SECURITY: check filenames in editor
[geekigeeki.git] / geekigeeki.py
index 764f3665de6fff91f4e773fc918cdae5adb65a7a..a7e99ed10121c9af816cfc76eddc0707edeeec94 100755 (executable)
@@ -3,7 +3,7 @@
 #
 # Copyright 1999, 2000 Martin Pool <mbp@humbug.org.au>
 # Copyright 2002 Gerardo Poggiali
-# Copyright 2007, 2008 Bernardo Innocenti <bernie@codewiz.org>
+# Copyright 2007, 2008 Bernie Innocenti <bernie@codewiz.org>
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -28,11 +28,12 @@ from os import path, environ
 
 # Regular expression defining a WikiWord
 # (but this definition is also assumed in other places)
-word_re = re.compile(r"^\b((([A-Z][a-z]+){2,}/)*([A-Z][a-z]+){2,})\b$")
+word_re = re.compile(r"^\b((([A-Z][a-z0-9]+){2,}/)*([A-Z][a-z0-9]+){2,})\b$")
 # FIXME: we accept stuff like foo/../bar and we shouldn't
 file_re = re.compile(r"^\b([A-Za-z0-9_\-][A-Za-z0-9_\.\-/]*)\b$")
-img_re = re.compile(r"^.*\.(png|gif|jpg|jpeg)$", re.IGNORECASE)
+img_re = re.compile(r"^.*\.(png|gif|jpg|jpeg|bmp|ico)$", re.IGNORECASE)
 url_re = re.compile(r"^[a-z]{3,8}://[^\s'\"]+\S$")
+link_re = re.compile("(?:\[\[|{{)([^\s\|]+)(?:\s*\|\s*([^\]]+)|)(?:\]\]|}})")
 
 title_done = False
 
@@ -70,8 +71,10 @@ def relative_url(pathname, privileged=False):
         pathname = url + '/' + pathname
     return pathname
 
-# Formatting stuff --------------------------------------------------
+def permalink(s):
+    return re.sub(' ', '-', re.sub('[^a-z0-9_ ]', '', s.lower()).strip())
 
+# Formatting stuff --------------------------------------------------
 def emit_header(mime_type="text/html"):
     print "Content-type: " + mime_type + "; charset=utf-8\n"
 
@@ -82,7 +85,7 @@ def send_guru(msg_text, msg_type):
         print '    Software Failure.  Press left mouse button to continue.\n'
     print msg_text
     if msg_type == 'error':
-        print '      Guru Meditation #DEADBEEF.ABADC0DE'
+        print '\n      Guru Meditation #DEADBEEF.ABADC0DE'
     print '</pre>'
     # FIXME: This little JS snippet is harder to pass than ACID 3.0 
     print """
@@ -107,7 +110,7 @@ def send_guru(msg_text, msg_type):
         }
     </script>"""
 
-def send_title(name, text="Limbo", msg_text=None, msg_type='error'):
+def send_title(name, text="Limbo", msg_text=None, msg_type='error', writable=False):
     global title_done
     if title_done: return
 
@@ -122,12 +125,23 @@ def send_title(name, text="Limbo", msg_text=None, msg_type='error'):
     print ' <meta http-equiv="Content-Type" content="application/xhtml+xml; charset=utf-8" />'
     if not name:
         print ' <meta name="robots" content="noindex,nofollow" />'
-    for css in css_url:
-        print ' <link rel="stylesheet" type="text/css" href="%s" />' % relative_url(css)
+
+    for link in link_urls:
+        rel, href = link
+        print ' <link rel="%s" href="%s" />' % (rel, relative_url(href))
+
+    if name and writable and privileged_url is not None:
+        print ' <link rel="alternate" type="application/x-wiki" title="Edit this page" href="%s" />' \
+            % (privileged_path() + '?edit=' + name)
+
+    if history_url is not None:
+        print ' <link rel="alternate" type="application/rss+xml" title="RSS" href="%s" />' \
+            % relative_url(history_url + '?a=rss')
+
     print '</head>'
 
     # Body
-    if name and privileged_url is not None:
+    if name and writable and privileged_url is not None:
         print '<body ondblclick="location.href=\'' + privileged_path() + '?edit=' + name + '\'">'
     else:
         print '<body>'
@@ -137,22 +151,25 @@ def send_title(name, text="Limbo", msg_text=None, msg_type='error'):
 
