form->field(name => "rcsinfo", value => rcs_prepedit($file), - force => 1); - } + htmllink($page, $page, "ikiwiki/formatting", + noimageinline => 1, + linktext => "FormattingHelp")); if ($form->submitted eq "Cancel") { - print $q->redirect("$config{url}/".htmlpage($page)); + if ($form->field("do") eq "create" && defined $from) { + redirect($q, "$config{url}/".htmlpage($from)); + } + elsif ($form->field("do") eq "create") { + redirect($q, $config{url}); + } + else { + redirect($q, "$config{url}/".htmlpage($page)); + } return; } elsif ($form->submitted eq "Preview") { - require IkiWiki::Render; - $form->tmpl_param("page_preview", - htmlize($config{default_pageext}, - linkify($form->field('content'), $page))); + my $new=not exists $pagesources{$page}; + if ($new) { + # temporarily record its type + $pagesources{$page}=$page.".".$type; + } + + my $content=$form->field('editcontent'); + + run_hooks(editcontent => sub { + $content=shift->( + content => $content, + page => $page, + cgi => $q, + session => $session, + ); + }); + my $preview=htmlize($page, $page, $type, + linkify($page, $page, + preprocess($page, $page, + filter($page, $page, $content), 0, 1))); + run_hooks(format => sub { + $preview=shift->( + page => $page, + content => $preview, + ); + }); + $form->tmpl_param("page_preview", $preview); + + if ($new) { + delete $pagesources{$page}; + } + # previewing may have created files on disk + saveindex(); } - else { + elsif ($form->submitted eq "Save Page") { $form->tmpl_param("page_preview", ""); } - $form->tmpl_param("page_conflict", ""); - if (! $form->submitted || $form->submitted eq "Preview" || - ! $form->validate) { + if ($form->submitted ne "Save Page" || ! $form->validate) { if ($form->field("do") eq "create") { - if (exists $pagesources{lc($page)}) { - # hmm, someone else made the page in the - # meantime? - print $q->redirect("$config{url}/".htmlpage($page)); - return; - } - my @page_locs; my $best_loc; - my ($from)=$form->param('from')=~/$config{wiki_file_regexp}/; if (! defined $from || ! length $from || - $from ne $form->param('from') || - $from=~/$config{wiki_file_prune_regexp}/ || $from=~/^\//) { + $from ne $form->field('from') || + file_pruned($from, $config{srcdir}) || + $from=~/^\// || + $absolute || + $form->submitted eq "Preview") { @page_locs=$best_loc=$page; } else { my $dir=$from."/"; - $dir=~s![^/]+/$!!; + $dir=~s![^/]+/+$!!; - if ($page eq 'discussion') { + if ((defined $form->field('subpage') && length $form->field('subpage')) || + $page eq gettext('discussion')) { $best_loc="$from/$page"; } else { @@ -365,145 +456,333 @@ sub cgi_editpage ($$) { #{{{ push @page_locs, $dir.$page; push @page_locs, "$from/$page"; while (length $dir) { - $dir=~s![^/]+/$!!; + $dir=~s![^/]+/+$!!; push @page_locs, $dir.$page; } + + push @page_locs, "$config{userdir}/$page" + if length $config{userdir}; + } - @page_locs = grep { - ! exists $pagesources{lc($_)} && - ! page_locked($_, $session, 1) - } @page_locs; + @page_locs = grep { + ! exists $pagecase{lc $_} + } @page_locs; + if (! @page_locs) { + # hmm, someone else made the page in the + # meantime? + if ($form->submitted eq "Preview") { + # let them go ahead with the edit + # and resolve the conflict at save + # time + @page_locs=$page; + } + else { + redirect($q, "$config{url}/".htmlpage($page)); + return; + } } + my @editable_locs = grep { + check_canedit($_, $q, $session, 1) + } @page_locs; + if (! @editable_locs) { + # let it throw an error this time + map { check_canedit($_, $q, $session) } @page_locs; + } + + my @page_types; + if (exists $hooks{htmlize}) { + @page_types=grep { !/^_/ } + keys %{$hooks{htmlize}}; + } + $form->tmpl_param("page_select", 1); $form->field(name => "page", type => 'select', - options => \@page_locs, value => $best_loc); - $form->title("creating $page"); + options => [ map { [ $_, pagetitle($_, 1) ] } @editable_locs ], + value => $best_loc); + $form->field(name => "type", type => 'select', + options => \@page_types); + $form->title(sprintf(gettext("creating %s"), pagetitle($page))); + } elsif ($form->field("do") eq "edit") { - page_locked($page, $session); - if (! defined $form->field('content') || - ! length $form->field('content')) { + check_canedit($page, $q, $session); + if (! defined $form->field('editcontent') || + ! length $form->field('editcontent')) { my $content=""; - if (exists $pagesources{lc($page)}) { - $content=readfile("$config{srcdir}/$pagesources{lc($page)}"); + if (exists $pagesources{$page}) { + $content=readfile(srcfile($pagesources{$page})); $content=~s/\n/\r\n/g; } - $form->field(name => "content", value => $content, + $form->field(name => "editcontent", value => $content, force => 1); } $form->tmpl_param("page_select", 0); $form->field(name => "page", type => 'hidden'); - $form->title("editing $page"); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), pagetitle($page))); } - print $form->render(submit => \@buttons); + showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl); } else { # save page - page_locked($page, $session); + check_canedit($page, $q, $session); + + # The session id is stored on the form and checked to + # guard against CSRF. But only if the user is logged in, + # as anonok can allow anonymous edits. + if (defined $session->param("name")) { + my $sid=$q->param('sid'); + if (! defined $sid || $sid ne $session->id) { + error(gettext("Your login session has expired.")); + } + } + + my $exists=-e "$config{srcdir}/$file"; + + if ($form->field("do") ne "create" && ! $exists && + ! defined srcfile($file, 1)) { + $form->tmpl_param("message", template("editpagegone.tmpl")->output); + $form->field(name => "do", value => "create", force => 1); + $form->tmpl_param("page_select", 0); + $form->field(name => "page", type => 'hidden'); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), $page)); + showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl); + return; + } + elsif ($form->field("do") eq "create" && $exists) { + $form->tmpl_param("message", template("editcreationconflict.tmpl")->output); + $form->field(name => "do", value => "edit", force => 1); + $form->tmpl_param("page_select", 0); + $form->field(name => "page", type => 'hidden'); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), $page)); + $form->field("editcontent", + value => readfile("$config{srcdir}/$file"). + "\n\n\n".$form->field("editcontent"), + force => 1); + showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl); + return; + } - my $content=$form->field('content'); + my $content=$form->field('editcontent'); + run_hooks(editcontent => sub { + $content=shift->( + content => $content, + page => $page, + cgi => $q, + session => $session, + ); + }); $content=~s/\r\n/\n/g; $content=~s/\r/\n/g; - writefile("$config{srcdir}/$file", $content); - - my $message="web commit "; - if (length $session->param("name")) { - $message.="by ".$session->param("name"); - } - else { - $message.="from $ENV{REMOTE_ADDR}"; - } - if (defined $form->field('comments') && - length $form->field('comments')) { - $message.=": ".$form->field('comments'); + $content.="\n" if $content !~ /\n$/; + + $config{cgi}=0; # avoid cgi error message + eval { writefile($file, $config{srcdir}, $content) }; + $config{cgi}=1; + if ($@) { + $form->field(name => "rcsinfo", value => rcs_prepedit($file), + force => 1); + my $mtemplate=template("editfailedsave.tmpl"); + $mtemplate->param(error_message => $@); + $form->tmpl_param("message", $mtemplate->output); + $form->field("editcontent", value => $content, force => 1); + $form->tmpl_param("page_select", 0); + $form->field(name => "page", type => 'hidden'); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), $page)); + showform($form, \@buttons, $session, $q, + forcebaseurl => $baseurl); + return; } + my $conflict; if ($config{rcs}) { - if ($newfile) { + my $message=""; + if (defined $form->field('comments') && + length $form->field('comments')) { + $message=$form->field('comments'); + } + + if (! $exists) { rcs_add($file); } - # prevent deadlock with post-commit hook - unlockwiki(); - # presumably the commit will trigger an update - # of the wiki - my $conflict=rcs_commit($file, $message, - $form->field("rcsinfo")); + + # Prevent deadlock with post-commit hook by + # signaling to it that it should not try to + # do anything. + disable_commit_hook(); + $conflict=rcs_commit($file, $message, + $form->field("rcsinfo"), + $session->param("name"), $ENV{REMOTE_ADDR}); + enable_commit_hook(); + rcs_update(); + } - if (defined $conflict) { - $form->field(name => "rcsinfo", value => rcs_prepedit($file), - force => 1); - $form->tmpl_param("page_conflict", 1); - $form->field("content", value => $conflict, force => 1); - $form->field("do", "edit)"); - $form->tmpl_param("page_select", 0); - $form->field(name => "page", type => 'hidden'); - $form->title("editing $page"); - print $form->render(submit => \@buttons); - return; - } + # Refresh even if there was a conflict, since other changes + # may have been committed while the post-commit hook was + # disabled. + require IkiWiki::Render; + refresh(); + saveindex(); + + if (defined $conflict) { + $form->field(name => "rcsinfo", value => rcs_prepedit($file), + force => 1); + $form->tmpl_param("message", template("editconflict.tmpl")->output); + $form->field("editcontent", value => $conflict, force => 1); + $form->field("do", "edit", force => 1); + $form->tmpl_param("page_select", 0); + $form->field(name => "page", type => 'hidden'); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), $page)); + showform($form, \@buttons, $session, $q, + forcebaseurl => $baseurl); + return; } else { - require IkiWiki::Render; - loadindex(); - refresh(); - saveindex(); + # The trailing question mark tries to avoid broken + # caches and get the most recent version of the page. + redirect($q, "$config{url}/".htmlpage($page)."