IkiWiki/CGI.pm

   1 #!/usr/bin/perl
   2
   3 package IkiWiki;
   4
   5 use warnings;
   6 use strict;
   7 use IkiWiki;
   8 use IkiWiki::UserInfo;
   9 use open qw{:utf8 :std};
  10 use Encode;
  11
  12 sub printheader ($) { #{{{
  13         my $session=shift;
  14
  15         if ($config{sslcookie}) {
  16                 print $session->header(-charset => 'utf-8',
  17                         -cookie => $session->cookie(-secure => 1));
  18         } else {
  19                 print $session->header(-charset => 'utf-8');
  20         }
  21 } #}}}
  22
  23 sub showform ($$$$;@) { #{{{
  24         my $form=shift;
  25         my $buttons=shift;
  26         my $session=shift;
  27         my $cgi=shift;
  28
  29         if (exists $hooks{formbuilder}) {
  30                 run_hooks(formbuilder => sub {
  31                         shift->(form => $form, cgi => $cgi, session => $session,
  32                                 buttons => $buttons);
  33                 });
  34         }
  35
  36         printheader($session);
  37         print misctemplate($form->title, $form->render(submit => $buttons), @_);
  38 }
  39
  40 sub redirect ($$) { #{{{
  41         my $q=shift;
  42         my $url=shift;
  43         if (! $config{w3mmode}) {
  44                 print $q->redirect($url);
  45         }
  46         else {
  47                 print "Content-type: text/plain\n";
  48                 print "W3m-control: GOTO $url\n\n";
  49         }
  50 } #}}}
  51
  52 sub check_canedit ($$$;$) { #{{{
  53         my $page=shift;
  54         my $q=shift;
  55         my $session=shift;
  56         my $nonfatal=shift;
  57
  58         my $canedit;
  59         run_hooks(canedit => sub {
  60                 return if defined $canedit;
  61                 my $ret=shift->($page, $q, $session);
  62                 if (defined $ret) {
  63                         if ($ret eq "") {
  64                                 $canedit=1;
  65                         }
  66                         elsif (ref $ret eq 'CODE') {
  67                                 $ret->() unless $nonfatal;
  68                                 $canedit=0;
  69                         }
  70                         elsif (defined $ret) {
  71                                 error($ret) unless $nonfatal;
  72                                 $canedit=0;
  73                         }
  74                 }
  75         });
  76         return $canedit;
  77 } #}}}
  78
  79 sub decode_cgi_utf8 ($) { #{{{
  80         # decode_form_utf8 method is needed for 5.10
  81         if ($] < 5.01) {
  82                 my $cgi = shift;
  83                 foreach my $f ($cgi->param) {
  84                         $cgi->param($f, map { decode_utf8 $_ } $cgi->param($f));
  85                 }
  86         }
  87 } #}}}
  88
  89 sub decode_form_utf8 ($) { #{{{
  90         if ($] >= 5.01) {
  91                 my $form = shift;
  92                 foreach my $f ($form->field) {
  93                         $form->field(name  => $f,
  94                                      value => decode_utf8($form->field($f)),
  95                                      force => 1,
  96                         );
  97                 }
  98         }
  99 } #}}}
 100
 101 # Check if the user is signed in. If not, redirect to the signin form and
 102 # save their place to return to later.