     # Navbar
     print '<div class="nav">'
-    print '  <b>' + site_name + ': ',
     if name:
-        print link_tag('?fullsearch=' + name, text, 'navlink') + '</b> '
+        print '  <b>' + link_tag('?fullsearch=' + name, text, 'navlink') + '</b> '
     else:
-        print text + '</b> '
-    print ' | ' + link_tag('FrontPage', 'Front Page', 'navlink')
+        print '  <b>' + text + '</b> '
+    print ' | ' + link_tag('FrontPage', 'Home', 'navlink')
     print ' | ' + link_tag('FindPage', 'Find Page', 'navlink')
-    if globals().has_key('history_url'):
-        print ' | <a href="' + history_url + '" class="navlink">Recent Changes</a>'
+    if 'history_url' in globals():
+        print ' | <a href="' + relative_url(history_url) + '" class="navlink">Recent Changes</a>'
         if name:
-            print ' | <a href="' + history_url + '?a=history;f=' + name + '" class="navlink">Page History</a>'
+            print ' | <a href="' + relative_url(history_url + '?a=history;f=' + name) + '" class="navlink">Page History</a>'
 
     if name:
         print ' | ' + link_tag('?raw=' + name, 'Raw Text', 'navlink')
         if privileged_url is not None:
-            print ' | ' + link_tag('?edit=' + name, 'Edit Page', 'navlink', privileged=True)
+            if writable:
+                print ' | ' + link_tag('?edit=' + name, 'Edit', 'navlink', privileged=True)
+            else:
+                print ' | ' + link_tag(name, 'Login', 'navlink', privileged=True)
+
     else:
         print ' | <i>Immutable Page</i>'
 
@@ -162,6 +179,11 @@ def send_title(name, text="Limbo", msg_text=None, msg_type='error'):
 
     print '<hr /></div>'
 
+def send_httperror(status="403 Not Found", query=""):
+    print "Status: %s" % status
+    send_title(None, msg_text=("%s: on query '%s'" % (status, query)))
+    send_footer(None)
+
 def link_tag(params, text=None, ss_class=None, privileged=False):
     if text is None:
         text = params # default
@@ -177,7 +199,7 @@ def link_tag(params, text=None, ss_class=None, privileged=False):
 
 # Search ---------------------------------------------------
 
-def do_fullsearch(needle):
+def handle_fullsearch(needle):
     send_title(None, 'Full text search for "%s"' % (needle))
 
     needle_re = re.compile(needle, re.IGNORECASE)
@@ -204,7 +226,7 @@ def do_fullsearch(needle):
 
     print_search_stats(len(hits), len(all_pages))
 
-def do_titlesearch(needle):
+def handle_titlesearch(needle):
     # TODO: check needle is legal -- but probably we can just accept any RE
     send_title(None, "Title search for \"" + needle + '"')
 
@@ -222,109 +244,59 @@ def do_titlesearch(needle):
 def print_search_stats(hits, searched):
     print "<p>%d hits out of %d pages searched.</p>" % (hits, searched)
 
-def do_raw(pagename):
+def handle_raw(pagename):
+    if not file_re.match(pagename):
+        send_httperror("403 Forbidden", pagename)
+        return
+
     Page(pagename).send_raw()
 
-def do_edit(pagename):
+def handle_edit(pagename):
+    if not file_re.match(pagename):
+        send_httperror("403 Forbidden", pagename)
+        return
+
     pg = Page(pagename)
-    if 'preview' in form:
-        pg.send_editor(form['savetext'].value)
-    elif 'save' in form:
-        pg.save_text(form['savetext'].value)
-        pg.send_page()
+    if 'save' in form:
+        if form['file'].value:
+            pg.save(form['file'].file.read(), form['changelog'].value)
+        else:
+            pg.save(form['savetext'].value.replace('\r\n', '\n'), form['changelog'].value)
+        pg.format()
     elif 'cancel' in form:
         pg.msg_text = 'Editing canceled'
         pg.msg_type = 'notice'
-        pg.send_page()
-    else:
-        pg.send_editor()
+        pg.format()
+    else: # preview or edit
+        text = None
+        if 'preview' in form:
+            text = form['savetext'].value
+        pg.send_editor(text)
 
 def make_index_key():
     links = map(lambda ch: '<a href="#%s">%s</a>' % (ch, ch), 'abcdefghijklmnopqrstuvwxyz')
     return '<p><center>'+ ' | '.join(links) + '</center></p>'
 
-def page_list():
-    return filter(word_re.match, os.listdir(data_dir))
+def page_list(dir = None, re = word_re):
+    return sorted(filter(re.match, os.listdir(dir or data_dir)))
 
 def send_footer(name, mod_string=None):
     if globals().get('debug_cgi', False):
         cgi.print_arguments()
-        cgi.print_form(cgi.FieldStorage())
+        cgi.print_form(form)
         cgi.print_environ()
-    print '<div id="footer"><hr />'
-    print ('<p class="copyright"><span class="benchmark">generated in %0.3fs</span>' +
-        ' by <a href="http://www.codewiz.org/wiki/GeekiGeeki">GeekiGeeki</a>' +
-        ' version %s</p>') % (clock() - start_time, __version__)
+    print '''
+<div id="footer"><hr />
+<p class="copyright">
+<a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/"><img class="license" alt="Creative Commons License" src="http://i.creativecommons.org/l/by-sa/3.0/80x15.png" /></a>
+<span class="benchmark">generated in %0.3fs</span> by <a href="http://www.codewiz.org/wiki/GeekiGeeki">GeekiGeeki</a> version %s
+</p>
+''' % (clock() - start_time, __version__)
     if mod_string:
         print '<p class="modified">last modified %s</p>' % mod_string
     print '</div></body></html>'
 