?updated"); } - - # The trailing question mark tries to avoid broken - # caches and get the most recent version of the page. - print $q->redirect("$config{url}/".htmlpage($page)."?updated"); } } #}}} - -sub cgi () { #{{{ - eval q{use CGI}; - eval q{use CGI::Session}; - my $q=CGI->new; - - my $do=$q->param('do'); - if (! defined $do || ! length $do) { - error("\"do\" parameter missing"); +sub check_banned ($$) { #{{{ + my $q=shift; + my $session=shift; + + my $name=$session->param("name"); + if (defined $name) { + # XXX banned in userinfo is deprecated, should be removed + # eventually, and only banned_users be checked. + if (userinfo_get($session->param("name"), "banned") || + grep { $name eq $_ } @{$config{banned_users}}) { + print $q->header(-status => "403 Forbidden"); + $session->delete(); + print gettext("You are banned."); + cgi_savesession($session); + exit; + } } +} + +sub cgi_getsession ($) { #{{{ + my $q=shift; + + eval q{use CGI::Session}; + error($@) if $@; + CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname})); - # This does not need a session. - if ($do eq 'recentchanges') { - cgi_recentchanges($q); - return; + my $oldmask=umask(077); + my $session = eval { + CGI::Session->new("driver:DB_File", $q, + { FileName => "$config{wikistatedir}/sessions.db" }) + }; + if (! $session || $@) { + error($@." ".CGI::Session->errstr()); } - CGI::Session->name("ikiwiki_session"); + umask($oldmask); + + return $session; +} #}}} + +sub cgi_savesession ($) { #{{{ + my $session=shift; + # Force session flush with safe umask. my $oldmask=umask(077); - my $session = CGI::Session->new("driver:db_file", $q, - { FileName => "$config{wikistatedir}/sessions.db" }); + $session->flush; umask($oldmask); +} #}}} + +sub cgi (;$$) { #{{{ + my $q=shift; + my $session=shift; + + eval q{use CGI}; + error($@) if $@; + $CGI::DISABLE_UPLOADS=$config{cgi_disable_uploads}; + + if (! $q) { + binmode(STDIN); + $q=CGI->new; + binmode(STDIN, ":utf8"); - # Everything below this point needs the user to be signed in. - if ((! $config{anonok} && ! defined $session->param("name") || - ! defined $session->param("name") || - ! userinfo_get($session->param("name"), "regdate")) || $do eq 'signin') { - cgi_signin($q, $session); + run_hooks(cgi => sub { shift->($q) }); + } + + my $do=$q->param('do'); + if (! defined $do || ! length $do) { + my $error = $q->cgi_error; + if ($error) { + error("Request not processed: $error"); + } + else { + error("\"do\" parameter missing"); + } + } - # Force session flush with safe umask. - my $oldmask=umask(077); - $session->flush; - umask($oldmask); - - return; + # Need to lock the wiki before getting a session. + lockwiki(); + loadindex(); + + if (! $session) { + $session=cgi_getsession($q); } - if ($do eq 'create' || $do eq 'edit') { - cgi_editpage($q, $session); + # Auth hooks can sign a user in. + if ($do ne 'signin' && ! defined $session->param("name")) { + run_hooks(auth => sub { + shift->($q, $session) + }); + if (defined $session->param("name")) { + # Make sure whatever user was authed is in the + # userinfo db. + if (! userinfo_get($session->param("name"), "regdate")) { + userinfo_setall($session->param("name"), { + email => "", + password => "", + regdate => time, + }) || error("failed adding user"); + } + } + } + + check_banned($q, $session); + + run_hooks(sessioncgi => sub { shift->($q, $session) }); + + if ($do eq 'signin') { + cgi_signin($q, $session); + cgi_savesession($session); } elsif ($do eq 'prefs') { cgi_prefs($q, $session); } + elsif ($do eq 'create' || $do eq 'edit') { + cgi_editpage($q, $session); + } + elsif (defined $session->param("postsignin") || $do eq 'postsignin') { + cgi_postsignin($q, $session); + } else { error("unknown do parameter"); } } #}}} +# Does not need to be called directly; all errors will go through here. +sub cgierror ($) { #{{{ + my $message=shift; + + print "Content-type: text/html\n\n"; + print misctemplate(gettext("Error"), + "

".gettext("Error").": $message

"); + die $@; +} #}}} + 1