X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/dbab5e9b85b04c5ae5b8687b954ff0ae96f1c3f4..7071d0b58667e36f22ddc95cc6602dcb1700438a:/IkiWiki/CGI.pm?ds=sidebyside diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm index 0d010b115..a05043478 100644 --- a/IkiWiki/CGI.pm +++ b/IkiWiki/CGI.pm @@ -1,15 +1,13 @@ #!/usr/bin/perl +package IkiWiki; + use warnings; use strict; use IkiWiki; use IkiWiki::UserInfo; use open qw{:utf8 :std}; use Encode; -use CGI; -$CGI::DISABLE_UPLOADS=1; - -package IkiWiki; sub printheader ($) { #{{{ my $session=shift; @@ -20,7 +18,6 @@ sub printheader ($) { #{{{ } else { print $session->header(-charset => 'utf-8'); } - } #}}} sub showform ($$$$;@) { #{{{ @@ -229,20 +226,27 @@ sub cgi_prefs ($$) { #{{{ $form->field(name => "sid", type => "hidden", value => $session->id, force => 1); $form->field(name => "email", size => 50, fieldset => "preferences"); - $form->field(name => "banned_users", size => 50, - fieldset => "admin"); my $user_name=$session->param("name"); + + # XXX deprecated, should be removed eventually + $form->field(name => "banned_users", size => 50, fieldset => "admin"); if (! is_admin($user_name)) { $form->field(name => "banned_users", type => "hidden"); } - if (! $form->submitted) { $form->field(name => "email", force => 1, value => userinfo_get($user_name, "email")); if (is_admin($user_name)) { - $form->field(name => "banned_users", force => 1, - value => join(" ", get_banned_users())); + my $value=join(" ", get_banned_users()); + if (length $value) { + $form->field(name => "banned_users", force => 1, + value => join(" ", get_banned_users()), + comment => "deprecated; please move to banned_users in setup file"); + } + else { + $form->field(name => "banned_users", type => "hidden"); + } } } @@ -260,12 +264,18 @@ sub cgi_prefs ($$) { #{{{ userinfo_set($user_name, 'email', $form->field('email')) || error("failed to set email"); } + + # XXX deprecated, should be removed eventually if (is_admin($user_name)) { set_banned_users(grep { ! is_admin($_) } split(' ', $form->field("banned_users"))) || error("failed saving changes"); + if (! length $form->field("banned_users")) { + $form->field(name => "banned_users", type => "hidden"); + } } + $form->text(gettext("Preferences saved.")); } @@ -303,12 +313,12 @@ sub cgi_editpage ($$) { #{{{ }); decode_form_utf8($form); - # This untaint is safe because titlepage removes any problematic - # characters. - my ($page)=$form->field('page'); - $page=titlepage(possibly_foolish_untaint($page)); + # This untaint is safe because we check file_pruned. + my $page=$form->field('page'); + $page=possibly_foolish_untaint($page); + my $absolute=($page =~ s#^/+##); if (! defined $page || ! length $page || - file_pruned($page, $config{srcdir}) || $page=~/^\//) { + file_pruned($page, $config{srcdir})) { error("bad page name"); } @@ -356,7 +366,7 @@ sub cgi_editpage ($$) { #{{{ $form->field(name => "from", type => 'hidden'); $form->field(name => "rcsinfo", type => 'hidden'); $form->field(name => "subpage", type => 'hidden'); - $form->field(name => "page", value => pagetitle($page, 1), force => 1); + $form->field(name => "page", value => $page, force => 1); $form->field(name => "type", value => $type, force => 1); $form->field(name => "comments", type => "text", size => 80); $form->field(name => "editcontent", type => "textarea", rows => 20, @@ -418,7 +428,6 @@ sub cgi_editpage ($$) { #{{{ elsif ($form->submitted eq "Save Page") { $form->tmpl_param("page_preview", ""); } - $form->tmpl_param("page_conflict", ""); if ($form->submitted ne "Save Page" || ! $form->validate) { if ($form->field("do") eq "create") { @@ -427,7 +436,8 @@ sub cgi_editpage ($$) { #{{{ if (! defined $from || ! length $from || $from ne $form->field('from') || file_pruned($from, $config{srcdir}) || - $from=~/^\// || + $from=~/^\// || + $absolute || $form->submitted eq "Preview") { @page_locs=$best_loc=$page; } @@ -488,8 +498,8 @@ sub cgi_editpage ($$) { #{{{ $form->tmpl_param("page_select", 1); $form->field(name => "page", type => 'select', - options => [ map { pagetitle($_, 1) } @editable_locs ], - value => pagetitle($best_loc, 1)); + options => [ map { [ $_, pagetitle($_, 1) ] } @editable_locs ], + value => $best_loc); $form->field(name => "type", type => 'select', options => \@page_types); $form->title(sprintf(gettext("creating %s"), pagetitle($page))); @@ -533,7 +543,7 @@ sub cgi_editpage ($$) { #{{{ if ($form->field("do") ne "create" && ! $exists && ! defined srcfile($file, 1)) { - $form->tmpl_param("page_gone", 1); + $form->tmpl_param("message", template("editpagegone.tmpl")->output); $form->field(name => "do", value => "create", force => 1); $form->tmpl_param("page_select", 0); $form->field(name => "page", type => 'hidden'); @@ -543,7 +553,7 @@ sub cgi_editpage ($$) { #{{{ return; } elsif ($form->field("do") eq "create" && $exists) { - $form->tmpl_param("creation_conflict", 1); + $form->tmpl_param("message", template("editcreationconflict.tmpl")->output); $form->field(name => "do", value => "edit", force => 1); $form->tmpl_param("page_select", 0); $form->field(name => "page", type => 'hidden'); @@ -576,8 +586,9 @@ sub cgi_editpage ($$) { #{{{ if ($@) { $form->field(name => "rcsinfo", value => rcs_prepedit($file), force => 1); - $form->tmpl_param("failed_save", 1); - $form->tmpl_param("error_message", $@); + my $mtemplate=template("editfailedsave.tmpl"); + $mtemplate->param(error_message => $@); + $form->tmpl_param("message", $mtemplate->output); $form->field("editcontent", value => $content, force => 1); $form->tmpl_param("page_select", 0); $form->field(name => "page", type => 'hidden'); @@ -621,7 +632,7 @@ sub cgi_editpage ($$) { #{{{ if (defined $conflict) { $form->field(name => "rcsinfo", value => rcs_prepedit($file), force => 1); - $form->tmpl_param("page_conflict", 1); + $form->tmpl_param("message", template("editconflict.tmpl")->output); $form->field("editcontent", value => $conflict, force => 1); $form->field("do", "edit", force => 1); $form->tmpl_param("page_select", 0); @@ -639,6 +650,25 @@ sub cgi_editpage ($$) { #{{{ } } } #}}} + +sub check_banned ($$) { #{{{ + my $q=shift; + my $session=shift; + + my $name=$session->param("name"); + if (defined $name) { + # XXX banned in userinfo is deprecated, should be removed + # eventually, and only banned_users be checked. + if (userinfo_get($session->param("name"), "banned") || + grep { $name eq $_ } @{$config{banned_users}}) { + print $q->header(-status => "403 Forbidden"); + $session->delete(); + print gettext("You are banned."); + cgi_savesession($session); + exit; + } + } +} sub cgi_getsession ($) { #{{{ my $q=shift; @@ -648,8 +678,14 @@ sub cgi_getsession ($) { #{{{ CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname})); my $oldmask=umask(077); - my $session = CGI::Session->new("driver:DB_File", $q, - { FileName => "$config{wikistatedir}/sessions.db" }); + my $session = eval { + CGI::Session->new("driver:DB_File", $q, + { FileName => "$config{wikistatedir}/sessions.db" }) + }; + if (! $session || $@) { + error($@." ".CGI::Session->errstr()); + } + umask($oldmask); return $session; @@ -668,6 +704,10 @@ sub cgi (;$$) { #{{{ my $q=shift; my $session=shift; + eval q{use CGI}; + error($@) if $@; + $CGI::DISABLE_UPLOADS=$config{cgi_disable_uploads}; + if (! $q) { binmode(STDIN); $q=CGI->new; @@ -713,14 +753,8 @@ sub cgi (;$$) { #{{{ } } - if (defined $session->param("name") && - userinfo_get($session->param("name"), "banned")) { - print $q->header(-status => "403 Forbidden"); - $session->delete(); - print gettext("You are banned."); - cgi_savesession($session); - } - + check_banned($q, $session); + run_hooks(sessioncgi => sub { shift->($q, $session) }); if ($do eq 'signin') { @@ -741,4 +775,14 @@ sub cgi (;$$) { #{{{ } } #}}} +# Does not need to be called directly; all errors will go through here. +sub cgierror ($) { #{{{ + my $message=shift; + + print "Content-type: text/html\n\n"; + print misctemplate(gettext("Error"), + "

".gettext("Error").": $message

"); + die $@; +} #}}} + 1