9 use open qw{:utf8 :std};
15 if ($config{sslcookie}) {
16 print $session->header(-charset => 'utf-8',
17 -cookie => $session->cookie(-httponly => 1, -secure => 1));
19 print $session->header(-charset => 'utf-8',
20 -cookie => $session->cookie(-httponly => 1));
24 sub showform ($$$$;@) {
30 if (exists $hooks{formbuilder}) {
31 run_hooks(formbuilder => sub {
32 shift->(form => $form, cgi => $cgi, session => $session,
37 printheader($session);
38 print misctemplate($form->title, $form->render(submit => $buttons), @_);
44 if (! $config{w3mmode}) {
45 print $q->redirect($url);
48 print "Content-type: text/plain\n";
49 print "W3m-control: GOTO $url\n\n";
53 sub decode_cgi_utf8 ($) {
54 # decode_form_utf8 method is needed for 5.10
57 foreach my $f ($cgi->param) {
58 $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
63 sub decode_form_utf8 ($) {
66 foreach my $f ($form->field) {
67 $form->field(name => $f,
68 value => decode_utf8($form->field($f)),
75 # Check if the user is signed in. If not, redirect to the signin form and
76 # save their place to return to later.
81 if (! defined $session->param("name") ||
82 ! userinfo_get($session->param("name"), "regdate")) {
83 $session->param(postsignin => $ENV{QUERY_STRING});
84 cgi_signin($q, $session);
85 cgi_savesession($session);
95 eval q{use CGI::FormBuilder};
97 my $form = CGI::FormBuilder->new(
105 action => $config{cgiurl},
107 template => {type => 'div'},
108 stylesheet => baseurl()."style.css",
110 # MITLOGIN: These should be restored when logins are allowed again.
111 #my $buttons=["Login"];
114 if ($q->param("do") ne "signin" && !$form->submitted) {
115 #$form->text(gettext("You need to log in first."));
117 "You must have an MIT personal certificate to edit");
119 $form->field(name => "do", type => "hidden", value => "signin",
122 decode_form_utf8($form);
123 run_hooks(formbuilder_setup => sub {
124 shift->(form => $form, cgi => $q, session => $session,
125 buttons => $buttons);
127 decode_form_utf8($form);
129 if ($form->submitted) {
133 showform($form, $buttons, $session, $q);
136 sub cgi_postsignin ($$) {
140 # Continue with whatever was being done before the signin process.
141 if (defined $session->param("postsignin")) {
142 my $postsignin=CGI->new($session->param("postsignin"));
143 $session->clear("postsignin");
144 cgi($postsignin, $session);
145 cgi_savesession($session);
149 error(gettext("login failed, perhaps you need to turn on cookies?"));
157 needsignin($q, $session);
160 # The session id is stored on the form and checked to
161 # guard against CSRF.
162 my $sid=$q->param('sid');
163 if (! defined $sid) {
166 elsif ($sid ne $session->id) {
167 error(gettext("Your login session has expired."));
170 eval q{use CGI::FormBuilder};
172 my $form = CGI::FormBuilder->new(
173 title => "preferences",
174 name => "preferences",
184 action => $config{cgiurl},
185 template => {type => 'div'},
186 stylesheet => baseurl()."style.css",
188 [login => gettext("Login")],
189 [preferences => gettext("Preferences")],
190 [admin => gettext("Admin")]
193 my $buttons=["Save Preferences", "Logout", "Cancel"];
195 decode_form_utf8($form);
196 run_hooks(formbuilder_setup => sub {
197 shift->(form => $form, cgi => $q, session => $session,
198 buttons => $buttons);
200 decode_form_utf8($form);
202 $form->field(name => "do", type => "hidden", value => "prefs",
204 $form->field(name => "sid", type => "hidden", value => $session->id,
206 #$form->field(name => "email", size => 50, fieldset => "preferences");
207 $form->field(name => "realname", size => 50, fieldset => "preferences");
209 my $user_name=$session->param("name");
211 if (! $form->submitted) {
212 #$form->field(name => "email", force => 1,
213 #value => userinfo_get($user_name, "email"));
214 $form->field(name => "realname", force => 1,
215 value => userinfo_get($user_name, "realname"));
218 if ($form->submitted eq 'Logout') {
220 redirect($q, $config{url});
223 elsif ($form->submitted eq 'Cancel') {
224 redirect($q, $config{url});
227 elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
228 if (defined $form->field('email')) {
229 userinfo_set($user_name, 'email', $form->field('email')) ||
230 error("failed to set email");
232 if (defined $form->field('realname')) {
233 userinfo_set($user_name, 'realname', $form->field('realname')) ||
234 error("failed to set realname");
236 $form->text(gettext("Preferences saved."));
239 showform($form, $buttons, $session, $q);
242 sub check_banned ($$) {
246 my $name=$session->param("name");
248 if (grep { $name eq $_ } @{$config{banned_users}}) {
249 print $q->header(-status => "403 Forbidden");
251 print gettext("You are banned.");
252 cgi_savesession($session);
258 sub cgi_getsession ($) {
261 eval q{use CGI::Session; use HTML::Entities};
263 CGI::Session->name("ikiwiki_session_".encode_entities($config{wikiname}));
265 my $oldmask=umask(077);
267 CGI::Session->new("driver:DB_File", $q,
268 { FileName => "$config{wikistatedir}/sessions.db" })
270 if (! $session || $@) {
271 error($@." ".CGI::Session->errstr());
279 # To guard against CSRF, the user's session id (sid)
280 # can be stored on a form. This function will check
281 # (for logged in users) that the sid on the form matches
282 # the session id in the cookie.
283 sub checksessionexpiry ($$) {
287 if (defined $session->param("name")) {
288 my $sid=$q->param('sid');
289 if (! defined $sid || $sid ne $session->id) {
290 error(gettext("Your login session has expired."));
295 sub cgi_savesession ($) {
298 # Force session flush with safe umask.
299 my $oldmask=umask(077);
310 $CGI::DISABLE_UPLOADS=$config{cgi_disable_uploads};
315 binmode(STDIN, ":utf8");
317 run_hooks(cgi => sub { shift->($q) });
320 my $do=$q->param('do');
321 if (! defined $do || ! length $do) {
322 my $error = $q->cgi_error;
324 error("Request not processed: $error");
327 error("\"do\" parameter missing");
331 # Need to lock the wiki before getting a session.
336 $session=cgi_getsession($q);
339 # Auth hooks can sign a user in.
340 if ($do ne 'signin' && ! defined $session->param("name")) {
341 run_hooks(auth => sub {
342 shift->($q, $session)
344 if (defined $session->param("name")) {
345 # Make sure whatever user was authed is in the
347 if (! userinfo_get($session->param("name"), "regdate")) {
348 userinfo_setall($session->param("name"), {
352 }) || error("failed adding user");
357 check_banned($q, $session);
359 run_hooks(sessioncgi => sub { shift->($q, $session) });
361 if ($do eq 'signin') {
362 cgi_signin($q, $session);
363 cgi_savesession($session);
365 elsif ($do eq 'prefs') {
366 cgi_prefs($q, $session);
368 elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
369 cgi_postsignin($q, $session);
372 error("unknown do parameter");
376 # Does not need to be called directly; all errors will go through here.
380 print "Content-type: text/html\n\n";
381 print misctemplate(gettext("Error"),
382 "<p class=\"error\">".gettext("Error").": $message</p>");