X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/dedbe110f27e77051c8e49e0a53b8cdd148dd752..ea713f002515c3c60c28fc5eb0d70d421093af83:/IkiWiki/CGI.pm diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm index 8734cdd49..f8617bfc6 100644 --- a/IkiWiki/CGI.pm +++ b/IkiWiki/CGI.pm @@ -12,16 +12,17 @@ use Encode; sub printheader ($) { my $session=shift; - if ($config{sslcookie}) { + if ($ENV{HTTPS} || $config{sslcookie}) { print $session->header(-charset => 'utf-8', -cookie => $session->cookie(-httponly => 1, -secure => 1)); - } else { + } + else { print $session->header(-charset => 'utf-8', -cookie => $session->cookie(-httponly => 1)); } } -sub showform ($$$$;@) { +sub prepform { my $form=shift; my $buttons=shift; my $session=shift; @@ -34,13 +35,62 @@ sub showform ($$$$;@) { }); } + return $form; +} + +sub showform ($$$$;@) { + my $form=prepform(@_); + shift; + my $buttons=shift; + my $session=shift; + my $cgi=shift; + printheader($session); - print misctemplate($form->title, $form->render(submit => $buttons), @_); + print cgitemplate($cgi, $form->title, + $form->render(submit => $buttons), @_); +} + +sub cgitemplate ($$$;@) { + my $cgi=shift; + my $title=shift; + my $content=shift; + my %params=@_; + + my $template=template("page.tmpl"); + + my $topurl = defined $cgi ? $cgi->url : $config{url}; + + my $page=""; + if (exists $params{page}) { + $page=delete $params{page}; + $params{forcebaseurl}=urlabs(urlto($page), $topurl); + } + run_hooks(pagetemplate => sub { + shift->( + page => $page, + destpage => $page, + template => $template, + ); + }); + templateactions($template, ""); + + $template->param( + dynamic => 1, + title => $title, + wikiname => $config{wikiname}, + content => $content, + baseurl => urlabs(urlto(""), $topurl), + html5 => $config{html5}, + %params, + ); + + return $template->output; } sub redirect ($$) { my $q=shift; - my $url=shift; + eval q{use URI}; + my $url=URI->new(urlabs(shift, $q->url)); if (! $config{w3mmode}) { print $q->redirect($url); } @@ -51,7 +101,7 @@ sub redirect ($$) { } sub decode_cgi_utf8 ($) { - # decode_form_utf8 method is needed for 5.10 + # decode_form_utf8 method is needed for 5.01 if ($] < 5.01) { my $cgi = shift; foreach my $f ($cgi->param) { @@ -64,8 +114,9 @@ sub decode_form_utf8 ($) { if ($] >= 5.01) { my $form = shift; foreach my $f ($form->field) { + my @value=map { decode_utf8($_) } $form->field($f); $form->field(name => $f, - value => decode_utf8($form->field($f)), + value => \@value, force => 1, ); } @@ -87,9 +138,10 @@ sub needsignin ($$) { } } -sub cgi_signin ($$) { +sub cgi_signin ($$;$) { my $q=shift; my $session=shift; + my $returnhtml=shift; decode_cgi_utf8($q); eval q{use CGI::FormBuilder}; @@ -102,16 +154,13 @@ sub cgi_signin ($$) { required => 'NONE', javascript => 0, params => $q, - action => $config{cgiurl}, + action => cgiurl(), header => 0, template => {type => 'div'}, - stylesheet => baseurl()."style.css", + stylesheet => 1, ); my $buttons=["Login"]; - if ($q->param("do") ne "signin" && !$form->submitted) { - $form->text(gettext("You need to log in first.")); - } $form->field(name => "do", type => "hidden", value => "signin", force => 1); @@ -126,6 +175,11 @@ sub cgi_signin ($$) { $form->validate; } + if ($returnhtml) { + $form=prepform($form, $buttons, $session, $q); + return $form->render(submit => $buttons); + } + showform($form, $buttons, $session, $q); } @@ -142,7 +196,12 @@ sub cgi_postsignin ($$) { exit; } else { - error(gettext("login failed, perhaps you need to turn on cookies?")); + if ($config{sslcookie} && ! $q->https()) { + error(gettext("probable misconfiguration: sslcookie is set, but you are attempting to login via http, not https")); + } + else { + error(gettext("login failed, perhaps you need to turn on cookies?")); + } } } @@ -177,9 +236,9 @@ sub cgi_prefs ($$) { required => 'NONE', javascript => 0, params => $q, - action => $config{cgiurl}, + action => cgiurl(), template => {type => 'div'}, - stylesheet => baseurl()."style.css", + stylesheet => 1, fieldsets => [ [login => gettext("Login")], [preferences => gettext("Preferences")], @@ -210,11 +269,11 @@ sub cgi_prefs ($$) { if ($form->submitted eq 'Logout') { $session->delete(); - redirect($q, $config{url}); + redirect($q, baseurl(undef)); return; } elsif ($form->submitted eq 'Cancel') { - redirect($q, $config{url}); + redirect($q, baseurl(undef)); return; } elsif ($form->submitted eq 'Save Preferences' && $form->validate) { @@ -226,26 +285,57 @@ sub cgi_prefs ($$) { $form->text(gettext("Preferences saved.")); } - showform($form, $buttons, $session, $q); + showform($form, $buttons, $session, $q, + prefsurl => "", # avoid showing the preferences link + ); +} + +sub cgi_custom_failure ($$$) { + my $q=shift; + my $httpstatus=shift; + my $message=shift; + + print $q->header( + -status => $httpstatus, + -charset => 'utf-8', + ); + print $message; + + # Internet Explod^Hrer won't show custom 404 responses + # unless they're >= 512 bytes + print ' ' x 512; + + exit; } sub check_banned ($$) { my $q=shift; my $session=shift; + my $banned=0; my $name=$session->param("name"); - if (defined $name) { - if (grep { $name eq $_ } @{$config{banned_users}}) { - print $q->header(-status => "403 Forbidden"); - $session->delete(); - print gettext("You are banned."); - # Internet Explorer won't show custom 404 responses - # unless they're >= 512 bytes - print " " x 512; - cgi_savesession($session); - exit; + if (defined $name && + grep { $name eq $_ } @{$config{banned_users}}) { + $banned=1; + } + + foreach my $b (@{$config{banned_users}}) { + if (pagespec_match("", $b, + ip => $session->remote_addr(), + name => defined $name ? $name : "", + )) { + $banned=1; + last; } } + + if ($banned) { + $session->delete(); + cgi_savesession($session); + cgi_custom_failure( + $q, "403 Forbidden", + gettext("You are banned.")); + } } sub cgi_getsession ($) { @@ -294,90 +384,6 @@ sub cgi_savesession ($) { umask($oldmask); } -# cgi_goto(CGI, [page]) -# Redirect to a specified page, or display "not found". If not specified, -# the page param from the CGI object is used. -sub cgi_goto ($;$) { - my $q = shift; - my $page = shift; - - if (!defined $page) { - $page = decode_utf8($q->param("page")); - - if (!defined $page) { - error("missing page parameter"); - } - } - - loadindex(); - - # If the page is internal (like a comment), see if it has a - # permalink. Comments do. - if (isinternal($page) && - defined $pagestate{$page}{meta}{permalink}) { - redirect($q, $pagestate{$page}{meta}{permalink}); - } - - my $link = bestlink("", $page); - - if (! length $link) { - print $q->header(-status => "404 Not Found"); - print misctemplate(gettext("missing page"), - "

