". + sprintf(gettext("The page %s does not exist."), + htmllink("", "", $page)). + "
"); + } + else { + IkiWiki::redirect($cgi, urlto($link, undef, 1)); + } + + exit; + } +} + +sub sessioncgi ($$) { my $cgi=shift; my $session=shift; my $do = $cgi->param('do'); - return unless $do eq 'comment'; + if ($do eq 'comment') { + editcomment($cgi, $session); + } + elsif ($do eq 'commentmoderation') { + commentmoderation($cgi, $session); + } +} + +# Mostly cargo-culted from IkiWiki::plugin::editpage +sub editcomment ($$) { + my $cgi=shift; + my $session=shift; IkiWiki::decode_cgi_utf8($cgi); @@ -148,18 +289,16 @@ sub sessioncgi ($$) { #{{{ my @buttons = (POST_COMMENT, PREVIEW, CANCEL); my $form = CGI::FormBuilder->new( - fields => [qw{do sid page subject body}], + fields => [qw{do sid page subject editcontent type author url}], charset => 'utf-8', method => 'POST', - required => [qw{body}], + required => [qw{editcontent}], javascript => 0, params => $cgi, action => $config{cgiurl}, header => 0, table => 0, - template => scalar IkiWiki::template_params('comments_form.tmpl'), - # wtf does this do in editpage? - wikiname => $config{wikiname}, + template => scalar IkiWiki::template_params('editcomment.tmpl'), ); IkiWiki::decode_form_utf8($form); @@ -169,31 +308,52 @@ sub sessioncgi ($$) { #{{{ }); IkiWiki::decode_form_utf8($form); + my $type = $form->param('type'); + if (defined $type && length $type && $IkiWiki::hooks{htmlize}{$type}) { + $type = IkiWiki::possibly_foolish_untaint($type); + } + else { + $type = $config{default_pageext}; + } + my @page_types; + if (exists $IkiWiki::hooks{htmlize}) { + @page_types = grep { ! /^_/ } keys %{$IkiWiki::hooks{htmlize}}; + } + $form->field(name => 'do', type => 'hidden'); $form->field(name => 'sid', type => 'hidden', value => $session->id, force => 1); $form->field(name => 'page', type => 'hidden'); $form->field(name => 'subject', type => 'text', size => 72); - $form->field(name => 'body', type => 'textarea', rows => 5, - cols => 80); + $form->field(name => 'editcontent', type => 'textarea', rows => 10); + $form->field(name => "type", value => $type, force => 1, + type => 'select', options => \@page_types); + + $form->tmpl_param(username => $session->param('name')); + + if ($config{comments_allowauthor} and + ! defined $session->param('name')) { + $form->tmpl_param(allowauthor => 1); + $form->field(name => 'author', type => 'text', size => '40'); + $form->field(name => 'url', type => 'text', size => '40'); + } + else { + $form->tmpl_param(allowauthor => 0); + $form->field(name => 'author', type => 'hidden', value => '', + force => 1); + $form->field(name => 'url', type => 'hidden', value => '', + force => 1); + } # The untaint is OK (as in editpage) because we're about to pass # it to file_pruned anyway my $page = $form->field('page'); $page = IkiWiki::possibly_foolish_untaint($page); - if (!defined $page || !length $page || + if (! defined $page || ! length $page || IkiWiki::file_pruned($page, $config{srcdir})) { error(gettext("bad page name")); } - my $allow_directives = $pagestate{$page}{comments}{allowdirectives}; - my $allow_html = $pagestate{$page}{comments}{allowdirectives}; - my $commit_comments = defined $pagestate{$page}{comments}{commit} - ? $pagestate{$page}{comments}{commit} - : 1; - - # FIXME: is this right? Or should we be using the candidate subpage - # (whatever that might mean) as the base URL? my $baseurl = urlto($page, undef, 1); $form->title(sprintf(gettext("commenting on %s"), @@ -203,73 +363,77 @@ sub sessioncgi ($$) { #{{{ htmllink($page, $page, 'ikiwiki/formatting', noimageinline => 1, linktext => 'FormattingHelp'), - allowhtml => $allow_html, - allowdirectives => $allow_directives); + allowdirectives => $config{allow_directives}); + + if ($form->submitted eq CANCEL) { + # bounce