 103 sub needsignin ($$) { #{{{
 104         my $q=shift;
 105         my $session=shift;
 106
 107         if (! defined $session->param("name") ||
 108             ! userinfo_get($session->param("name"), "regdate")) {
 109                 $session->param(postsignin => $ENV{QUERY_STRING});
 110                 cgi_signin($q, $session);
 111                 cgi_savesession($session);
 112                 exit;
 113         }
 114 } #}}}
 115
 116 sub cgi_signin ($$) { #{{{
 117         my $q=shift;
 118         my $session=shift;
 119
 120         decode_cgi_utf8($q);
 121         eval q{use CGI::FormBuilder};
 122         error($@) if $@;
 123         my $form = CGI::FormBuilder->new(
 124                 title => "signin",
 125                 name => "signin",
 126                 charset => "utf-8",
 127                 method => 'POST',
 128                 required => 'NONE',
 129                 javascript => 0,
 130                 params => $q,
 131                 action => $config{cgiurl},
 132                 header => 0,
 133                 template => {type => 'div'},
 134                 stylesheet => baseurl()."style.css",
 135         );
 136         my $buttons=["Login"];
 137
 138         if ($q->param("do") ne "signin" && !$form->submitted) {
 139                 $form->text(gettext("You need to log in first."));
 140         }
 141         $form->field(name => "do", type => "hidden", value => "signin",
 142                 force => 1);
 143
 144         decode_form_utf8($form);
 145         run_hooks(formbuilder_setup => sub {
 146                 shift->(form => $form, cgi => $q, session => $session,
 147                         buttons => $buttons);
 148         });
 149         decode_form_utf8($form);
 150
 151         if ($form->submitted) {
 152                 $form->validate;
 153         }
 154
 155         showform($form, $buttons, $session, $q);
 156 } #}}}
 157
 158 sub cgi_postsignin ($$) { #{{{
 159         my $q=shift;
 160         my $session=shift;
 161
 162         # Continue with whatever was being done before the signin process.
 163         if (defined $session->param("postsignin")) {
 164                 my $postsignin=CGI->new($session->param("postsignin"));
 165                 $session->clear("postsignin");
 166                 cgi($postsignin, $session);
 167                 cgi_savesession($session);
 168                 exit;
 169         }
 170         else {
 171                 error(gettext("login failed, perhaps you need to turn on cookies?"));
 172         }
 173 } #}}}
 174
 175 sub cgi_prefs ($$) { #{{{
 176         my $q=shift;
 177         my $session=shift;
 178
 179         needsignin($q, $session);
 180         decode_cgi_utf8($q);
 181
 182         # The session id is stored on the form and checked to
 183         # guard against CSRF.
 184         my $sid=$q->param('sid');
 185         if (! defined $sid) {
 186                 $q->delete_all;
 187         }
 188         elsif ($sid ne $session->id) {
 189                 error(gettext("Your login session has expired."));
 190         }
 191
 192         eval q{use CGI::FormBuilder};
 193         error($@) if $@;
 194         my $form = CGI::FormBuilder->new(
 195                 title => "preferences",
 196                 name => "preferences",
 197                 header => 0,
 198                 charset => "utf-8",
 199                 method => 'POST',
 200                 validate => {
 201                         email => 'EMAIL',
 202                 },
 203                 required => 'NONE',
 204                 javascript => 0,
 205                 params => $q,
 206                 action => $config{cgiurl},
 207                 template => {type => 'div'},
 208                 stylesheet => baseurl()."style.css",
 209                 fieldsets => [
 210                         [login => gettext("Login")],
 211                         [preferences => gettext("Preferences")],
 212                         [admin => gettext("Admin")]
 213                 ],
 214         );
 215         my $buttons=["Save Preferences", "Logout", "Cancel"];
 216
 217         decode_form_utf8($form);
 218         run_hooks(formbuilder_setup => sub {
 219                 shift->(form => $form, cgi => $q, session => $session,
 220                         buttons => $buttons);
 221         });
 222         decode_form_utf8($form);
 223
 224         $form->field(name => "do", type => "hidden", value => "prefs",
 225                 force => 1);
 226         $form->field(name => "sid", type => "hidden", value => $session->id,
 227                 force => 1);
 228         $form->field(name => "email", size => 50, fieldset => "preferences");
 229
 230         my $user_name=$session->param("name");
 231
 232         # XXX deprecated, should be removed eventually
 233         $form->field(name => "banned_users", size => 50, fieldset => "admin");
 234         if (! is_admin($user_name)) {
 235                 $form->field(name => "banned_users", type => "hidden");
 236         }
 237         if (! $form->submitted) {
 238                 $form->field(name => "email", force => 1,
 239                         value => userinfo_get($user_name, "email"));
 240                 if (is_admin($user_name)) {
 241                         my $value=join(" ", get_banned_users());
