X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/8c8ce06a1b267a5c5d0b1a4f2b229b6d15e63b71..35668b87d3247a7de6c4dbb9edd7e0d909603524:/IkiWiki/CGI.pm?ds=sidebyside diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm index b1f770b05..d805506aa 100644 --- a/IkiWiki/CGI.pm +++ b/IkiWiki/CGI.pm @@ -1,5 +1,7 @@ #!/usr/bin/perl +package IkiWiki; + use warnings; use strict; use IkiWiki; @@ -7,8 +9,6 @@ use IkiWiki::UserInfo; use open qw{:utf8 :std}; use Encode; -package IkiWiki; - sub printheader ($) { #{{{ my $session=shift; @@ -21,6 +21,23 @@ sub printheader ($) { #{{{ } #}}} +sub showform ($$$$;@) { #{{{ + my $form=shift; + my $buttons=shift; + my $session=shift; + my $cgi=shift; + + if (exists $hooks{formbuilder}) { + run_hooks(formbuilder => sub { + shift->(form => $form, cgi => $cgi, session => $session, + buttons => $buttons); + }); + } + + printheader($session); + print misctemplate($form->title, $form->render(submit => $buttons), @_); +} + sub redirect ($$) { #{{{ my $q=shift; my $url=shift; @@ -33,95 +50,80 @@ sub redirect ($$) { #{{{ } } #}}} -sub page_locked ($$;$) { #{{{ +sub check_canedit ($$$;$) { #{{{ my $page=shift; + my $q=shift; my $session=shift; my $nonfatal=shift; - my $user=$session->param("name"); - return if defined $user && is_admin($user); - - foreach my $admin (@{$config{adminuser}}) { - my $locked_pages=userinfo_get($admin, "locked_pages"); - if (pagespec_match($page, userinfo_get($admin, "locked_pages"))) { - return 1 if $nonfatal; - - #translators: The first parameter is a page name, - #translators: second is the user who locked it. - error(sprintf(gettext("%s is locked by %s and cannot be edited"), - htmllink("", "", $page, 1), - userlink($admin))); + my $canedit; + run_hooks(canedit => sub { + return if defined $canedit; + my $ret=shift->($page, $q, $session); + if (defined $ret) { + if ($ret eq "") { + $canedit=1; + } + elsif (ref $ret eq 'CODE') { + $ret->() unless $nonfatal; + $canedit=0; + } + elsif (defined $ret) { + error($ret) unless $nonfatal; + $canedit=0; + } } - } + }); + return $canedit; +} #}}} - return 0; +sub decode_cgi_utf8 ($) { #{{{ + # decode_form_utf8 method is needed for 5.10 + if ($] < 5.01) { + my $cgi = shift; + foreach my $f ($cgi->param) { + $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f)); + } + } } #}}} sub decode_form_utf8 ($) { #{{{ - my $form = shift; - foreach my $f ($form->field) { - next if Encode::is_utf8(scalar $form->field($f)); - $form->field(name => $f, - value => decode_utf8($form->field($f)), - force => 1, - ); + if ($] >= 5.01) { + my $form = shift; + foreach my $f ($form->field) { + $form->field(name => $f, + value => decode_utf8($form->field($f)), + force => 1, + ); + } } } #}}} -sub cgi_recentchanges ($) { #{{{ +# Check if the user is signed in. If not, redirect to the signin form and +# save their place to return to later. +sub needsignin ($$) { #{{{ my $q=shift; - - # Optimisation: building recentchanges means calculating lots of - # links. Memoizing htmllink speeds it up a lot (can't be memoized - # during page builds as the return values may change, but they - # won't here.) - eval q{use Memoize}; - error($@) if $@; - memoize("htmllink"); - - eval q{use Time::Duration}; - error($@) if $@; - - my $changelog=[rcs_recentchanges(100)]; - foreach my $change (@$changelog) { - $change->{when} = concise(ago($change->{when})); - - $change->{user} = userlink($change->{user}); + my $session=shift; - my $is_excess = exists $change->{pages}[10]; # limit pages to first 10 - delete @{$change->{pages}}[10 .. @{$change->{pages}}] if $is_excess; - $change->{pages} = [ - map { - $_->{link} = htmllink("", "", $_->{page}, 1); - $_; - } @{$change->{pages}} - ]; - push @{$change->{pages}}, { link => '...' } if $is_excess; + if (! defined $session->param("name") || + ! userinfo_get($session->param("name"), "regdate")) { + $session->param(postsignin => $ENV{QUERY_STRING}); + cgi_signin($q, $session); + cgi_savesession($session); + exit; } - - my $template=template("recentchanges.tmpl"); - $template->param( - title => "RecentChanges", - indexlink => indexlink(), - wikiname => $config{wikiname}, - changelog => $changelog, - baseurl => baseurl(), - ); - run_hooks(pagetemplate => sub { - shift->(page => "", destpage => "", template => $template); - }); - print $q->header(-charset => 'utf-8'), $template->output; -} #}}} +} #}}} sub cgi_signin ($$) { #{{{ my $q=shift; my $session=shift; + decode_cgi_utf8($q); eval q{use CGI::FormBuilder}; error($@) if $@; my $form = CGI::FormBuilder->new( title => "signin", - header => 1, + name => "signin", charset => "utf-8", method => 'POST', required => 'NONE', @@ -129,45 +131,37 @@ sub cgi_signin ($$) { #{{{ params => $q, action => $config{cgiurl}, header => 0, - template => scalar template_params("signin.tmpl"), + template => {type => 'div'}, stylesheet => baseurl()."style.css", ); my $buttons=["Login"]; - $form->field(name => "do", type => "hidden"); - if ($q->param("do") ne "signin" && !$form->submitted) { $form->text(gettext("You need to log in first.")); } + $form->field(name => "do", type => "hidden", value => "signin", + force => 1); + decode_form_utf8($form); run_hooks(formbuilder_setup => sub { - shift->(form => $form, cgi => $q, session => $session); + shift->(form => $form, cgi => $q, session => $session, + buttons => $buttons); }); - decode_form_utf8($form); - if (exists $hooks{formbuilder}) { - run_hooks(formbuilder => sub { - shift->(form => $form, cgi => $q, session => $session, - buttons => $buttons); - }); - } - else { - if ($form->submitted) { - $form->validate; - } - printheader($session); - print misctemplate($form->title, $form->render(submit => $buttons)); + if ($form->submitted) { + $form->validate; } + + showform($form, $buttons, $session, $q); } #}}} sub cgi_postsignin ($$) { #{{{ my $q=shift; my $session=shift; - + # Continue with whatever was being done before the signin process. - if (defined $q->param("do") && $q->param("do") ne "signin" && - defined $session->param("postsignin")) { + if (defined $session->param("postsignin")) { my $postsignin=CGI->new($session->param("postsignin")); $session->clear("postsignin"); cgi($postsignin, $session); @@ -175,7 +169,7 @@ sub cgi_postsignin ($$) { #{{{ exit; } else { - redirect($q, $config{url}); + error(gettext("login failed, perhaps you need to turn on cookies?")); } } #}}} @@ -183,10 +177,24 @@ sub cgi_prefs ($$) { #{{{ my $q=shift; my $session=shift; + needsignin($q, $session); + decode_cgi_utf8($q); + + # The session id is stored on the form and checked to + # guard against CSRF. + my $sid=$q->param('sid'); + if (! defined $sid) { + $q->delete_all; + } + elsif ($sid ne $session->id) { + error(gettext("Your login session has expired.")); + } + eval q{use CGI::FormBuilder}; error($@) if $@; my $form = CGI::FormBuilder->new( title => "preferences", + name => "preferences", header => 0, charset => "utf-8", method => 'POST', @@ -197,44 +205,45 @@ sub cgi_prefs ($$) { #{{{ javascript => 0, params => $q, action => $config{cgiurl}, - template => scalar template_params("prefs.tmpl"), + template => {type => 'div'}, stylesheet => baseurl()."style.css", + fieldsets => [ + [login => gettext("Login")], + [preferences => gettext("Preferences")], + [admin => gettext("Admin")] + ], ); my $buttons=["Save Preferences", "Logout", "Cancel"]; - + + decode_form_utf8($form); run_hooks(formbuilder_setup => sub { - shift->(form => $form, cgi => $q, session => $session); + shift->(form => $form, cgi => $q, session => $session, + buttons => $buttons); }); + decode_form_utf8($form); - $form->field(name => "do", type => "hidden"); - $form->field(name => "email", size => 50); - $form->field(name => "subscriptions", size => 50, - comment => "(".htmllink("", "", "PageSpec", 1).")"); - $form->field(name => "locked_pages", size => 50, - comment => "(".htmllink("", "", "PageSpec", 1).")"); - $form->field(name => "banned_users", size => 50); + $form->field(name => "do", type => "hidden", value => "prefs", + force => 1); + $form->field(name => "sid", type => "hidden", value => $session->id, + force => 1); + $form->field(name => "email", size => 50, fieldset => "preferences"); + $form->field(name => "banned_users", size => 50, + fieldset => "admin"); my $user_name=$session->param("name"); if (! is_admin($user_name)) { - $form->field(name => "locked_pages", type => "hidden"); $form->field(name => "banned_users", type => "hidden"); } if (! $form->submitted) { $form->field(name => "email", force => 1, value => userinfo_get($user_name, "email")); - $form->field(name => "subscriptions", force => 1, - value => userinfo_get($user_name, "subscriptions")); - $form->field(name => "locked_pages", force => 1, - value => userinfo_get($user_name, "locked_pages")); if (is_admin($user_name)) { $form->field(name => "banned_users", force => 1, value => join(" ", get_banned_users())); } } - decode_form_utf8($form); - if ($form->submitted eq 'Logout') { $session->delete(); redirect($q, $config{url}); @@ -245,68 +254,63 @@ sub cgi_prefs ($$) { #{{{ return; } elsif ($form->submitted eq 'Save Preferences' && $form->validate) { - foreach my $field (qw(email subscriptions locked_pages)) { - if (defined $form->field($field) && length $form->field($field)) { - userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field"); - } + if (defined $form->field('email')) { + userinfo_set($user_name, 'email', $form->field('email')) || + error("failed to set email"); } if (is_admin($user_name)) { set_banned_users(grep { ! is_admin($_) } - split(' ', $form->field("banned_users"))); + split(' ', + $form->field("banned_users"))) || + error("failed saving changes"); } $form->text(gettext("Preferences saved.")); } - if (exists $hooks{formbuilder}) { - run_hooks(formbuilder => sub { - shift->(form => $form, cgi => $q, session => $session, - buttons => $buttons); - }); - } - else { - printheader($session); - print misctemplate($form->title, $form->render(submit => $buttons)); - } + showform($form, $buttons, $session, $q); } #}}} sub cgi_editpage ($$) { #{{{ my $q=shift; my $session=shift; + + decode_cgi_utf8($q); my @fields=qw(do rcsinfo subpage from page type editcontent comments); my @buttons=("Save Page", "Preview", "Cancel"); - eval q{use CGI::FormBuilder}; error($@) if $@; my $form = CGI::FormBuilder->new( fields => \@fields, - header => 1, charset => "utf-8", method => 'POST', - validate => { - editcontent => '/.+/', - }, required => [qw{editcontent}], javascript => 0, params => $q, action => $config{cgiurl}, + header => 0, table => 0, template => scalar template_params("editpage.tmpl"), + wikiname => $config{wikiname}, ); + decode_form_utf8($form); run_hooks(formbuilder_setup => sub { - shift->(form => $form, cgi => $q, session => $session); + shift->(form => $form, cgi => $q, session => $session, + buttons => \@buttons); }); - decode_form_utf8($form); - # This untaint is safe because titlepage removes any problematic - # characters. - my ($page)=$form->field('page'); - $page=titlepage(possibly_foolish_untaint($page)); - if (! defined $page || ! length $page || file_pruned($page, $config{srcdir}) || $page=~/^\//) { + # This untaint is safe because we check file_pruned. + my $page=$form->field('page'); + $page=possibly_foolish_untaint($page); + my $absolute=($page =~ s#^/+##); + if (! defined $page || ! length $page || + file_pruned($page, $config{srcdir})) { error("bad page name"); } + + my $baseurl=$config{url}."