X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/blobdiff_plain/d4b44755215a40dd163753719e539bf84124587d..cb25b4c7c4a388cf7ec89659bac489335ffd93d7:/IkiWiki/CGI.pm diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm index b031aef56..d92bdd330 100644 --- a/IkiWiki/CGI.pm +++ b/IkiWiki/CGI.pm @@ -33,24 +33,25 @@ sub redirect ($$) { #{{{ } } #}}} -sub page_locked ($$;$) { #{{{ +sub check_canedit ($$$;$) { #{{{ my $page=shift; + my $q=shift; my $session=shift; my $nonfatal=shift; - my $user=$session->param("name"); - return if defined $user && is_admin($user); - - foreach my $admin (@{$config{adminuser}}) { - my $locked_pages=userinfo_get($admin, "locked_pages"); - if (pagespec_match($page, userinfo_get($admin, "locked_pages"))) { - return 1 if $nonfatal; - error(htmllink("", "", $page, 1)." is locked by ". - userlink($admin)." and cannot be edited."); + my $canedit; + run_hooks(canedit => sub { + return if defined $canedit; + my $ret=shift->($page, $q, $session); + if (defined $ret && $ret eq "") { + $canedit=1; } - } - - return 0; + elsif (defined $ret) { + $canedit=0; + error($ret) unless $nonfatal; + } + }); + return $canedit; } #}}} sub decode_form_utf8 ($) { #{{{ @@ -88,7 +89,9 @@ sub cgi_recentchanges ($) { #{{{ delete @{$change->{pages}}[10 .. @{$change->{pages}}] if $is_excess; $change->{pages} = [ map { - $_->{link} = htmllink("", "", $_->{page}, 1); + $_->{link} = htmllink("", "", $_->{page}, + noimageinline => 1, + linktext => pagetitle($_->{page})); $_; } @{$change->{pages}} ]; @@ -109,6 +112,23 @@ sub cgi_recentchanges ($) { #{{{ print $q->header(-charset => 'utf-8'), $template->output; } #}}} +# Check if the user is signed in. If not, redirect to the signin form and +# save their place to return to later. +sub needsignin ($$) { #{{{ + my $q=shift; + my $session=shift; + + if (! defined $session->param("name") || + ! userinfo_get($session->param("name"), "regdate")) { + if (! defined $session->param("postsignin")) { + $session->param(postsignin => $ENV{QUERY_STRING}); + } + cgi_signin($q, $session); + cgi_savesession($session); + exit; + } +} #}}} + sub cgi_signin ($$) { #{{{ my $q=shift; my $session=shift; @@ -117,6 +137,7 @@ sub cgi_signin ($$) { #{{{ error($@) if $@; my $form = CGI::FormBuilder->new( title => "signin", + name => "signin", header => 1, charset => "utf-8", method => 'POST', @@ -125,17 +146,16 @@ sub cgi_signin ($$) { #{{{ params => $q, action => $config{cgiurl}, header => 0, - template => (-e "$config{templatedir}/signin.tmpl" ? - {template_params("signin.tmpl")} : ""), + template => {type => 'div'}, stylesheet => baseurl()."style.css", ); my $buttons=["Login"]; - $form->field(name => "do", type => "hidden"); - if ($q->param("do") ne "signin" && !$form->submitted) { - $form->text("You need to log in first."); + $form->text(gettext("You need to log in first.")); } + $form->field(name => "do", type => "hidden", value => "signin", + force => 1); run_hooks(formbuilder_setup => sub { shift->(form => $form, cgi => $q, session => $session); @@ -161,16 +181,18 @@ sub cgi_signin ($$) { #{{{ sub cgi_postsignin ($$) { #{{{ my $q=shift; my $session=shift; - + # Continue with whatever was being done before the signin process. - if (defined $q->param("do") && $q->param("do") ne "signin" && - defined $session->param("postsignin")) { + if (defined $session->param("postsignin")) { my $postsignin=CGI->new($session->param("postsignin")); $session->clear("postsignin"); cgi($postsignin, $session); + cgi_savesession($session); exit; } else { + # This can occur, for example, if a user went to the signin + # url via a bookmark. redirect($q, $config{url}); } } #}}} @@ -179,10 +201,13 @@ sub cgi_prefs ($$) { #{{{ my $q=shift; my $session=shift; + needsignin($q, $session); + eval q{use CGI::FormBuilder}; error($@) if $@; my $form = CGI::FormBuilder->new( title => "preferences", + name => "preferences", header => 0, charset => "utf-8", method => 'POST', @@ -193,9 +218,13 @@ sub cgi_prefs ($$) { #{{{ javascript => 0, params => $q, action => $config{cgiurl}, - template => (-e "$config{templatedir}/prefs.tmpl" ? - {template_params("prefs.tmpl")} : ""), + template => {type => 'div'}, stylesheet => baseurl()."style.css", + fieldsets => [ + [login => gettext("Login")], + [preferences => gettext("Preferences")], + [admin => gettext("Admin")] + ], ); my $buttons=["Save Preferences", "Logout", "Cancel"]; @@ -204,16 +233,15 @@ sub cgi_prefs ($$) { #{{{ }); $form->field(name => "do", type => "hidden"); - $form->field(name => "email", size => 50); + $form->field(name => "email", size => 50, fieldset => "preferences"); $form->field(name => "subscriptions", size => 50, - comment => "(".htmllink("", "", "PageSpec", 1).")"); - $form->field(name => "locked_pages", size => 50, - comment => "(".htmllink("", "", "PageSpec", 1).")"); - $form->field(name => "banned_users", size => 50); + fieldset => "preferences", + comment => "(".htmllink("", "", "PageSpec", noimageinline => 1).")"); + $form->field(name => "banned_users", size => 50, + fieldset => "admin"); my $user_name=$session->param("name"); if (! is_admin($user_name)) { - $form->field(name => "locked_pages", type => "hidden"); $form->field(name => "banned_users", type => "hidden"); } @@ -222,8 +250,6 @@ sub cgi_prefs ($$) { #{{{ value => userinfo_get($user_name, "email")); $form->field(name => "subscriptions", force => 1, value => userinfo_get($user_name, "subscriptions")); - $form->field(name => "locked_pages", force => 1, - value => userinfo_get($user_name, "locked_pages")); if (is_admin($user_name)) { $form->field(name => "banned_users", force => 1, value => join(" ", get_banned_users())); @@ -241,17 +267,20 @@ sub cgi_prefs ($$) { #{{{ redirect($q, $config{url}); return; } - elsif ($form->submitted eq "Save Preferences" && $form->validate) { - foreach my $field (qw(email subscriptions locked_pages)) { + elsif ($form->submitted eq 'Save Preferences' && $form->validate) { + foreach my $field (qw(email subscriptions)) { if (defined $form->field($field) && length $form->field($field)) { - userinfo_set($user_name, $field, $form->field($field)) || error("failed to set $field"); + userinfo_set($user_name, $field, $form->field($field)) || + error("failed to set $field"); } } if (is_admin($user_name)) { set_banned_users(grep { ! is_admin($_) } - split(' ', $form->field("banned_users"))); + split(' ', + $form->field("banned_users"))) || + error("failed saving changes"); } - $form->text("Preferences saved."); + $form->text(gettext("Preferences saved.")); } if (exists $hooks{formbuilder}) { @@ -273,15 +302,8 @@ sub cgi_editpage ($$) { #{{{ my @fields=qw(do rcsinfo subpage from page type editcontent comments); my @buttons=("Save Page", "Preview", "Cancel"); - eval q{use CGI::FormBuilder; use CGI::FormBuilder::Template::HTML}; + eval q{use CGI::FormBuilder}; error($@) if $@; - my $renderer=CGI::FormBuilder::Template::HTML->new( - fields => \@fields, - template_params("editpage.tmpl"), - ); - run_hooks(pagetemplate => sub { - shift->(page => "", destpage => "", template => $renderer->engine); - }); my $form = CGI::FormBuilder->new( fields => \@fields, header => 1, @@ -295,7 +317,8 @@ sub cgi_editpage ($$) { #{{{ params => $q, action => $config{cgiurl}, table => 0, - template => $renderer, + template => scalar template_params("editpage.tmpl"), + wikiname => $config{wikiname}, ); run_hooks(formbuilder_setup => sub { @@ -308,8 +331,7 @@ sub cgi_editpage ($$) { #{{{ # characters. my ($page)=$form->field('page'); $page=titlepage(possibly_foolish_untaint($page)); - if (! defined $page || ! length $page || - $page=~/$config{wiki_file_prune_regexp}/ || $page=~/^\//) { + if (! defined $page || ! length $page || file_pruned($page, $config{srcdir}) || $page=~/^\//) { error("bad page name"); } @@ -320,9 +342,16 @@ sub cgi_editpage ($$) { #{{{ my $file; my $type; - if (exists $pagesources{$page}) { + if (exists $pagesources{$page} && $form->field("do") ne "create") { $file=$pagesources{$page}; $type=pagetype($file); + if (! defined $type) { + error(sprintf(gettext("%s is not an editable page"), $page)); + } + if (! $form->submitted) { + $form->field(name => "rcsinfo", + value => rcs_prepedit($file), force => 1); + } } else { $type=$form->param('type'); @@ -335,18 +364,16 @@ sub cgi_editpage ($$) { #{{{ } $type=$config{default_pageext} unless defined $type; $file=$page.".".$type; - } - - my $newfile=0; - if (! -e "$config{srcdir}/$file") { - $newfile=1; + if (! $form->submitted) { + $form->field(name => "rcsinfo", value => "", force => 1); + } } $form->field(name => "do", type => 'hidden'); $form->field(name => "from", type => 'hidden'); $form->field(name => "rcsinfo", type => 'hidden'); $form->field(name => "subpage", type => 'hidden'); - $form->field(name => "page", value => $page, force => 1); + $form->field(name => "page", value => pagetitle($page, 1), force => 1); $form->field(name => "type", value => $type, force => 1); $form->field(name => "comments", type => "text", size => 80); $form->field(name => "editcontent", type => "textarea", rows => 20, @@ -354,18 +381,14 @@ sub cgi_editpage ($$) { #{{{ $form->tmpl_param("can_commit", $config{rcs}); $form->tmpl_param("indexlink", indexlink()); $form->tmpl_param("helponformattinglink", - htmllink("", "", "HelpOnFormatting", 1)); + htmllink("", "", "HelpOnFormatting", noimageinline => 1)); $form->tmpl_param("baseurl", baseurl()); - if (! $form->submitted) { - $form->field(name => "rcsinfo", value => rcs_prepedit($file), - force => 1); - } if ($form->submitted eq "Cancel") { - if ($newfile && defined $from) { + if ($form->field("do") eq "create" && defined $from) { redirect($q, "$config{url}/".htmlpage($from)); } - elsif ($newfile) { + elsif ($form->field("do") eq "create") { redirect($q, $config{url}); } else { @@ -374,18 +397,11 @@ sub cgi_editpage ($$) { #{{{ return; } elsif ($form->submitted eq "Preview") { - my $content=$form->field('editcontent'); - my $comments=$form->field('comments'); - $form->field(name => "editcontent", - value => $content, force => 1); - $form->field(name => "comments", - value => $comments, force => 1); - $config{rss}=$config{atom}=0; # avoid preview writing a feed! $form->tmpl_param("page_preview", htmlize($page, $type, linkify($page, "", preprocess($page, $page, - filter($page, $content))))); + filter($page, $form->field('editcontent')), 0, 1)))); } else { $form->tmpl_param("page_preview", ""); @@ -399,7 +415,7 @@ sub cgi_editpage ($$) { #{{{ my $best_loc; if (! defined $from || ! length $from || $from ne $form->field('from') || - $from=~/$config{wiki_file_prune_regexp}/ || + file_pruned($from, $config{srcdir}) || $from=~/^\// || $form->submitted eq "Preview") { @page_locs=$best_loc=$page; @@ -409,7 +425,7 @@ sub cgi_editpage ($$) { #{{{ $dir=~s![^/]+/+$!!; if ((defined $form->field('subpage') && length $form->field('subpage')) || - $page eq 'discussion') { + $page eq gettext('discussion')) { $best_loc="$from/$page"; } else { @@ -423,18 +439,26 @@ sub cgi_editpage ($$) { #{{{ push @page_locs, $dir.