 242                         if (length $value) {
 243                                 $form->field(name => "banned_users", force => 1,
 244                                         value => join(" ", get_banned_users()),
 245                                         comment => "deprecated; please move to banned_users in setup file");
 246                         }
 247                         else {
 248                                 $form->field(name => "banned_users", type => "hidden");
 249                         }
 250                 }
 251         }
 252
 253         if ($form->submitted eq 'Logout') {
 254                 $session->delete();
 255                 redirect($q, $config{url});
 256                 return;
 257         }
 258         elsif ($form->submitted eq 'Cancel') {
 259                 redirect($q, $config{url});
 260                 return;
 261         }
 262         elsif ($form->submitted eq 'Save Preferences' && $form->validate) {
 263                 if (defined $form->field('email')) {
 264                         userinfo_set($user_name, 'email', $form->field('email')) ||
 265                                 error("failed to set email");
 266                 }
 267
 268                 # XXX deprecated, should be removed eventually
 269                 if (is_admin($user_name)) {
 270                         set_banned_users(grep { ! is_admin($_) }
 271                                         split(' ',
 272                                                 $form->field("banned_users"))) ||
 273                                 error("failed saving changes");
 274                         if (! length $form->field("banned_users")) {
 275                                 $form->field(name => "banned_users", type => "hidden");
 276                         }
 277                 }
 278
 279                 $form->text(gettext("Preferences saved."));
 280         }
 281
 282         showform($form, $buttons, $session, $q);
 283 } #}}}
 284
 285 sub cgi_editpage ($$) { #{{{
 286         my $q=shift;
 287         my $session=shift;
 288
 289         decode_cgi_utf8($q);
 290
 291         my @fields=qw(do rcsinfo subpage from page type editcontent comments);
 292         my @buttons=("Save Page", "Preview", "Cancel");
 293         eval q{use CGI::FormBuilder};
 294         error($@) if $@;
 295         my $form = CGI::FormBuilder->new(
 296                 fields => \@fields,
 297                 charset => "utf-8",
 298                 method => 'POST',
 299                 required => [qw{editcontent}],
 300                 javascript => 0,
 301                 params => $q,
 302                 action => $config{cgiurl},
 303                 header => 0,
 304                 table => 0,
 305                 template => scalar template_params("editpage.tmpl"),
 306                 wikiname => $config{wikiname},
 307         );
 308
 309         decode_form_utf8($form);
 310         run_hooks(formbuilder_setup => sub {
 311                 shift->(form => $form, cgi => $q, session => $session,
 312                         buttons => \@buttons);
 313         });
 314         decode_form_utf8($form);
 315
 316         # This untaint is safe because we check file_pruned.
 317         my $page=$form->field('page');
 318         $page=possibly_foolish_untaint($page);
 319         my $absolute=($page =~ s#^/+##);
 320         if (! defined $page || ! length $page ||
 321             file_pruned($page, $config{srcdir})) {
 322                 error("bad page name");
 323         }
 324
 325         my $baseurl=$config{url}."/".htmlpage($page);
 326
 327         my $from;
 328         if (defined $form->field('from')) {
 329                 ($from)=$form->field('from')=~/$config{wiki_file_regexp}/;
 330         }
 331
 332         my $file;
 333         my $type;
 334         if (exists $pagesources{$page} && $form->field("do") ne "create") {
 335                 $file=$pagesources{$page};
 336                 $type=pagetype($file);
 337                 if (! defined $type || $type=~/^_/) {
 338                         error(sprintf(gettext("%s is not an editable page"), $page));
 339                 }
 340                 if (! $form->submitted) {
 341                         $form->field(name => "rcsinfo",
 342                                 value => rcs_prepedit($file), force => 1);
 343                 }
 344                 $form->field(name => "editcontent", validate => '/.*/');
 345         }
 346         else {
 347                 $type=$form->param('type');
 348                 if (defined $type && length $type && $hooks{htmlize}{$type}) {
 349                         $type=possibly_foolish_untaint($type);
 350                 }
 351                 elsif (defined $from && exists $pagesources{$from}) {
 352                         # favor the type of linking page
 353                         $type=pagetype($pagesources{$from});
 354                 }
 355                 $type=$config{default_pageext} unless defined $type;
 356                 $file=$page.".".$type;
 357                 if (! $form->submitted) {
 358                         $form->field(name => "rcsinfo", value => "", force => 1);
 359                 }
 360                 $form->field(name => "editcontent", validate => '/.+/');
 361         }
 362
 363         $form->field(name => "do", type => 'hidden');