back to the page they wanted to comment on, and exit. + # CANCEL need not be considered in future + IkiWiki::redirect($cgi, urlto($page, undef, 1)); + exit; + } if (not exists $pagesources{$page}) { error(sprintf(gettext( "page '%s' doesn't exist, so you can't comment"), $page)); } - if (not $pagestate{$page}{comments}{comments}) { + + if (pagespec_match($page, $config{comments_closed_pagespec}, + location => $page)) { error(sprintf(gettext( - "comments are not enabled on page '%s'"), + "comments on page '%s' are closed"), $page)); } - if ($form->submitted eq CANCEL) { - # bounce back to the page they wanted to comment on, and exit. - # CANCEL need not be considered in future - IkiWiki::redirect($cgi, urlto($page, undef, 1)); - exit; - } - - IkiWiki::check_canedit($page . "[postcomment]", $cgi, $session); + # Set a flag to indicate that we're posting a comment, + # so that postcomment() can tell it should match. + $postcomment=1; + IkiWiki::check_canedit($page, $cgi, $session); + $postcomment=0; - my ($authorurl, $author) = linkuser(getcgiuser($session)); + my $location=unique_comment_location($page, $config{srcdir}); - my $body = $form->field('body') || ''; - $body =~ s/\r\n/\n/g; - $body =~ s/\r/\n/g; - $body .= "\n" if $body !~ /\n$/; + my $content = "[[!_comment format=$type\n"; - unless ($allow_directives) { - # don't allow new-style directives at all - $body =~ s/(^|[^\\])\[\[!/$1\\[[!/g; - - # don't allow [[ unless it begins an old-style - # wikilink, if prefix_directives is off - $body =~ s/(^|[^\\])\[\[(?![^\n\s\]+]\]\])/$1\\[[!/g - unless $config{prefix_directives}; + # FIXME: handling of double quotes probably wrong? + if (defined $session->param('name')) { + my $username = $session->param('name'); + $username =~ s/"/"/g; + $content .= " username=\"$username\"\n"; + } + elsif (defined $ENV{REMOTE_ADDR}) { + my $ip = $ENV{REMOTE_ADDR}; + if ($ip =~ m/^([.0-9]+)$/) { + $content .= " ip=\"$1\"\n"; + } } - unless ($allow_html) { - $body =~ s/&(\w|#)/&$1/g; - $body =~ s//>/g; + if ($config{comments_allowauthor}) { + my $author = $form->field('author'); + if (defined $author && length $author) { + $author =~ s/"/"/g; + $content .= " claimedauthor=\"$author\"\n"; + } + my $url = $form->field('url'); + if (defined $url && length $url) { + $url =~ s/"/"/g; + $content .= " url=\"$url\"\n"; + } } - IkiWiki::run_hooks(sanitize => sub { - # $fake is a possible location for this comment. We don't - # know yet what the comment number *actually* is. - my $fake = "$page/_comment_1"; - $body=shift->( - page => $fake, - destpage => $fake, - content => $body, - ); - }); + my $subject = $form->field('subject'); + if (defined $subject && length $subject) { + $subject =~ s/"/"/g; + $content .= " subject=\"$subject\"\n"; + } - # In this template, the [[!meta]] directives should stay at the end, - # so that they will override anything the user specifies. (For - # instance, [[!meta author="I can fake the author"]]...) - my $content_tmpl = template('comments_comment.tmpl'); - $content_tmpl->param(author => $author); - $content_tmpl->param(authorurl => $authorurl); - $content_tmpl->param(subject => $form->field('subject')); - $content_tmpl->param(body => $body); + $content .= " date=\"" . decode_utf8(strftime('%Y-%m-%dT%H:%M:%SZ', gmtime)) . "\"\n"; - my $content = $content_tmpl->output; + my $editcontent = $form->field('editcontent') || ''; + $editcontent =~ s/\r\n/\n/g; + $editcontent =~ s/\r/\n/g; + $editcontent =~ s/"/\\"/g; + $content .