$page; } } + push @page_locs, "$config{userdir}/$page" + if length $config{userdir}; @page_locs = grep { - ! exists $pagecase{lc $_} && - ! page_locked($_, $session, 1) + ! exists $pagecase{lc $_} } @page_locs; - if (! @page_locs) { # hmm, someone else made the page in the # meantime? redirect($q, "$config{url}/".htmlpage($page)); return; } + + my @editable_locs = grep { + check_canedit($_, $q, $session, 1) + } @page_locs; + if (! @editable_locs) { + # let it throw an error this time + map { check_canedit($_, $q, $session) } @page_locs; + } my @page_types; if (exists $hooks{htmlize}) { @@ -443,13 +467,14 @@ sub cgi_editpage ($$) { #{{{ $form->tmpl_param("page_select", 1); $form->field(name => "page", type => 'select', - options => \@page_locs, value => $best_loc); + options => [ map { pagetitle($_, 1) } @editable_locs ], + value => pagetitle($best_loc, 1)); $form->field(name => "type", type => 'select', options => \@page_types); - $form->title("creating ".pagetitle($page)); + $form->title(sprintf(gettext("creating %s"), pagetitle($page))); } elsif ($form->field("do") eq "edit") { - page_locked($page, $session); + check_canedit($page, $q, $session); if (! defined $form->field('editcontent') || ! length $form->field('editcontent')) { my $content=""; @@ -463,78 +488,143 @@ sub cgi_editpage ($$) { #{{{ $form->tmpl_param("page_select", 0); $form->field(name => "page", type => 'hidden'); $form->field(name => "type", type => 'hidden'); - $form->title("editing ".pagetitle($page)); + $form->title(sprintf(gettext("editing %s"), pagetitle($page))); } print $form->render(submit => \@buttons); } else { # save page - page_locked($page, $session); + check_canedit($page, $q, $session); + if (! -e "$config{srcdir}/$file" && + $form->field("do") ne "create") { + $form->tmpl_param("page_gone", 1); + $form->field(name => "do", value => "create", force => 1); + $form->tmpl_param("page_select", 0); + $form->field(name => "page", type => 'hidden'); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), $page)); + print $form->render(submit => \@buttons); + return; + } + elsif (-e "$config{srcdir}/$file" && + $form->field("do") eq "create") { + $form->tmpl_param("creation_conflict", 1); + $form->field(name => "do", value => "edit", force => 1); + $form->tmpl_param("page_select", 0); + $form->field(name => "page", type => 'hidden'); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), $page)); + $form->field("editcontent", + value => readfile("$config{srcdir}/$file"). + "\n\n\n".$form->field("editcontent"), + force => 1); + print $form->render(submit => \@buttons); + return; + } my $content=$form->field('editcontent'); $content=~s/\r\n/\n/g; $content=~s/\r/\n/g; - writefile($file, $config{srcdir}, $content); - - my $message="web commit "; - if (defined $session->param("name") && - length $session->param("name")) { - $message.="by ".$session->param("name"); - } - else { - $message.="from $ENV{REMOTE_ADDR}"; - } - if (defined $form->field('comments') && - length $form->field('comments')) { - $message.