 364         $form->field(name => "sid", type => "hidden", value => $session->id,
 365                 force => 1);
 366         $form->field(name => "from", type => 'hidden');
 367         $form->field(name => "rcsinfo", type => 'hidden');
 368         $form->field(name => "subpage", type => 'hidden');
 369         $form->field(name => "page", value => $page, force => 1);
 370         $form->field(name => "type", value => $type, force => 1);
 371         $form->field(name => "comments", type => "text", size => 80);
 372         $form->field(name => "editcontent", type => "textarea", rows => 20,
 373                 cols => 80);
 374         $form->tmpl_param("can_commit", $config{rcs});
 375         $form->tmpl_param("indexlink", indexlink());
 376         $form->tmpl_param("helponformattinglink",
 377                 htmllink($page, $page, "ikiwiki/formatting",
 378                         noimageinline => 1,
 379                         linktext => "FormattingHelp"));
 380
 381         if ($form->submitted eq "Cancel") {
 382                 if ($form->field("do") eq "create" && defined $from) {
 383                         redirect($q, "$config{url}/".htmlpage($from));
 384                 }
 385                 elsif ($form->field("do") eq "create") {
 386                         redirect($q, $config{url});
 387                 }
 388                 else {
 389                         redirect($q, "$config{url}/".htmlpage($page));
 390                 }
 391                 return;
 392         }
 393         elsif ($form->submitted eq "Preview") {
 394                 my $new=not exists $pagesources{$page};
 395                 if ($new) {
 396                         # temporarily record its type
 397                         $pagesources{$page}=$page.".".$type;
 398                 }
 399
 400                 my $content=$form->field('editcontent');
 401
 402                 run_hooks(editcontent => sub {
 403                         $content=shift->(
 404                                 content => $content,
 405                                 page => $page,
 406                                 cgi => $q,
 407                                 session => $session,
 408                         );
 409                 });
 410                 my $preview=htmlize($page, $page, $type,
 411                         linkify($page, $page,
 412                         preprocess($page, $page,
 413                         filter($page, $page, $content), 0, 1)));
 414                 run_hooks(format => sub {
 415                         $preview=shift->(
 416                                 page => $page,
 417                                 content => $preview,
 418                         );
 419                 });
 420                 $form->tmpl_param("page_preview", $preview);
 421
 422                 if ($new) {
 423                         delete $pagesources{$page};
 424                 }
 425                 # previewing may have created files on disk
 426                 saveindex();
 427         }
 428         elsif ($form->submitted eq "Save Page") {
 429                 $form->tmpl_param("page_preview", "");
 430         }
 431
 432         if ($form->submitted ne "Save Page" || ! $form->validate) {
 433                 if ($form->field("do") eq "create") {
 434                         my @page_locs;
 435                         my $best_loc;
 436                         if (! defined $from || ! length $from ||
 437                             $from ne $form->field('from') ||
 438                             file_pruned($from, $config{srcdir}) ||
 439                             $from=~/^\// ||
 440                             $absolute ||
 441                             $form->submitted eq "Preview") {
 442                                 @page_locs=$best_loc=$page;
 443                         }
 444                         else {
 445                                 my $dir=$from."/";
 446                                 $dir=~s![^/]+/+$!!;
 447
 448                                 if ((defined $form->field('subpage') && length $form->field('subpage')) ||
 449                                     $page eq gettext('discussion')) {
 450                                         $best_loc="$from/$page";
 451                                 }
 452                                 else {
 453                                         $best_loc=$dir.$page;
 454                                 }
 455
 456                                 push @page_locs, $dir.$page;
 457                                 push @page_locs, "$from/$page";
 458                                 while (length $dir) {
 459                                         $dir=~s![^/]+/+$!!;
 460                                         push @page_locs, $dir.$page;
 461                                 }
 462
 463                                 push @page_locs, "$config{userdir}/$page"
 464                                         if length $config{userdir};
 465                         }
 466
 467                         @page_locs = grep {
 468                                 ! exists $pagecase{lc $_}
 469                         } @page_locs;
 470                         if (! @page_locs) {
 471                                 # hmm, someone else made the page in the
 472                                 # meantime?