/".htmlpage($page); my $from; if (defined $form->field('from')) { @@ -315,29 +319,38 @@ sub cgi_editpage ($$) { #{{{ my $file; my $type; - if (exists $pagesources{$page}) { + if (exists $pagesources{$page} && $form->field("do") ne "create") { $file=$pagesources{$page}; $type=pagetype($file); + if (! defined $type || $type=~/^_/) { + error(sprintf(gettext("%s is not an editable page"), $page)); + } + if (! $form->submitted) { + $form->field(name => "rcsinfo", + value => rcs_prepedit($file), force => 1); + } + $form->field(name => "editcontent", validate => '/.*/'); } else { $type=$form->param('type'); if (defined $type && length $type && $hooks{htmlize}{$type}) { $type=possibly_foolish_untaint($type); } - elsif (defined $from) { + elsif (defined $from && exists $pagesources{$from}) { # favor the type of linking page $type=pagetype($pagesources{$from}); } $type=$config{default_pageext} unless defined $type; $file=$page.".".$type; - } - - my $newfile=0; - if (! -e "$config{srcdir}/$file") { - $newfile=1; + if (! $form->submitted) { + $form->field(name => "rcsinfo", value => "", force => 1); + } + $form->field(name => "editcontent", validate => '/.+/'); } $form->field(name => "do", type => 'hidden'); + $form->field(name => "sid", type => "hidden", value => $session->id, + force => 1); $form->field(name => "from", type => 'hidden'); $form->field(name => "rcsinfo", type => 'hidden'); $form->field(name => "subpage", type => 'hidden'); @@ -349,18 +362,15 @@ sub cgi_editpage ($$) { #{{{ $form->tmpl_param("can_commit", $config{rcs}); $form->tmpl_param("indexlink", indexlink()); $form->tmpl_param("helponformattinglink", - htmllink("", "", "HelpOnFormatting", 1)); - $form->tmpl_param("baseurl", baseurl()); - if (! $form->submitted) { - $form->field(name => "rcsinfo", value => rcs_prepedit($file), - force => 1); - } + htmllink($page, $page, "ikiwiki/formatting", + noimageinline => 1, + linktext => "FormattingHelp")); if ($form->submitted eq "Cancel") { - if ($newfile && defined $from) { + if ($form->field("do") eq "create" && defined $from) { redirect($q, "$config{url}/".htmlpage($from)); } - elsif ($newfile) { + elsif ($form->field("do") eq "create") { redirect($q, $config{url}); } else { @@ -369,33 +379,54 @@ sub cgi_editpage ($$) { #{{{ return; } elsif ($form->submitted eq "Preview") { + my $new=not exists $pagesources{$page}; + if ($new) { + # temporarily record its type + $pagesources{$page}=$page.".".$type; + } + my $content=$form->field('editcontent'); - my $comments=$form->field('comments'); - $form->field(name => "editcontent", - value => $content, force => 1); - $form->field(name => "comments", - value => $comments, force => 1); - $config{rss}=$config{atom}=0; # avoid preview writing a feed! - $form->tmpl_param("page_preview", - htmlize($page, $type, - linkify($page, "", + + run_hooks(editcontent => sub { + $content=shift->( + content => $content, + page => $page, + cgi => $q, + session => $session, + ); + }); + my $preview=htmlize($page, $page, $type, + linkify($page, $page, preprocess($page, $page, - filter($page, $content))))); + filter($page, $page, $content), 0, 1))); + run_hooks(format => sub { + $preview=shift->( + page => $page, + content => $preview, + ); + }); + $form->tmpl_param("page_preview", $preview); + + if ($new) { + delete $pagesources{$page}; + } + # previewing may have created files on disk + saveindex(); } - else { + elsif ($form->submitted eq "Save Page") { $form->tmpl_param("page_preview", ""); } $form->tmpl_param("page_conflict", ""); - if (! $form->submitted || $form->submitted eq "Preview" || - ! $form->validate) { + if ($form->submitted ne "Save Page" || ! $form->validate) { if ($form->field("do") eq "create") { my @page_locs; my $best_loc; if (! defined $from || ! length $from || $from ne $form->field('from') || file_pruned($from, $config{srcdir}) || - $from=~/^\// || + $from=~/^\// || + $absolute || $form->submitted eq "Preview") { @page_locs=$best_loc=$page; } @@ -417,36 +448,54 @@ sub cgi_editpage ($$) { #{{{ $dir=~s![^/]+/+$!!; push @page_locs, $dir.