IkiWiki/CGI.pm

   1 #!/usr/bin/perl
   2
   3 use warnings;
   4 use strict;
   5 use IkiWiki;
   6 use IkiWiki::UserInfo;
   7 use encoding 'utf8'; # force use of utf8 for io layer
   8
   9 package IkiWiki;
  10
  11 sub page_locked ($$;$) { #{{{
  12         my $page=shift;
  13         my $session=shift;
  14         my $nonfatal=shift;
  15
  16         my $user=$session->param("name");
  17         return if defined $user && is_admin($user);
  18
  19         foreach my $admin (@{$config{adminuser}}) {
  20                 my $locked_pages=userinfo_get($admin, "locked_pages");
  21                 if (globlist_match($page, userinfo_get($admin, "locked_pages"))) {
  22                         return 1 if $nonfatal;
  23                         error(htmllink("", "", $page, 1)." is locked by ".
  24                               htmllink("", "", $admin, 1)." and cannot be edited.");
  25                 }
  26         }
  27
  28         return 0;
  29 } #}}}
  30
  31 sub cgi_recentchanges ($) { #{{{
  32         my $q=shift;
  33
  34         unlockwiki();
  35
  36         # Force reading the template as utf-8, necessary if
  37         # rcs_recentchanges returns true utf-8 strings.
  38         open(TMPL, "<:utf8", "$config{templatedir}/recentchanges.tmpl");
  39         my $template=HTML::Template->new(filehandle => *TMPL);
  40         close(TMPL);
  41         my $template=HTML::Template->new(
  42                 filename => "$config{templatedir}/recentchanges.tmpl"
  43         );
  44         $template->param(
  45                 title => "RecentChanges",
  46                 indexlink => indexlink(),
  47                 wikiname => $config{wikiname},
  48                 changelog => [rcs_recentchanges(100)],
  49                 styleurl => styleurl(),
  50                 baseurl => "$config{url}/",
  51         );
  52         print $q->header(-charset=>'utf-8'), $template->output;
  53 } #}}}
  54
  55 sub cgi_signin ($$) { #{{{
  56         my $q=shift;
  57         my $session=shift;
  58
  59         eval q{use CGI::FormBuilder};
  60         my $form = CGI::FormBuilder->new(
  61                 title => "signin",
  62                 fields => [qw(do title page subpage from name password confirm_password email)],
  63                 header => 1,
  64                 charset => "utf-8",
  65                 method => 'POST',
  66                 validate => {
  67                         confirm_password => {
  68                                 perl => q{eq $form->field("password")},
  69                         },
  70                         email => 'EMAIL',
  71                 },
  72                 required => 'NONE',
  73                 javascript => 0,
  74                 params => $q,
  75                 action => $config{cgiurl},
  76                 header => 0,
  77                 template => (-e "$config{templatedir}/signin.tmpl" ?
  78                               "$config{templatedir}/signin.tmpl" : ""),
  79                 stylesheet => styleurl(),
  80         );
  81
  82         $form->field(name => "name", required => 0);
  83         $form->field(name => "do", type => "hidden");
  84         $form->field(name => "page", type => "hidden");
  85         $form->field(name => "title", type => "hidden");
  86         $form->field(name => "from", type => "hidden");
  87         $form->field(name => "subpage", type => "hidden");
  88         $form->field(name => "password", type => "password", required => 0);
  89         $form->field(name => "confirm_password", type => "password", required => 0);
  90         $form->field(name => "email", required => 0);
  91         if ($q->param("do") ne "signin") {
  92                 $form->text("You need to log in first.");
  93         }
  94
  95         if ($form->submitted) {
  96                 # Set required fields based on how form was submitted.
  97                 my %required=(
  98                         "Login" => [qw(name password)],
  99                         "Register" => [qw(name password confirm_password email)],
 100                         "Mail Password" => [qw(name)],
 101                 );
 102                 foreach my $opt (@{$required{$form->submitted}}) {
 103                         $form->field(name => $opt, required => 1);
 104                 }
 105
 106                 # Validate password differently depending on how
 107                 # form was submitted.
 108                 if ($form->submitted eq 'Login') {
 109                         $form->field(
 110                                 name => "password",
 111                                 validate => sub {
 112                                         length $form->field("name") &&
 113                                         shift eq userinfo_get($form->field("name"), 'password');
 114                                 },
 115                         );
 116                         $form->field(name => "name", validate => '/^\w+$/');
 117                 }
 118                 else {
 119                         $form->field(name => "password", validate => 'VALUE');
 120                 }
 121                 # And make sure the entered name exists when logging
 122                 # in or sending email, and does not when registering.