 473                                 if ($form->submitted eq "Preview") {
 474                                         # let them go ahead with the edit
 475                                         # and resolve the conflict at save
 476                                         # time
 477                                         @page_locs=$page;
 478                                 }
 479                                 else {
 480                                         redirect($q, "$config{url}/".htmlpage($page));
 481                                         return;
 482                                 }
 483                         }
 484
 485                         my @editable_locs = grep {
 486                                 check_canedit($_, $q, $session, 1)
 487                         } @page_locs;
 488                         if (! @editable_locs) {
 489                                 # let it throw an error this time
 490                                 map { check_canedit($_, $q, $session) } @page_locs;
 491                         }
 492
 493                         my @page_types;
 494                         if (exists $hooks{htmlize}) {
 495                                 @page_types=grep { !/^_/ }
 496                                         keys %{$hooks{htmlize}};
 497                         }
 498
 499                         $form->tmpl_param("page_select", 1);
 500                         $form->field(name => "page", type => 'select',
 501                                 options => [ map { [ $_, pagetitle($_, 1) ] } @editable_locs ],
 502                                 value => $best_loc);
 503                         $form->field(name => "type", type => 'select',
 504                                 options => \@page_types);
 505                         $form->title(sprintf(gettext("creating %s"), pagetitle($page)));
 506
 507                 }
 508                 elsif ($form->field("do") eq "edit") {
 509                         check_canedit($page, $q, $session);
 510                         if (! defined $form->field('editcontent') ||
 511                             ! length $form->field('editcontent')) {
 512                                 my $content="";
 513                                 if (exists $pagesources{$page}) {
 514                                         $content=readfile(srcfile($pagesources{$page}));
 515                                         $content=~s/\n/\r\n/g;
 516                                 }
 517                                 $form->field(name => "editcontent", value => $content,
 518                                         force => 1);
 519                         }
 520                         $form->tmpl_param("page_select", 0);
 521                         $form->field(name => "page", type => 'hidden');
 522                         $form->field(name => "type", type => 'hidden');
 523                         $form->title(sprintf(gettext("editing %s"), pagetitle($page)));
 524                 }
 525
 526                 showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
 527         }
 528         else {
 529                 # save page
 530                 check_canedit($page, $q, $session);
 531
 532                 # The session id is stored on the form and checked to
 533                 # guard against CSRF. But only if the user is logged in,
 534                 # as anonok can allow anonymous edits.
 535                 if (defined $session->param("name")) {
 536                         my $sid=$q->param('sid');
 537                         if (! defined $sid || $sid ne $session->id) {
 538                                 error(gettext("Your login session has expired."));
 539                         }
 540                 }
 541
 542                 my $exists=-e "$config{srcdir}/$file";
 543
 544                 if ($form->field("do") ne "create" && ! $exists &&
 545                     ! defined srcfile($file, 1)) {
 546                         $form->tmpl_param("message", template("editpagegone.tmpl")->output);
 547                         $form->field(name => "do", value => "create", force => 1);
 548                         $form->tmpl_param("page_select", 0);
 549                         $form->field(name => "page", type => 'hidden');
 550                         $form->field(name => "type", type => 'hidden');
 551                         $form->title(sprintf(gettext("editing %s"), $page));
 552                         showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
 553                         return;
 554                 }
 555                 elsif ($form->field("do") eq "create" && $exists) {
 556                         $form->tmpl_param("message", template("editcreationconflict.tmpl")->output);
 557                         $form->field(name => "do", value => "edit", force => 1);
 558                         $form->tmpl_param("page_select", 0);
 559                         $form->field(name => "page", type => 'hidden');
 560                         $form->field(name => "type", type => 'hidden');
 561                         $form->title(sprintf(gettext("editing %s"), $page));
 562                         $form->field("editcontent",
 563                                 value => readfile("$config{srcdir}/$file").