$page; } + + push @page_locs, "$config{userdir}/$page" + if length $config{userdir}; } - push @page_locs, "$config{userdir}/$page" - if length $config{userdir}; @page_locs = grep { - ! exists $pagecase{lc $_} && - ! page_locked($_, $session, 1) + ! exists $pagecase{lc $_} } @page_locs; - if (! @page_locs) { # hmm, someone else made the page in the # meantime? - redirect($q, "$config{url}/".htmlpage($page)); - return; + if ($form->submitted eq "Preview") { + # let them go ahead with the edit + # and resolve the conflict at save + # time + @page_locs=$page; + } + else { + redirect($q, "$config{url}/".htmlpage($page)); + return; + } + } + + my @editable_locs = grep { + check_canedit($_, $q, $session, 1) + } @page_locs; + if (! @editable_locs) { + # let it throw an error this time + map { check_canedit($_, $q, $session) } @page_locs; } my @page_types; if (exists $hooks{htmlize}) { - @page_types=keys %{$hooks{htmlize}}; + @page_types=grep { !/^_/ } + keys %{$hooks{htmlize}}; } $form->tmpl_param("page_select", 1); $form->field(name => "page", type => 'select', - options => \@page_locs, value => $best_loc); + options => [ map { [ $_, pagetitle($_, 1) ] } @editable_locs ], + value => $best_loc); $form->field(name => "type", type => 'select', options => \@page_types); $form->title(sprintf(gettext("creating %s"), pagetitle($page))); + } elsif ($form->field("do") eq "edit") { - page_locked($page, $session); + check_canedit($page, $q, $session); if (! defined $form->field('editcontent') || ! length $form->field('editcontent')) { my $content=""; @@ -463,18 +512,82 @@ sub cgi_editpage ($$) { #{{{ $form->title(sprintf(gettext("editing %s"), pagetitle($page))); } - print $form->render(submit => \@buttons); + showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl); } else { # save page - page_locked($page, $session); + check_canedit($page, $q, $session); + + # The session id is stored on the form and checked to + # guard against CSRF. But only if the user is logged in, + # as anonok can allow anonymous edits. + if (defined $session->param("name")) { + my $sid=$q->param('sid'); + if (! defined $sid || $sid ne $session->id) { + error(gettext("Your login session has expired.")); + } + } + + my $exists=-e "$config{srcdir}/$file"; + + if ($form->field("do") ne "create" && ! $exists && + ! defined srcfile($file, 1)) { + $form->tmpl_param("page_gone", 1); + $form->field(name => "do", value => "create", force => 1); + $form->tmpl_param("page_select", 0); + $form->field(name => "page", type => 'hidden'); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), $page)); + showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl); + return; + } + elsif ($form->field("do") eq "create" && $exists) { + $form->tmpl_param("creation_conflict", 1); + $form->field(name => "do", value => "edit", force => 1); + $form->tmpl_param("page_select", 0); + $form->field(name => "page", type => 'hidden'); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), $page)); + $form->field("editcontent", + value => readfile("$config{srcdir}/$file"). + "\n\n\n".