=": ".$form->field('comments'); + + $config{cgi}=0; # avoid cgi error message + eval { writefile($file, $config{srcdir}, $content) }; + $config{cgi}=1; + if ($@) { + $form->field(name => "rcsinfo", value => rcs_prepedit($file), + force => 1); + $form->tmpl_param("failed_save", 1); + $form->tmpl_param("error_message", $@); + $form->field("editcontent", value => $content, force => 1); + $form->tmpl_param("page_select", 0); + $form->field(name => "page", type => 'hidden'); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), $page)); + print $form->render(submit => \@buttons); + return; } + my $conflict; if ($config{rcs}) { - if ($newfile) { + my $message=""; + if (defined $form->field('comments') && + length $form->field('comments')) { + $message=$form->field('comments'); + } + + if ($form->field("do") eq "create") { rcs_add($file); } - # prevent deadlock with post-commit hook - unlockwiki(); - # presumably the commit will trigger an update - # of the wiki - my $conflict=rcs_commit($file, $message, - $form->field("rcsinfo")); + + # Prevent deadlock with post-commit hook by + # signaling to it that it should not try to + # do anything (except send commit mails). + disable_commit_hook(); + $conflict=rcs_commit($file, $message, + $form->field("rcsinfo"), + $session->param("name"), $ENV{REMOTE_ADDR}); + enable_commit_hook(); + rcs_update(); + } - if (defined $conflict) { - $form->field(name => "rcsinfo", value => rcs_prepedit($file), - force => 1); - $form->tmpl_param("page_conflict", 1); - $form->field("editcontent", value => $conflict, force => 1); - $form->field(name => "comments", value => $form->field('comments'), force => 1); - $form->field("do", "edit)"); - $form->tmpl_param("page_select", 0); - $form->field(name => "page", type => 'hidden'); - $form->field(name => "type", type => 'hidden'); - $form->title("editing $page"); - print $form->render(submit => \@buttons); - return; - } + # Refresh even if there was a conflict, since other changes + # may have been committed while the post-commit hook was + # disabled. + require IkiWiki::Render; + refresh(); + saveindex(); + + if (defined $conflict) { + $form->field(name => "rcsinfo", value => rcs_prepedit($file), + force => 1); + $form->tmpl_param("page_conflict", 1); + $form->field("editcontent", value => $conflict, force => 1); + $form->field("do", "edit", force => 1); + $form->tmpl_param("page_select", 0); + $form->field(name => "page", type => 'hidden'); + $form->field(name => "type", type => 'hidden'); + $form->title(sprintf(gettext("editing %s"), $page)); + print $form->render(submit => \@buttons); + return; } else { - require IkiWiki::Render; - refresh(); - saveindex(); + # The trailing question mark tries to avoid broken + # caches and get the most recent version of the page. + redirect($q, "$config{url}/".htmlpage($page)."?updated"); } - - # The trailing question mark tries to avoid broken - # caches and get the most recent version of the page. - redirect($q, "$config{url}/".htmlpage($page)."