 123                 if ($form->submitted eq 'Register') {
 124                         $form->field(
 125                                 name => "name",
 126                                 validate => sub {
 127                                         my $name=shift;
 128                                         length $name &&
 129                                         $name=~/$config{wiki_file_regexp}/ &&
 130                                         ! userinfo_get($name, "regdate");
 131                                 },
 132                         );
 133                 }
 134                 else {
 135                         $form->field(
 136                                 name => "name",
 137                                 validate => sub {
 138                                         my $name=shift;
 139                                         length $name &&
 140                                         userinfo_get($name, "regdate");
 141                                 },
 142                         );
 143                 }
 144         }
 145         else {
 146                 # First time settings.
 147                 $form->field(name => "name", comment => "use FirstnameLastName");
 148                 $form->field(name => "confirm_password", comment => "(only needed");
 149                 $form->field(name => "email",            comment => "for registration)");
 150                 if ($session->param("name")) {
 151                         $form->field(name => "name", value => $session->param("name"));
 152                 }
 153         }
 154
 155         if ($form->submitted && $form->validate) {
 156                 if ($form->submitted eq 'Login') {
 157                         $session->param("name", $form->field("name"));
 158                         if (defined $form->field("do") &&
 159                             $form->field("do") ne 'signin') {
 160                                 print $q->redirect(cgiurl(
 161                                         do => $form->field("do"),
 162                                         page => $form->field("page"),
 163                                         title => $form->field("title"),
 164                                         subpage => $form->field("subpage"),
 165                                         from => $form->field("from"),
 166                                 ));
 167                         }
 168                         else {
 169                                 print $q->redirect($config{url});
 170                         }
 171                 }
 172                 elsif ($form->submitted eq 'Register') {
 173                         my $user_name=$form->field('name');
 174                         if (userinfo_setall($user_name, {
 175                                            'email' => $form->field('email'),
 176                                            'password' => $form->field('password'),
 177                                            'regdate' => time
 178                                          })) {
 179                                 $form->field(name => "confirm_password", type => "hidden");
 180                                 $form->field(name => "email", type => "hidden");
 181                                 $form->text("Registration successful. Now you can Login.");
 182                                 print $session->header(-charset=>'utf-8');
 183                                 print misctemplate($form->title, $form->render(submit => ["Login"]));
 184                         }
 185                         else {
 186                                 error("Error saving registration.");
 187                         }
 188                 }
 189                 elsif ($form->submitted eq 'Mail Password') {
 190                         my $user_name=$form->field("name");
 191                         my $template=HTML::Template->new(
 192                                 filename => "$config{templatedir}/passwordmail.tmpl"
 193                         );
 194                         $template->param(
 195                                 user_name => $user_name,
 196                                 user_password => userinfo_get($user_name, "password"),
 197                                 wikiurl => $config{url},
 198                                 wikiname => $config{wikiname},
 199                                 REMOTE_ADDR => $ENV{REMOTE_ADDR},
 200                         );
 201
 202                         eval q{use Mail::Sendmail};
 203                         sendmail(
 204                                 To => userinfo_get($user_name, "email"),
 205                                 From => "$config{wikiname} admin <$config{adminemail}>",
 206                                 Subject => "$config{wikiname} information",
 207                                 Message => $template->output,
 208                         ) or error("Failed to send mail");
 209
 210                         $form->text("Your password has been emailed to you.");
 211                         $form->field(name => "name", required => 0);
 212                         print $session->header(-charset=>'utf-8');
 213                         print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
 214                 }
 215         }
 216         else {
 217                 print $session->header(-charset=>'utf-8');
 218                 print misctemplate($form->title, $form->render(submit => ["Login", "Register", "Mail Password"]));
 219         }
 220 } #}}}
 221
 222 sub cgi_prefs ($$) { #{{{
 223         my $q=shift;
 224         my $session=shift;
 225
 226         eval q{use CGI::FormBuilder};
 227         my $form = CGI::FormBuilder->new(
 228                 title => "preferences",
 229                 fields => [qw(do name password confirm_password email
 230                               subscriptions locked_pages)],
 231                 header => 0,
 232                 charset => "utf-8",
 233                 method => 'POST',
 234                 validate => {
 235                         confirm_password => {
 236                                 perl => q{eq $form->field("password")},
 237                         },
 238                         email => 'EMAIL',
 239                 },
 240                 required => 'NONE',
 241                 javascript => 0,
 242                 params => $q,
 243                 action => $config{cgiurl},
 244                 template => (-e "$config{templatedir}/prefs.tmpl" ?