$form->field("editcontent"), + force => 1); + showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl); + return; + } my $content=$form->field('editcontent'); - + run_hooks(editcontent => sub { + $content=shift->( + content => $content, + page => $page, + cgi => $q, + session => $session, + ); + }); $content=~s/\r\n/\n/g; $content=~s/\r/\n/g; - writefile($file, $config{srcdir}, $content); + $content.="\n" if $content !~ /\n$/; + + $config{cgi}=0; # avoid cgi error message + eval { writefile($file, $config{srcdir}, $content) }; + $config{cgi}=1; + if ($@) { + $form->field(name => "rcsinfo", value => rcs_prepedit($file), + force => 1); + $form->tmpl_param("failed_save", 1); + $form->tmpl_param("error_message", $@); + $form->field("editcontent", value => $content, force => 1); + $form->tmpl_param("page_select", 0); + $form->field(name => "page", type => 'hidden'); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), $page)); + showform($form, \@buttons, $session, $q, + forcebaseurl => $baseurl); + return; + } + my $conflict; if ($config{rcs}) { my $message=""; if (defined $form->field('comments') && @@ -482,41 +595,47 @@ sub cgi_editpage ($$) { #{{{ $message=$form->field('comments'); } - if ($newfile) { + if (! $exists) { rcs_add($file); } - # prevent deadlock with post-commit hook - unlockwiki(); - # presumably the commit will trigger an update - # of the wiki - my $conflict=rcs_commit($file, $message, + + # Prevent deadlock with post-commit hook by + # signaling to it that it should not try to + # do anything. + disable_commit_hook(); + $conflict=rcs_commit($file, $message, $form->field("rcsinfo"), $session->param("name"), $ENV{REMOTE_ADDR}); + enable_commit_hook(); + rcs_update(); + } - if (defined $conflict) { - $form->field(name => "rcsinfo", value => rcs_prepedit($file), - force => 1); - $form->tmpl_param("page_conflict", 1); - $form->field("editcontent", value => $conflict, force => 1); - $form->field(name => "comments", value => $form->field('comments'), force => 1); - $form->field("do", "edit)"); - $form->tmpl_param("page_select", 0); - $form->field(name => "page", type => 'hidden'); - $form->field(name => "type", type => 'hidden'); - $form->title(sprintf(gettext("editing %s"), $page)); - print $form->render(submit => \@buttons); - return; - } + # Refresh even if there was a conflict, since other changes + # may have been committed while the post-commit hook was + # disabled. + require IkiWiki::Render; + refresh(); + saveindex(); + + if (defined $conflict) { + $form->field(name => "rcsinfo", value => rcs_prepedit($file), + force => 1); + $form->tmpl_param("page_conflict", 1); + $form->field("editcontent", value => $conflict, force => 1); + $form->field("do", "edit", force => 1); + $form->tmpl_param("page_select", 0); + $form->field(name => "page", type => 'hidden'); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), $page)); + showform($form, \@buttons, $session, $q, + forcebaseurl => $baseurl); + return; } else { - require IkiWiki::Render; - refresh(); - saveindex(); + # The trailing question mark tries to avoid broken + # caches and get the most recent version of the page. + redirect($q, "$config{url}/".htmlpage($page)."?updated"); } - - # The trailing question mark tries to avoid broken - # caches and get the most recent version of the page. - redirect($q, "$config{url}/".htmlpage($page)."