 564                                          "\n\n\n".$form->field("editcontent"),
 565                                 force => 1);
 566                         showform($form, \@buttons, $session, $q, forcebaseurl => $baseurl);
 567                         return;
 568                 }
 569
 570                 my $content=$form->field('editcontent');
 571                 run_hooks(editcontent => sub {
 572                         $content=shift->(
 573                                 content => $content,
 574                                 page => $page,
 575                                 cgi => $q,
 576                                 session => $session,
 577                         );
 578                 });
 579                 $content=~s/\r\n/\n/g;
 580                 $content=~s/\r/\n/g;
 581                 $content.="\n" if $content !~ /\n$/;
 582
 583                 $config{cgi}=0; # avoid cgi error message
 584                 eval { writefile($file, $config{srcdir}, $content) };
 585                 $config{cgi}=1;
 586                 if ($@) {
 587                         $form->field(name => "rcsinfo", value => rcs_prepedit($file),
 588                                 force => 1);
 589                         my $mtemplate=template("editfailedsave.tmpl");
 590                         $mtemplate->param(error_message => $@);
 591                         $form->tmpl_param("message", $mtemplate->output);
 592                         $form->field("editcontent", value => $content, force => 1);
 593                         $form->tmpl_param("page_select", 0);
 594                         $form->field(name => "page", type => 'hidden');
 595                         $form->field(name => "type", type => 'hidden');
 596                         $form->title(sprintf(gettext("editing %s"), $page));
 597                         showform($form, \@buttons, $session, $q,
 598                                 forcebaseurl => $baseurl);
 599                         return;
 600                 }
 601
 602                 my $conflict;
 603                 if ($config{rcs}) {
 604                         my $message="";
 605                         if (defined $form->field('comments') &&
 606                             length $form->field('comments')) {
 607                                 $message=$form->field('comments');
 608                         }
 609
 610                         if (! $exists) {
 611                                 rcs_add($file);
 612                         }
 613
 614                         # Prevent deadlock with post-commit hook by
 615                         # signaling to it that it should not try to
 616                         # do anything.
 617                         disable_commit_hook();
 618                         $conflict=rcs_commit($file, $message,
 619                                 $form->field("rcsinfo"),
 620                                 $session->param("name"), $ENV{REMOTE_ADDR});
 621                         enable_commit_hook();
 622                         rcs_update();
 623                 }
 624
 625                 # Refresh even if there was a conflict, since other changes
 626                 # may have been committed while the post-commit hook was
 627                 # disabled.
 628                 require IkiWiki::Render;
 629                 refresh();
 630                 saveindex();
 631
 632                 if (defined $conflict) {
 633                         $form->field(name => "rcsinfo", value => rcs_prepedit($file),
 634                                 force => 1);
 635                         $form->tmpl_param("message", template("editconflict.tmpl")->output);
 636                         $form->field("editcontent", value => $conflict, force => 1);
 637                         $form->field("do", "edit", force => 1);
 638                         $form->tmpl_param("page_select", 0);
 639                         $form->field(name => "page", type => 'hidden');
 640                         $form->field(name => "type", type => 'hidden');
 641                         $form->title(sprintf(gettext("editing %s"), $page));
 642                         showform($form, \@buttons, $session, $q,
 643                                 forcebaseurl => $baseurl);
 644                         return;
 645                 }
 646                 else {
 647                         # The trailing question mark tries to avoid broken
 648                         # caches and get the most recent version of the page.
 649                         redirect($q, "$config{url}/".htmlpage($page)."?updated");
 650                 }
 651         }
 652 } #}}}
 653
 654 sub check_banned ($$) { #{{{
 655         my $q=shift;
 656         my $session=shift;
 657
 658         my $name=$session->param("name");
 659         if (defined $name) {
 660                 # XXX banned in userinfo is deprecated, should be removed
 661                 # eventually, and only banned_users be checked.