= " content=\"\"\"\n$editcontent\n\"\"\"]]\n"; # This is essentially a simplified version of editpage: # - the user does not control the page that's created, only the parent @@ -278,61 +442,56 @@ sub sessioncgi ($$) { #{{{ # - this means that if they do, rocks fall and everyone dies if ($form->submitted eq PREVIEW) { - # $fake is a possible location for this comment. We don't - # know yet what the comment number *actually* is. - my $fake = "$page/_comment_1"; - my $preview = IkiWiki::htmlize($fake, $page, 'mdwn', - IkiWiki::linkify($page, $page, - IkiWiki::preprocess($page, $page, - IkiWiki::filter($fake, $page, - $content), - 0, 1))); - IkiWiki::run_hooks(format => sub { - $preview = shift->(page => $page, - content => $preview); - }); - - my $template = template("comments_display.tmpl"); - $template->param(content => $preview); - $template->param(title => $form->field('subject')); - $template->param(ctime => displaytime(time)); - $template->param(author => $author); - $template->param(authorurl => $authorurl); - - $form->tmpl_param(page_preview => $template->output); + $form->tmpl_param(page_preview => + previewcomment($content, $location, $page, time)); } else { $form->tmpl_param(page_preview => ""); } if ($form->submitted eq POST_COMMENT && $form->validate) { - # Let's get posting. We don't check_canedit here because - # that somewhat defeats the point of this plugin. - - checksessionexpiry($session, $cgi->param('sid')); - - # FIXME: check that the wiki is locked right now, because - # if it's not, there are mad race conditions! - - # FIXME: rather a simplistic way to make the comments... - my $i = 0; - my $file; - do { - $i++; - $file = "$page/_comment_${i}._comment"; - } while (-e "$config{srcdir}/$file"); + IkiWiki::checksessionexpiry($cgi, $session); + + $postcomment=1; + my $ok=IkiWiki::check_content(content => $form->field('editcontent'), + subject => $form->field('subject'), + $config{comments_allowauthor} ? ( + author => $form->field('author'), + url => $form->field('url'), + ) : (), + page => $location, + cgi => $cgi, + session => $session, + nonfatal => 1, + ); + $postcomment=0; + + if (! $ok) { + my $penddir=$config{wikistatedir}."/comments_pending"; + $location=unique_comment_location($page, $penddir); + writefile("$location._comment", $penddir, $content); + IkiWiki::printheader($session); + print IkiWiki::misctemplate(gettext(gettext("comment stored for moderation")), + "". + gettext("Your comment will be posted after moderator review"), + "
"); + exit; + } # FIXME: could probably do some sort of graceful retry - # if I could be bothered + # on error? Would require significant unwinding though + my $file = "$location._comment"; writefile($file, $config{srcdir}, $content); my $conflict; - if ($config{rcs} and $commit_comments) { + if ($config{rcs} and $config{comments_commit}) { my $message = gettext("Added a comment"); if (defined $form->field('subject') && length $form->field('subject')) { - $message .= ": ".$form->field('subject'); + $message = sprintf( + gettext("Added a comment: %s"), + $form->field('subject')); } IkiWiki::rcs_add($file); @@ -352,9 +511,11 @@ sub sessioncgi ($$) { #{{{ # breaks it or something error($conflict) if defined $conflict; - # Bounce back to where we were, but defeat broken caches - my $anticache = "?updated=$page/_comment_$i"; - IkiWiki::redirect($cgi, urlto($page, undef, 1).$anticache); + # Jump to the new comment on the page. + # The trailing question mark tries to avoid broken + # caches and get the most recent version of the page. + IkiWiki::redirect($cgi, urlto($page, undef, 1)."?updated#$location"); + } else { IkiWiki::showform ($form, \@buttons, $session, $cgi, @@ -362,7 +523,312 @@ sub sessioncgi ($$) { #{{{ } exit; -} #}}} +} + +sub commentmoderation ($$) { + my $cgi=shift; + my $session=shift; + + IkiWiki::needsignin($cgi, $session); + if (! IkiWiki::is_admin($session->param("name"))) { + error(gettext("you are not logged in as an admin")); + } + + IkiWiki::decode_cgi_utf8($cgi); + + if (defined $cgi->param('sid')) { + IkiWiki::checksessionexpiry($cgi, $session); + + my $rejectalldefer=$cgi->param('rejectalldefer'); + + my %vars=$cgi->Vars; + my $added=0; + foreach my $id (keys %vars) { + if ($id =~ /(.