?updated"); } } #}}} @@ -524,11 +643,18 @@ sub cgi_getsession ($) { #{{{ my $q=shift; eval q{use CGI::Session}; + error($@) if $@; CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname})); my $oldmask=umask(077); - my $session = CGI::Session->new("driver:DB_File", $q, - { FileName => "$config{wikistatedir}/sessions.db" }); + my $session = eval { + CGI::Session->new("driver:DB_File", $q, + { FileName => "$config{wikistatedir}/sessions.db" }) + }; + if (! $session || $@) { + error($@." ".CGI::Session->errstr()); + } + umask($oldmask); return $session; @@ -541,17 +667,20 @@ sub cgi_savesession ($) { #{{{ my $oldmask=umask(077); $session->flush; umask($oldmask); -} +} #}}} sub cgi (;$$) { #{{{ my $q=shift; my $session=shift; + eval q{use CGI}; + error($@) if $@; + $CGI::DISABLE_UPLOADS=$config{cgi_disable_uploads}; + if (! $q) { - eval q{use CGI}; - error($@) if $@; - + binmode(STDIN); $q=CGI->new; + binmode(STDIN, ":utf8"); run_hooks(cgi => sub { shift->($q) }); } @@ -567,17 +696,9 @@ sub cgi (;$$) { #{{{ } } - # Things that do not need a session. - if ($do eq 'recentchanges') { - cgi_recentchanges($q); - return; - } - elsif ($do eq 'hyperestraier') { - cgi_hyperestraier(); - } - # Need to lock the wiki before getting a session. lockwiki(); + loadindex(); if (! $session) { $session=cgi_getsession($q); @@ -596,87 +717,47 @@ sub cgi (;$$) { #{{{ email => "", password => "", regdate => time, - }); + }) || error("failed adding user"); } } } - - # Everything below this point needs the user to be signed in. - if (((! $config{anonok} || $do eq 'prefs') && - (! defined $session->param("name") || - ! userinfo_get($session->param("name"), "regdate"))) - || $do eq 'signin') { - if ($do ne 'signin' && ! defined $session->param("postsignin")) { - $session->param(postsignin => $ENV{QUERY_STRING}); - } - cgi_signin($q, $session); - cgi_savesession($session); - return; - } - elsif (defined $session->param("postsignin")) { - cgi_postsignin($q, $session); - } - - if (defined $session->param("name") && userinfo_get($session->param("name"), "banned")) { + + if (defined $session->param("name") && + userinfo_get($session->param("name"), "banned")) { print $q->header(-status => "403 Forbidden"); $session->delete(); print gettext("You are banned."); cgi_savesession($session); - exit; } - - if ($do eq 'create' || $do eq 'edit') { - cgi_editpage($q, $session); + + run_hooks(sessioncgi => sub { shift->($q, $session) }); + + if ($do eq 'signin') { + cgi_signin($q, $session); + cgi_savesession($session); } elsif ($do eq 'prefs') { cgi_prefs($q, $session); } - elsif ($do eq 'blog') { - my $page=titlepage(decode_utf8($q->param('title'))); - $page=~s/(\/)/"__".ord($1)."__"/eg; # escape slashes too - # if the page already exists, munge it to be unique - my $from=$q->param('from'); - my $add=""; - while (exists $pagecase{lc "$from/$page$add"}) { - $add=1 unless length $add; - $add++; - } - $q->param('page', $page.$add); - # now run same as create - $q->param('do', 'create'); + elsif ($do eq 'create' || $do eq 'edit') { cgi_editpage($q, $session); } + elsif (defined $session->param("postsignin") || $do eq 'postsignin') { + cgi_postsignin($q, $session); + } else { error("unknown do parameter"); } } #}}} -sub userlink ($) { #{{{ - my $user=shift; +# Does not need tobe called directly; all errors will go through here. +sub cgierror ($) { #{{{ + my $message=shift; - eval q{use CGI 'escapeHTML'}; - error($@) if $@; - if ($user =~ m!^https?://! && - eval q{use Net::OpenID::VerifiedIdentity; 1} && !$@) { - # Munge user-urls, as used by eg, OpenID. - my $oid=Net::OpenID::VerifiedIdentity->new(identity => $user); - my $display=$oid->display; - # Convert "user.somehost.com" to "user [somehost.com]". - if ($display !~ /\[/) { - $display=~s/^(.*?)\.([^.]+\.[a-z]+)$/$1 [$2]/; - } - # Convert "http://somehost.com/user" to "user [somehost.com]". - if ($display !~ /\[/) { - $display=~s/^https?:\/\/(.+)\/([^\/]+)$/$2 [$1]/; - } - $display=~s!^https?://!!; # make sure this is removed - return "".escapeHTML($display).""; - } - else { - return htmllink("", "", escapeHTML( - length $config{userdir} ? $config{userdir}."/".$user : $user - ), 1); - } + print "Content-type: text/html\n\n"; + print misctemplate(gettext("Error"), + "

".gettext("Error").": $message

"); + die $@; } #}}} 1