 662                 if (userinfo_get($session->param("name"), "banned") ||
 663                     grep { $name eq $_ } @{$config{banned_users}}) {
 664                         print $q->header(-status => "403 Forbidden");
 665                         $session->delete();
 666                         print gettext("You are banned.");
 667                         cgi_savesession($session);
 668                         exit;
 669                 }
 670         }
 671 }
 672
 673 sub cgi_getsession ($) { #{{{
 674         my $q=shift;
 675
 676         eval q{use CGI::Session};
 677         error($@) if $@;
 678         CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname}));
 679
 680         my $oldmask=umask(077);
 681         my $session = eval {
 682                 CGI::Session->new("driver:DB_File", $q,
 683                         { FileName => "$config{wikistatedir}/sessions.db" })
 684         };
 685         if (! $session || $@) {
 686                 error($@." ".CGI::Session->errstr());
 687         }
 688
 689         umask($oldmask);
 690
 691         return $session;
 692 } #}}}
 693
 694 sub cgi_savesession ($) { #{{{
 695         my $session=shift;
 696
 697         # Force session flush with safe umask.
 698         my $oldmask=umask(077);
 699         $session->flush;
 700         umask($oldmask);
 701 } #}}}
 702
 703 sub cgi (;$$) { #{{{
 704         my $q=shift;
 705         my $session=shift;
 706
 707         eval q{use CGI};
 708         error($@) if $@;
 709         $CGI::DISABLE_UPLOADS=$config{cgi_disable_uploads};
 710
 711         if (! $q) {
 712                 binmode(STDIN);
 713                 $q=CGI->new;
 714                 binmode(STDIN, ":utf8");
 715
 716                 run_hooks(cgi => sub { shift->($q) });
 717         }
 718
 719         my $do=$q->param('do');
 720         if (! defined $do || ! length $do) {
 721                 my $error = $q->cgi_error;
 722                 if ($error) {
 723                         error("Request not processed: $error");
 724                 }
 725                 else {
 726                         error("\"do\" parameter missing");
 727                 }
 728         }
 729
 730         # Need to lock the wiki before getting a session.
 731         lockwiki();
 732         loadindex();
 733
 734         if (! $session) {
 735                 $session=cgi_getsession($q);
 736         }
 737
 738         # Auth hooks can sign a user in.
 739         if ($do ne 'signin' && ! defined $session->param("name")) {
 740                 run_hooks(auth => sub {
 741                         shift->($q, $session)
 742                 });
 743                 if (defined $session->param("name")) {
 744                         # Make sure whatever user was authed is in the
 745                         # userinfo db.
 746                         if (! userinfo_get($session->param("name"), "regdate")) {
 747                                 userinfo_setall($session->param("name"), {
 748                                         email => "",
 749                                         password => "",
 750                                         regdate => time,
 751                                 }) || error("failed adding user");
 752                         }
 753                 }
 754         }
 755
 756         check_banned($q, $session);
 757
 758         run_hooks(sessioncgi => sub { shift->($q, $session) });
 759
 760         if ($do eq 'signin') {
 761                 cgi_signin($q, $session);
 762                 cgi_savesession($session);
 763         }
 764         elsif ($do eq 'prefs') {
 765                 cgi_prefs($q, $session);
 766         }
 767         elsif ($do eq 'create' || $do eq 'edit') {
 768                 cgi_editpage($q, $session);
 769         }
 770         elsif (defined $session->param("postsignin") || $do eq 'postsignin') {
 771                 cgi_postsignin($q, $session);
 772         }
 773         else {
 774                 error("unknown do parameter");
 775         }
 776 } #}}}
 777
 778 # Does not need tobe called directly; all errors will go through here.
 779 sub cgierror ($) { #{{{
 780         my $message=shift;
 781
 782         print "Content-type: text/html\n\n";
 783         print misctemplate(gettext("Error"),
 784                 "<p class=\"error\">".gettext("Error").": $message</p>");
 785         die $@;
 786 } #}}}
 787
 788 1