wiki: Fix authorisation handling when editing pages

This is now a proper handler which uses the @authenticated decorator
which redirects people to the correct login URL.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/templates/wiki/404.html b/src/templates/wiki/404.html
index b09d76f2867ef7d3df79d69a7acd666c278b3255..9fc12c04858fb2691747e9861f53a4a9f738e431 100644 (file)
--- a/src/templates/wiki/404.html
+++ b/src/templates/wiki/404.html
@@ -15,7 +15,7 @@
                         {{ _("This wiki page does not exist, yet.") }}
                     </p>
 
-                    <a class="btn btn-primary btn-block" href="{{ request.path }}?action=edit">
+                    <a class="btn btn-primary btn-block" href="/actions/edit/{{ request.path }}">
                         {{ _("Create Now") }}
                     </a>
                 </div>

diff --git a/src/templates/wiki/page.html b/src/templates/wiki/page.html
index 9e5979694cae9c544d93c254c8c136dab9f3b7aa..c6ba9e3fa52152025851ff8a6e5769c6d7dd751e 100644 (file)
--- a/src/templates/wiki/page.html
+++ b/src/templates/wiki/page.html
@@ -17,7 +17,7 @@
                </div>
        </div>
 
-       <a class="btn btn-primary btn-block mb-3" href="{{ request.path }}?action=edit">
+       <a class="btn btn-primary btn-block mb-3" href="/actions/edit{{ request.path }}">
                <span class="fas fa-edit mr-2"></span> {{ _("Edit Page") }}
                {% if not current_user %}&dash; {{ _("Yes, you can edit!") }}{% end %}
        </a>

diff --git a/src/web/__init__.py b/src/web/__init__.py
index ae86c52c58d031e00d2480a8f2dd77bb5f2545bd..7535e68629e4037a6846bb841aa031c1ef5af366 100644 (file)
--- a/src/web/__init__.py
+++ b/src/web/__init__.py
@@ -289,7 +289,7 @@ class Application(tornado.web.Application):
                        authentication_handlers + [
 
                        # Actions
-                       (r"/actions/edit", wiki.ActionEditHandler),
+                       (r"/actions/edit([A-Za-z0-9\-_\/]+)", wiki.ActionEditHandler),
                        (r"/action/(watch|unwatch)(.*)", wiki.ActionWatchHandler),
                        (r"/actions/upload", wiki.ActionUploadHandler),
 

diff --git a/src/web/wiki.py b/src/web/wiki.py
index 76433dc73dda3d4e6c76e98203f2b77164251baf..ab43c8b3ad783976200bd39c866c6a579d8ed785 100644 (file)
--- a/src/web/wiki.py
+++ b/src/web/wiki.py
@@ -9,9 +9,23 @@ from . import ui_modules
 
 class ActionEditHandler(auth.CacheMixin, base.BaseHandler):
        @tornado.web.authenticated
-       def post(self):
-               path = self.get_argument("path")
+       def get(self, path):
+               # Check permissions
+               if not self.backend.wiki.check_acl(path, self.current_user):
+                       raise tornado.web.HTTPError(403, "Access to %s not allowed for %s" % (path, self.current_user))
+
+               # Fetch the wiki page
+               page = self.backend.wiki.get_page(path)
 
+               # Empty page if it was deleted
+               if page and page.was_deleted():
+                       page = None
+
+               # Render page
+               self.render("wiki/edit.html", page=page)
+
+       @tornado.web.authenticated
+       def post(self, path):
                # Check permissions
                if not self.backend.wiki.check_acl(path, self.current_user):
                        raise tornado.web.HTTPError(403, "Access to %s not allowed for %s" % (path, self.current_user))
@@ -192,19 +206,6 @@ class PageHandler(auth.CacheMixin, base.BaseHandler):
                        self.render("wiki/diff.html", page=page, a=a, b=b)
                        return
 
-               # Edit
-               elif self.action == "edit":
-                       if not self.current_user:
-                               raise tornado.web.HTTPError(401)
-
-                       # Empty page if it was deleted
-                       if page and page.was_deleted():
-                               page = None
-
-                       # Render page
-                       self.render("wiki/edit.html", page=page)
-                       return
-
                # Revisions
                elif self.action == "revisions":
                        self.render("wiki/revisions.html", page=page)