#!/usr/bin/perl -w # Webedit - a CGI website editor # Copyright Jonathan Riddell (jr@jriddell.org) 2001 # May be copied under the term of the GNU GPL only use strict; use CGI qw(:standard); # TODO: improve session management, maybe with cookies # Hopefully this script will be portable to other sites by changing these # variables. %passwords is obvious. $rootdir is where the webserver # points to - don't follow it with a slash. $this_script is URL of # this script. @forbidden is a list of file or directory names that are not allowed to # be edited - anything containing one of these will not be able to be # edited # Needs to be run with Apaches suexec (see man suexec) my %passwords = ( foo => 'bar', ); my $rootdir = "/www/vhtdocs/foo"; my $this_script = "http://www.example.com/cgi-bin/webedit"; my @forbidden = qw(template cgi-bin); my $logfile = $rootdir . "/webedit-log"; ######## open(LOG, ">>$logfile") or die "Failed to open log file: $!"; my $logmessage = ""; my $authenticated = 0; print header(-type => 'text/html'); print < Website Editor for u19s

Website Editor for u19s (Help!)

FIN if (checkpassword() ) {$authenticated = 1;} else {print "

Please enter username and password and file to open

";} print "

\n", 'username: ', " \n", 'password: ', " \n

"; if (param('newfile') && $authenticated) {newfile()} elsif (param('saveas') && $authenticated) {savefile(param('file')) } elsif (param('file') && $authenticated) {readfile(param('file')) } elsif (!param('file')) { param(-name=>'file', -value=>'/filename.html') } print "

\n", 'file: ', " \n", '', " \n"; if (param('file')) { print '', " \n",; } print '', "

\n"; print "\n"; logmessage($logmessage); # And now some subroutines #returns true is password and username match, else prints messasge and #returns false sub checkpassword { if (param('username') && param('password') && $passwords{param('username')} eq param('password')) { $logmessage .= "User: " . param('username') . " "; return 1; } elsif (param('username') && $passwords{param('username')}) { $logmessage .= "Incorrect password from " . param('username') . " "; print "

Incorrect password

"; return 0; } elsif (param('username') && (! $passwords{param('username')}) ) { $logmessage .= "Incorrect username: " . param('username') . " "; print "

Incorrect username

"; return 0; } else { return 0; } } #opens and prints the file if it may sub readfile { my $file = shift; my $first_char = substr($file, 0, 1); ($first_char ne '/') && ($file = '/' . $file); $file = $rootdir . $file; foreach (@forbidden) { if ($file =~ $_) { print "

You are not allowed to access that file or directory

"; $logmessage .= "Attempt to read forbidden file: $file "; return 0; } } if (!-e $file) { print "

That file does not exist - creating a new one

"; $logmessage .= "New file: $file "; newfile(); return 0; } -d $file && ($file .= "/index.html"); if (!-r $file) { print "

That file is not readable

"; $logmessage .= "Non readable file: $file "; return 0; } open (INFILE, $file) || die ("Could not open: $!"); print ''; $logmessage .= "File opened: $file "; } # readfile() #prints out textbox for a new file sub newfile { print <New File FIN $logmessage .= "New file "; } # newfile() # saves the text to the file # a lot of this is copied out of readfile() which means # something is probably badly designed sub savefile { my $file = shift; my $first_char = substr($file, 0, 1); ($first_char ne '/') && ($file = '/' . $file); $file = $rootdir . $file; foreach (@forbidden) { if ($file =~ $_) { print "

You are not allowed to access that file or directory

"; $logmessage .= "Attempt to save to forbidden file: $file "; return 0; } } if (!-e $file) { print "

That file does not exist - saving to new file

"; $logmessage .= "Saving to new file new file "; } -d $file && ($file .= "/index.html"); if (-e $file && !-w $file) { print "

You do not have permition to write to that file

"; $logmessage .="No permitions to save to file: $file "; return 0; } open (OUTFILE, ">$file") || die ("Could not open: $!"); print OUTFILE param('filetext'); close OUTFILE; chmod 0664, $file || print "

Could not change permitions on file

"; $logmessage .="Save to file: $file "; print "

Saved to $file

\n"; print ''; } sub logmessage { my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday) = localtime(time()); my $time = $mday.'/'.$mon.'/'.$year.' ' . $hour . ':' .$min. '.' . $sec; my $remote_address = $ENV{'REMOTE_HOST'}? $ENV{'REMOTE_HOST'} : $ENV{'REMOTE_ADDR'}; print LOG ($time . ' ' . $remote_address . ' ' . shift() . "\n"); }