 245                               "$config{templatedir}/prefs.tmpl" : ""),
 246                 stylesheet => styleurl(),
 247         );
 248         my @buttons=("Save Preferences", "Logout", "Cancel");
 249
 250         my $user_name=$session->param("name");
 251         $form->field(name => "do", type => "hidden");
 252         $form->field(name => "name", disabled => 1,
 253                 value => $user_name, force => 1);
 254         $form->field(name => "password", type => "password");
 255         $form->field(name => "confirm_password", type => "password");
 256         $form->field(name => "subscriptions", size => 50,
 257                 comment => "(".htmllink("", "", "GlobList", 1).")");
 258         $form->field(name => "locked_pages", size => 50,
 259                 comment => "(".htmllink("", "", "GlobList", 1).")");
 260
 261         if (! is_admin($user_name)) {
 262                 $form->field(name => "locked_pages", type => "hidden");
 263         }
 264
 265         if (! $form->submitted) {
 266                 $form->field(name => "email", force => 1,
 267                         value => userinfo_get($user_name, "email"));
 268                 $form->field(name => "subscriptions", force => 1,
 269                         value => userinfo_get($user_name, "subscriptions"));
 270                 $form->field(name => "locked_pages", force => 1,
 271                         value => userinfo_get($user_name, "locked_pages"));
 272         }
 273
 274         if ($form->submitted eq 'Logout') {
 275                 $session->delete();
 276                 print $q->redirect($config{url});
 277                 return;
 278         }
 279         elsif ($form->submitted eq 'Cancel') {
 280                 print $q->redirect($config{url});
 281                 return;
 282         }
 283         elsif ($form->submitted eq "Save Preferences" && $form->validate) {
 284                 foreach my $field (qw(password email subscriptions locked_pages)) {
 285                         if (length $form->field($field)) {
 286                                 userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field");
 287                         }
 288                 }
 289                 $form->text("Preferences saved.");
 290         }
 291
 292         print $session->header(-charset=>'utf-8');
 293         print misctemplate($form->title, $form->render(submit => \@buttons));
 294 } #}}}
 295
 296 sub cgi_editpage ($$) { #{{{
 297         my $q=shift;
 298         my $session=shift;
 299
 300         eval q{use CGI::FormBuilder};
 301         my $form = CGI::FormBuilder->new(
 302                 fields => [qw(do rcsinfo subpage from page editcontent comments)],
 303                 header => 1,
 304                 charset => "utf-8",
 305                 method => 'POST',
 306                 validate => {
 307                         editcontent => '/.+/',
 308                 },
 309                 required => [qw{editcontent}],
 310                 javascript => 0,
 311                 params => $q,
 312                 action => $config{cgiurl},
 313                 table => 0,
 314                 template => "$config{templatedir}/editpage.tmpl"
 315         );
 316         my @buttons=("Save Page", "Preview", "Cancel");
 317
 318         # This untaint is safe because titlepage removes any problimatic
 319         # characters.
 320         my ($page)=titlepage(possibly_foolish_untaint(lc($form->param('page'))));
 321         if (! defined $page || ! length $page ||
 322             $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) {
 323                 error("bad page name");
 324         }
 325         $page=lc($page);
 326
 327         my $file=$page.$config{default_pageext};
 328         if (exists $pagesources{lc($page)}) {
 329                 $file=$pagesources{lc($page)};
 330         }
 331         my $newfile=0;
 332         if (! -e "$config{srcdir}/$file") {
 333                 $newfile=1;
 334         }
 335
 336         $form->field(name => "do", type => 'hidden');
 337         $form->field(name => "from", type => 'hidden');
 338         $form->field(name => "rcsinfo", type => 'hidden');
 339         $form->field(name => "subpage", type => 'hidden');
 340         $form->field(name => "page", value => "$page", force => 1);
 341         $form->field(name => "comments", type => "text", size => 80);
 342         $form->field(name => "editcontent", type => "textarea", rows => 20,
 343                 cols => 80);
 344         $form->tmpl_param("can_commit", $config{rcs});
 345         $form->tmpl_param("indexlink", indexlink());
 346         $form->tmpl_param("helponformattinglink",
 347                 htmllink("", "", "HelpOnFormatting", 1));
 348         $form->tmpl_param("styleurl", styleurl());
 349         $form->tmpl_param("baseurl", "$config{url}/");
 350         if (! $form->submitted) {
 351                 $form->field(name => "rcsinfo", value => rcs_prepedit($file),
 352                         force => 1);
 353         }
 354
 355         if ($form->submitted eq "Cancel") {
 356                 print $q->redirect("$config{url}/".htmlpage($page));
 357                 return;
 358         }
 359         elsif ($form->submitted eq "Preview") {
 360                 require IkiWiki::Render;
 361                 # Apparently FormBuilder doesn't not treat input as
 362                 # utf-8, so decode from it.