*)\Q._comment\E$/) { + my $action=$cgi->param($id); + next if $action eq 'Defer' && ! $rejectalldefer; + + # Make sure that the id is of a legal + # pending comment before untainting. + my ($f)= $id =~ /$config{wiki_file_regexp}/; + if (! defined $f || ! length $f || + IkiWiki::file_pruned($f, $config{srcdir})) { + error("illegal file"); + } + + my $page=IkiWiki::possibly_foolish_untaint(IkiWiki::dirname($1)); + my $file="$config{wikistatedir}/comments_pending/". + IkiWiki::possibly_foolish_untaint($id); + + if ($action eq 'Accept') { + my $content=eval { readfile($file) }; + next if $@; # file vanished since form was displayed + my $dest=unique_comment_location($page, $config{srcdir})."._comment"; + writefile($dest, $config{srcdir}, $content); + if ($config{rcs} and $config{comments_commit}) { + IkiWiki::rcs_add($dest); + } + $added++; + } + + # This removes empty subdirs, so the + # .ikiwiki/comments_pending dir will + # go away when all are moderated. + require IkiWiki::Render; + IkiWiki::prune($file); + } + } + + if ($added) { + my $conflict; + if ($config{rcs} and $config{comments_commit}) { + my $message = gettext("Comment moderation"); + IkiWiki::disable_commit_hook(); + $conflict=IkiWiki::rcs_commit_staged($message, + $session->param('name'), $ENV{REMOTE_ADDR}); + IkiWiki::enable_commit_hook(); + IkiWiki::rcs_update(); + } + + # Now we need a refresh + require IkiWiki::Render; + IkiWiki::refresh(); + IkiWiki::saveindex(); + + error($conflict) if defined $conflict; + } + } + + my @comments=map { + my ($id, $ctime)=@{$_}; + my $file="$config{wikistatedir}/comments_pending/$id"; + my $content=readfile($file); + { + id => $id, + view => previewcomment($content, $id, + IkiWiki::dirname($_), $ctime), + } + } sort { $b->[1] <=> $a->[1] } comments_pending(); + + my $template=template("commentmoderation.tmpl"); + $template->param( + sid => $session->id, + comments => \@comments, + ); + IkiWiki::printheader($session); + print IkiWiki::misctemplate(gettext("comment moderation"), $template->output); + exit; +} + +sub formbuilder_setup (@) { + my %params=@_; + + my $form=$params{form}; + if ($form->title eq "preferences") { + push @{$params{buttons}}, "Comment Moderation"; + if ($form->submitted && $form->submitted eq "Comment Moderation") { + commentmoderation($params{cgi}, $params{session}); + } + } +} + +sub comments_pending () { + my $dir="$config{wikistatedir}/comments_pending/"; + return unless -d $dir; + + my @ret; + eval q{use File::Find}; + error($@) if $@; + find({ + no_chdir => 1, + wanted => sub { + $_=decode_utf8($_); + if (IkiWiki::file_pruned($_, $dir)) { + $File::Find::prune=1; + } + elsif (! -l $_ && ! -d _) { + $File::Find::prune=0; + my ($f)=/$config{wiki_file_regexp}/; # untaint + if (defined $f && $f =~ /\Q._comment\E$/) { + my $ctime=(stat($f))[10]; + $f=~s/^\Q$dir\E\/?//; + push @ret, [$f, $ctime]; + } + } + } + }, $dir); + + return @ret; +} + +sub previewcomment ($$$) { + my $content=shift; + my $location=shift; + my $page=shift; + my $time=shift; + + my $preview = IkiWiki::htmlize($location, $page, '_comment', + IkiWiki::linkify($location, $page, + IkiWiki::preprocess($location, $page, + IkiWiki::filter($location, $page, $content), 0, 1))); + IkiWiki::run_hooks(format => sub { + $preview = shift->(page => $page, + content => $preview); + }); + + my $template = template("comment.tmpl"); + $template->param(content => $preview); + $template->param(ctime => displaytime($time)); + + IkiWiki::run_hooks(pagetemplate => sub { + shift->(page => $location, + destpage => $page, + template => $template); + }); + + $template->param(have_actions => 0); + + return $template->output; +} + +sub commentsshown ($) { + my $page=shift; + + return ! pagespec_match($page, "*/$config{comments_pagename}*", + location => $page) && + pagespec_match($page, $config{comments_pagespec}, + location => $page); +} + +sub commentsopen ($) { + my $page = shift; + + return length $config{cgiurl} > 0 && + (! length $config{comments_closed_pagespec} || + ! pagespec_match($page, $config{comments_closed_pagespec}, + location => $page)); +} + +sub pagetemplate (@) { + my %params = @_; + + my $page = $params{page}; + my $template = $params{template}; + my $shown = ($template->query(name => 'commentslink') || + $template->query(name => 'commentsurl') || + $template->query(name => 'atomcommentsurl') || + $template->query(name => 'comments')) && + commentsshown($page); + + if ($template->query(name => 'comments')) { + my $comments = undef; + if ($shown) { + $comments = IkiWiki::preprocess_inline( + pages => "internal($page/$config{comments_pagename}*)", + template => 'comment', + show => 0, + reverse => 'yes', + page => $page, + destpage => $params{destpage}, + feedfile => 'comments', + emptyfeeds => 'no', + ); + } + + if (defined $comments && length $comments) { + $template->param(comments => $comments); + } + + if ($shown && commentsopen($page)) { + my $addcommenturl = IkiWiki::cgiurl(do => 'comment', + page => $page); + $template->param(addcommenturl => $addcommenturl); + } + } + + if ($template->query(name => 'commentsurl')) { + if ($shown) { + $template->param(commentsurl => + urlto($page, undef, 1).'#comments'); + } + } + + if ($template->query(name => 'atomcommentsurl') && $config{usedirs}) { + if ($shown) { + # This will 404 until there are some comments, but I + # think that's probably OK... + $template->param(atomcommentsurl => + urlto($page, undef, 1).'comments.atom'); + } + } + + if ($template->query(name => 'commentslink')) { + # XXX Would be nice to say how many comments there are in + # the link. But, to update the number, blog pages + # would have to update whenever comments of any inlines + # page are added, which is not currently done. + if ($shown) { + $template->param(commentslink => + htmllink($page, $params{destpage}, $page, + linktext => gettext("Comments"), + anchor => "comments", + noimageinline => 1)); + } + } + + # everything below this point is only relevant to the comments + # themselves + if (!exists $commentstate{$page}) { + return; + } + + if ($template->query(name => 'commentuser')) { + $template->param(commentuser => + $commentstate{$page}{commentuser}); + } + + if ($template->query(name => 'commentopenid')) { + $template->param(commentopenid => + $commentstate{$page}{commentopenid}); + } + + if ($template->query(name => 'commentip')) { + $template->param(commentip => + $commentstate{$page}{commentip}); + } + + if ($template->query(name => 'commentauthor')) { + $template->param(commentauthor => + $commentstate{$page}{commentauthor}); + } + + if ($template->query(name => 'commentauthorurl')) { + $template->param(commentauthorurl => + $commentstate{$page}{commentauthorurl}); + } + + if ($template->query(name => 'removeurl') && + IkiWiki::Plugin::remove->can("check_canremove") && + length $config{cgiurl}) { + $template->param(removeurl => IkiWiki::cgiurl(do => 'remove', + page => $page)); + $template->param(have_actions => 1); + } +} + +sub unique_comment_location ($) { + my $page=shift; + my $dir=shift; + + my $location; + my $i = 0; + do { + $i++; + $location = "$page/$config{comments_pagename}$i"; + } while (-e "$dir/$location._comment"); + + return $location; +} package IkiWiki::PageSpec; @@ -370,7 +836,7 @@ sub match_postcomment ($$;@) { my $page = shift; my $glob = shift; - unless ($page =~ s/\[postcomment\]$//) { + if (! $postcomment) { return IkiWiki::FailReason->new("not posting a comment"); } return match_glob($page, $glob);