X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/f5bdfc29ee32446fcad4ad2ccc82e109445f4755..44d82285aebca88fe1bfcd4635fd600377f77c3c:/doc/bugs/anonok_vs._httpauth.mdwn?ds=sidebyside diff --git a/doc/bugs/anonok_vs._httpauth.mdwn b/doc/bugs/anonok_vs._httpauth.mdwn index 66a68032f..bff37e18b 100644 --- a/doc/bugs/anonok_vs._httpauth.mdwn +++ b/doc/bugs/anonok_vs._httpauth.mdwn @@ -36,12 +36,83 @@ and a whitelist of OpenIDs in `locked_pages`...) >>> would never see the Signin form. --[[Joey]] >>>> Would I be able to do what I want with a local plugin that ->>>> knows my auth requirements and abuses canedit -- e.g., if the page ->>>> matches */Discussion, redirect to Signin form, else httpauth? --[[schmonz]] - ->>>>> If you wanted users to need to login with openid or passwordauth ->>>>> for discussion pages, you could do that. That seems it would be ->>>>> annoying for httpauth users (who were not current authed) though, ->>>>> as they would then see the openid signin form. ->>>>> +>>>> abuses canedit (and auth) to reach in and call the appropriate +>>>> plugin's auth method -- e.g., if the page matches */Discussion, +>>>> call `openid:auth()`, else `httpauth:auth()`? --[[schmonz]] + +>>>>> That seems it would be +>>>>> annoying for httpauth users (who were not currently authed), +>>>>> as they would then see the openid signin form when going to edit a +>>>>> Discussion page. >>>>> --[[Joey]] + +>>>>>> I finally see the problem, I think. When you initially +>>>>>> suggested "a link they could follow to bounce through the +>>>>>> cgiauthurl", presumably this could _be_ the Edit link for +>>>>>> non-Discussion pages, so that the typical case of an httpauth +>>>>>> user editing an editable-only-by-httpauth page doesn't visibly +>>>>>> change. And then the Edit link for Discussion subpages could do +>>>>>> as you suggest, adding one click for the httpauth user, who won't +>>>>>> often need to edit those subpages. --[[schmonz]] + +>> On reflection, I've stopped being bothered by the +>> redirect-to-signin-page approach. (It only needs to happen once per +>> browser session, anyway.) Can we try that? --[[schmonz]] + +Here is an attempt. With this httpauth will only redirect to the +`cgiauth_url` when a page is edited, and it will defer to other plugins +like anonok first. I have not tested this. --[[Joey]] + +
+diff --git a/IkiWiki/Plugin/httpauth.pm b/IkiWiki/Plugin/httpauth.pm
+index 127c321..a18f8ca 100644
+--- a/IkiWiki/Plugin/httpauth.pm
++++ b/IkiWiki/Plugin/httpauth.pm
+@@ -9,6 +9,8 @@ use IkiWiki 3.00;
+ sub import {
+ 	hook(type => "getsetup", id => "httpauth", call => \&getsetup);
+ 	hook(type => "auth", id => "httpauth", call => \&auth);
++	hook(type => "canedit", id => "httpauth", call => \&canedit,
++		last => 1);
+ }
+ 
+ sub getsetup () {
+@@ -33,9 +35,21 @@ sub auth ($$) {
+ 	if (defined $cgi->remote_user()) {
+ 		$session->param("name", $cgi->remote_user());
+ 	}
+-	elsif (defined $config{cgiauthurl}) {
+-		IkiWiki::redirect($cgi, $config{cgiauthurl}.'?'.$cgi->query_string());
+-		exit;
++}
++
++sub canedit ($$$) {
++	my $page=shift;
++	my $cgi=shift;
++	my $session=shift;
++
++	if (! defined $cgi->remote_user() && defined $config{cgiauthurl}) {
++		return sub {
++			IkiWiki::redirect($cgi, $config{cgiauthurl}.'?'.$cgi->query_string());
++			exit;
++		};
++	}
++	else {
++		return undef;
+ 	}
+ }
+ 
+
+ +> With `anonok` enabled, this works for anonymous editing of an +> existing Discussion page. auth is still needed to create one. --[[schmonz]] + +>> Refreshed above patch to fix that. --[[Joey]] + +>> Remaining issue: This patch will work with anonok, but not openid or +>> passwordauth, both of which want to display a login page at the same +>> time that httpauth is redirecting to the cgiauthurl. As mentioned above, +>> the only way to deal with that would be to add a link to the signin page +>> that does the httpauth signin. --[[Joey]] + +>>> That's dealt with in final version. [[done]] --[[Joey]]