 363                 require Encode;
 364                 my $content = Encode::decode_utf8($form->field('editcontent'));
 365                 $form->field(name => "editcontent",
 366                                 value => $content, force => 1);
 367                 $form->field(name => "comments",
 368                                 value => Encode::decode_utf8($form->field('comments')), force => 1);
 369                 $form->tmpl_param("page_preview",
 370                         htmlize($config{default_pageext},
 371                                 linkify($page, $page, $content)));
 372         }
 373         else {
 374                 $form->tmpl_param("page_preview", "");
 375         }
 376         $form->tmpl_param("page_conflict", "");
 377
 378         if (! $form->submitted || $form->submitted eq "Preview" ||
 379             ! $form->validate) {
 380                 if ($form->field("do") eq "create") {
 381                         my @page_locs;
 382                         my $best_loc;
 383                         my ($from)=$form->param('from')=~/$config{wiki_file_regexp}/;
 384                         if (! defined $from || ! length $from ||
 385                             $from ne $form->param('from') ||
 386                             $from=~/$config{wiki_file_prune_regexp}/ ||
 387                             $from=~/^\// ||
 388                             $form->submitted eq "Preview") {
 389                                 @page_locs=$best_loc=$page;
 390                         }
 391                         else {
 392                                 my $dir=$from."/";
 393                                 $dir=~s![^/]+/+$!!;
 394
 395                                 if ((defined $form->param('subpage') && length $form->param('subpage')) ||
 396                                     $page eq 'discussion') {
 397                                         $best_loc="$from/$page";
 398                                 }
 399                                 else {
 400                                         $best_loc=$dir.$page;
 401                                 }
 402
 403                                 push @page_locs, $dir.$page;
 404                                 push @page_locs, "$from/$page";
 405                                 while (length $dir) {
 406                                         $dir=~s![^/]+/+$!!;
 407                                         push @page_locs, $dir.$page;
 408                                 }
 409                         }
 410
 411                         @page_locs = grep {
 412                                 ! exists $pagesources{lc($_)} &&
 413                                 ! page_locked($_, $session, 1)
 414                         } @page_locs;
 415
 416                         if (! @page_locs) {
 417                                 # hmm, someone else made the page in the
 418                                 # meantime?
 419                                 print $q->redirect("$config{url}/".htmlpage($page));
 420                                 return;
 421                         }
 422
 423                         $form->tmpl_param("page_select", 1);
 424                         $form->field(name => "page", type => 'select',
 425                                 options => \@page_locs, value => $best_loc);
 426                         $form->title("creating ".pagetitle($page));
 427                 }
 428                 elsif ($form->field("do") eq "edit") {
 429                         page_locked($page, $session);
 430                         if (! defined $form->field('editcontent') ||
 431                             ! length $form->field('editcontent')) {
 432                                 my $content="";
 433                                 if (exists $pagesources{lc($page)}) {
 434                                         $content=readfile(srcfile($pagesources{lc($page)}));
 435                                         $content=~s/\n/\r\n/g;
 436                                 }
 437                                 $form->field(name => "editcontent", value => $content,
 438                                         force => 1);
 439                         }
 440                         $form->tmpl_param("page_select", 0);
 441                         $form->field(name => "page", type => 'hidden');
 442                         $form->title("editing ".pagetitle($page));
 443                 }
 444
 445                 print $form->render(submit => \@buttons);
 446         }
 447         else {
 448                 # save page
 449                 page_locked($page, $session);
 450
 451                 # Decode utf-8 since FormBuilder does not
 452                 require Encode;
 453                 my $content=Encode::decode_utf8($form->field('editcontent'));
 454
 455                 $content=~s/\r\n/\n/g;
 456                 $content=~s/\r/\n/g;
 457                 writefile($file, $config{srcdir}, $content);
 458
 459                 my $message="web commit ";