?updated"); } } #}}} +sub cgi_getsession ($) { #{{{ + my $q=shift; + + eval q{use CGI::Session}; + CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname})); + + my $oldmask=umask(077); + my $session = CGI::Session->new("driver:DB_File", $q, + { FileName => "$config{wikistatedir}/sessions.db" }); + umask($oldmask); + + return $session; +} #}}} + +sub cgi_savesession ($) { #{{{ + my $session=shift; + + # Force session flush with safe umask. + my $oldmask=umask(077); + $session->flush; + umask($oldmask); +} #}}} + sub cgi (;$$) { #{{{ my $q=shift; my $session=shift; if (! $q) { - eval q{use CGI; use CGI::Session}; + eval q{use CGI}; error($@) if $@; $q=CGI->new; @@ -566,12 +656,7 @@ sub cgi (;$$) { #{{{ lockwiki(); if (! $session) { - CGI::Session->name("ikiwiki_session_".encode_utf8($config{wikiname})); - - my $oldmask=umask(077); - $session = CGI::Session->new("driver:DB_File", $q, - { FileName => "$config{wikistatedir}/sessions.db" }); - umask($oldmask); + $session=cgi_getsession($q); } # Auth hooks can sign a user in. @@ -587,51 +672,38 @@ sub cgi (;$$) { #{{{ email => "", password => "", regdate => time, - }); + }) || error("failed adding user"); } } } - - # Everything below this point needs the user to be signed in. - if (((! $config{anonok} || $do eq 'prefs') && - (! defined $session->param("name") || - ! userinfo_get($session->param("name"), "regdate"))) - || $do eq 'signin') { - if ($do ne 'signin' && ! defined $session->param("postsignin")) { - $session->param(postsignin => $ENV{QUERY_STRING}); - } - cgi_signin($q, $session); - # Force session flush with safe umask. - my $oldmask=umask(077); - $session->flush; - umask($oldmask); - - return; - } - elsif (defined $session->param("postsignin")) { - cgi_postsignin($q, $session); - } - - if (defined $session->param("name") && userinfo_get($session->param("name"), "banned")) { + if (defined $session->param("name") && + userinfo_get($session->param("name"), "banned")) { print $q->header(-status => "403 Forbidden"); $session->delete(); - print "You are banned."; - exit; + print gettext("You are banned."); + cgi_savesession($session); } - - if ($do eq 'create' || $do eq 'edit') { - cgi_editpage($q, $session); + elsif ($do eq 'signin') { + cgi_signin($q, $session); + cgi_savesession($session); + } + elsif (defined $session->param("postsignin")) { + cgi_postsignin($q, $session); } elsif ($do eq 'prefs') { cgi_prefs($q, $session); } + elsif ($do eq 'create' || $do eq 'edit') { + cgi_editpage($q, $session); + } elsif ($do eq 'blog') { - my $page=titlepage(decode_utf8($q->param('title'))); + my $page=decode_utf8($q->param('title')); + $page=~s/\///g; # no slashes in blog posts # if the page already exists, munge it to be unique my $from=$q->param('from'); my $add=""; - while (exists $pagecase{lc "$from/$page$add"}) { + while (exists $pagecase{lc($from."/".titlepage($page).$add)}) { $add=1 unless length $add; $add++; } @@ -640,6 +712,9 @@ sub cgi (;$$) { #{{{ $q->param('do', 'create'); cgi_editpage($q, $session); } + elsif ($do eq 'postsignin') { + error(gettext("login failed, perhaps you need to turn on cookies?")); + } else { error("unknown do parameter"); } @@ -654,10 +729,22 @@ sub userlink ($) { #{{{ eval q{use Net::OpenID::VerifiedIdentity; 1} && !$@) { # Munge user-urls, as used by eg, OpenID. my $oid=Net::OpenID::VerifiedIdentity->new(identity => $user); - return "".escapeHTML($oid->display).""; + my $display=$oid->display; + # Convert "user.somehost.com" to "user [somehost.com]". + if ($display !~ /\[/) { + $display=~s/^(.*?)\.([^.]+\.[a-z]+)$/$1 [$2]/; + } + # Convert "http://somehost.com/user" to "user [somehost.com]". + if ($display !~ /\[/) { + $display=~s/^https?:\/\/(.+)\/([^\/]+)$/$2 [$1]/; + } + $display=~s!^https?://!!; # make sure this is removed + return "".escapeHTML($display).""; } else { - return htmllink("", "", escapeHTML($user), 1); + return htmllink("", "", escapeHTML( + length $config{userdir} ? $config{userdir}."/".$user : $user + ), noimageinline => 1); } } #}}}