". - sprintf(gettext("The page %s does not exist."), - htmllink("", "", $page)). - "

". - # Internet Explorer won't show custom 404 responses - # unless they're >= 512 bytes - (" " x 512)); - } - else { - redirect($q, urlto($link, undef, 1)); - } - - exit; -} - -sub cgi_page_from_404 ($$$) { - my $path = shift; - my $baseurl = shift; - my $usedirs = shift; - - # fail if missing from environment or whatever - return undef unless defined $path; - return undef unless defined $baseurl; - - # with usedirs on, path is like /~fred/foo/bar/ or /~fred/foo/bar or - # /~fred/foo/bar/index.html - # with usedirs off, path is like /~fred/foo/bar.html - # baseurl is like 'http://people.example.com/~fred' - - # convert baseurl to ~fred - unless ($baseurl =~ s{^https?://[^/]+/?}{}) { - return undef; - } - - # convert path to /~fred/foo/bar - if ($usedirs) { - $path =~ s/\/*(?:index\.$config{htmlext})?$//; - } - else { - $path =~ s/\.$config{htmlext}$//; - } - - # remove /~fred/ - unless ($path =~ s{^/*\Q$baseurl\E/*}{}) { - return undef; - } - - # special case for the index - unless ($path) { - return 'index'; - } - - return $path; -} - sub cgi (;$$) { my $q=shift; my $session=shift; @@ -405,20 +411,6 @@ sub cgi (;$$) { } } - # goto is the preferred name for this; recentchanges_link and - # commenter are for compatibility with any saved URLs - if ($do eq 'goto' || $do eq 'recentchanges_link' || - $do eq 'commenter') { - my $page = undef; - - if ($ENV{REDIRECT_STATUS} eq '404') { - $page = cgi_page_from_404($ENV{REDIRECT_URL}, - $config{url}, $config{usedirs}); - } - - cgi_goto($q, $page); - } - # Need to lock the wiki before getting a session. lockwiki(); loadindex(); @@ -469,7 +461,7 @@ sub cgierror ($) { my $message=shift; print "Content-type: text/html\n\n"; - print misctemplate(gettext("Error"), + print cgitemplate(undef, gettext("Error"), "

".gettext("Error").": $message

"); die $@; }