 460                 if (defined $session->param("name") &&
 461                     length $session->param("name")) {
 462                         $message.="by ".$session->param("name");
 463                 }
 464                 else {
 465                         $message.="from $ENV{REMOTE_ADDR}";
 466                 }
 467                 if (defined $form->field('comments') &&
 468                     length $form->field('comments')) {
 469                         $message.=Encode::decode_utf8(": ".$form->field('comments'));
 470                 }
 471
 472                 if ($config{rcs}) {
 473                         if ($newfile) {
 474                                 rcs_add($file);
 475                         }
 476                         # prevent deadlock with post-commit hook
 477                         unlockwiki();
 478                         # presumably the commit will trigger an update
 479                         # of the wiki
 480                         my $conflict=rcs_commit($file, $message,
 481                                 $form->field("rcsinfo"));
 482
 483                         if (defined $conflict) {
 484                                 $form->field(name => "rcsinfo", value => rcs_prepedit($file),
 485                                         force => 1);
 486                                 $form->tmpl_param("page_conflict", 1);
 487                                 $form->field("editcontent", value => $conflict, force => 1);
 488                                 $form->field("do", "edit)");
 489                                 $form->tmpl_param("page_select", 0);
 490                                 $form->field(name => "page", type => 'hidden');
 491                                 $form->title("editing $page");
 492                                 print $form->render(submit => \@buttons);
 493                                 return;
 494                         }
 495                 }
 496                 else {
 497                         require IkiWiki::Render;
 498                         refresh();
 499                         saveindex();
 500                 }
 501
 502                 # The trailing question mark tries to avoid broken
 503                 # caches and get the most recent version of the page.
 504                 print $q->redirect("$config{url}/".htmlpage($page)."?updated");
 505         }
 506 } #}}}
 507
 508 sub cgi () { #{{{
 509         eval q{use CGI};
 510         eval q{use CGI::Session};
 511
 512         my $q=CGI->new;
 513
 514         if (exists $hooks{cgi}) {
 515                 foreach my $id (keys %{$hooks{cgi}}) {
 516                         $hooks{cgi}{$id}{call}->($q);
 517                 }
 518         }
 519
 520         my $do=$q->param('do');
 521         if (! defined $do || ! length $do) {
 522                 error("\"do\" parameter missing");
 523         }
 524
 525         # Things that do not need a session.
 526         if ($do eq 'recentchanges') {
 527                 cgi_recentchanges($q);
 528                 return;
 529         }
 530         elsif ($do eq 'hyperestraier') {
 531                 cgi_hyperestraier();
 532         }
 533
 534         CGI::Session->name("ikiwiki_session_$config{wikiname}");
 535
 536         my $oldmask=umask(077);
 537         my $session = CGI::Session->new("driver:DB_File", $q,
 538                 { FileName => "$config{wikistatedir}/sessions.db" });
 539         umask($oldmask);
 540
 541         # Everything below this point needs the user to be signed in.
 542         if ((! $config{anonok} &&
 543              (! defined $session->param("name") ||
 544              ! userinfo_get($session->param("name"), "regdate"))) || $do eq 'signin') {
 545                 cgi_signin($q, $session);
 546
 547                 # Force session flush with safe umask.
 548                 my $oldmask=umask(077);
 549                 $session->flush;
 550                 umask($oldmask);
 551
 552                 return;
 553         }
 554
 555         if ($do eq 'create' || $do eq 'edit') {
 556                 cgi_editpage($q, $session);
 557         }
 558         elsif ($do eq 'prefs') {
 559                 cgi_prefs($q, $session);
 560         }
 561         elsif ($do eq 'blog') {
 562                 my $page=titlepage(lc($q->param('title')));
 563                 # if the page already exists, munge it to be unique
 564                 my $from=$q->param('from');
 565                 my $add="";
 566                 while (exists $oldpagemtime{"$from/$page$add"}) {
 567                         $add=1 unless length $add;
 568                         $add++;
 569                 }
 570                 $q->param('page', $page.$add);
 571                 # now run same as create
 572                 $q->param('do', 'create');
 573                 cgi_editpage($q, $session);
 574         }
 575         else {
 576                 error("unknown do parameter");
 577         }
 578 } #}}}
 579
 580 1