-# ----------------------------------------------------------
-# Macros
-def _macro_TitleSearch(*vargs):
-    return _macro_search("titlesearch")
-
-def _macro_FullSearch(*vargs):
-    return _macro_search("fullsearch")
-
-def _macro_search(type):
-    if form.has_key('value'):
-        default = form["value"].value
-    else:
-        default = ''
-    return """<form method="get"><input name="%s" size="30" value="%s" /><input type="submit" value="Search" /></form>""" % (type, default)
-
-def _macro_WordIndex(*vargs):
-    s = make_index_key()
-    pages = list(page_list())
-    map = {}
-    word_re = re.compile('[A-Z][a-z]+')
-    for name in pages:
-        for word in word_re.findall(name):
-            try:
-                map[word].append(name)
-            except KeyError:
-                map[word] = [name]
-
-    all_words = map.keys()
-    all_words.sort()
-    last_letter = None
-    # set title
-    for word in all_words:
-        letter = word[0].lower()
-        if letter != last_letter:
-            s = s + '; <a name="%s"><h3>%s</h3></a>' % (letter, letter)
-            last_letter = letter
-
-        s = s + '<b>%s</b><ul>' % word
-        links = map[word]
-        links.sort()
-        last_page = None
-        for name in links:
-            if name == last_page: continue
-            s = s + '<li>' + Page(name).link_to()
-        s = s + '</ul>'
-    return s
-
-
-def _macro_TitleIndex(*vargs):
-    s = make_index_key()
-    pages = list(page_list())
-    pages.sort()
-    current_letter = None
-    for name in pages:
-        letter = name[0].lower()
-        if letter != current_letter:
-            s += '<a name="%s"><h3>%s</h3></a>' % (letter, letter)
-            current_letter = letter
-        else:
-            s += '<br />'
-        s += Page(name).link_to()
-    return s
-
-
-# ----------------------------------------------------------
-class PageFormatter:
+class WikiFormatter:
     """Object that turns Wiki markup into HTML.
 
     All formatting commands can be parsed one line at a time, though
@@ -333,10 +305,10 @@ class PageFormatter:
     def __init__(self, raw):
         self.raw = raw
         self.h_level = 0
-        self.in_pre = self.in_table = False
+        self.in_pre = self.in_html = self.in_table = self.in_li = False
         self.in_header = True
         self.list_indents = []
-        self.tr_cnt = self.h_cnt = 0
+        self.tr_cnt = 0
         self.styles = {
             #wiki   html   enabled?
             "//":  ["em",  False],
@@ -357,13 +329,12 @@ class PageFormatter:
 
     def _tit_repl(self, word):
         if self.h_level:
-            result = '</h%d>' % self.h_level
+            result = '</h%d><p>\n' % self.h_level
             self.h_level = 0
         else:
             self.h_level = len(word) - 1
-            self.h_cnt += 1
-            #abridged = re.sub('[^a-z_]', '', word.lower().replace(' ', '_'))
-            result = '<h%d id="%d"><a class="heading" href="#%d">¶</a> ' % (self.h_level, self.h_cnt, self.h_cnt)
+            link = permalink(self.line)
+            result = '\n</p><h%d id="%s"><a class="heading" href="#%s">¶</a> ' % (self.h_level, link, link)
         return result
 
     def _br_repl(self, word):
@@ -385,37 +356,75 @@ class PageFormatter:
         else:
             return '<a href="%s" rel="nofollow" class="external">%s</a>' % (word, word)
 
-    def _hurl_repl(self, word):
-        m = re.compile("\[\[([^ \t\n\r\f\v\|]+)(?:\s*\|\s*([^\]]+)|)\]\]").match(word)
+    def _macro_repl(self, word):
+        m = re.compile("\<\<([^\s\|\>]+)(?:\s*\|\s*([^\>]+)|)\>\>").match(word)
         name = m.group(1)
-        descr = m.group(2) or name
+        argv = [name]
+        if m.group(2):
+            argv.extend(m.group(2).split('|'))
+        argv = map(str.strip, argv)
 
         macro = globals().get('_macro_' + name)
+        if not macro:
+            execfile("macros/" + name + ".py", globals())
+            macro = globals().get('_macro_' + name)
         if macro:
-            return apply(macro, (name, descr))
-        elif img_re.match(name):
-            name = relative_url(name)
-            # The "extthumb" nonsense works around a limitation of the HTML block model
-            return '<div class="extthumb"><div class="thumb"><a href="%s"><img border="0" src="%s" alt="%s" /></a><div class="caption">%s</div></div></div>' % (name, name, descr, descr)
+            return macro(argv)
+        else:
+            return '<strong class="error">&lt;&lt;' + '|'.join(argv) + '&gt;&gt;</strong>'
+
+    def _hurl_repl(self, word):
+        m = link_re.match(word)
+        name = m.group(1)
+        descr = m.group(2)
+        if descr is None:
+            descr = name
+        elif img_re.match(m.group(2)):
+            descr = '<img border="0" src="' + descr + '" />'
+
+        return link_tag(name, descr, 'wikilink')
+
+    def _inl_repl(self, word):
+        m = link_re.match(word)
+        name = m.group(1)
+        descr = m.group(2) or name
+        name = relative_url(name)
+        argv = descr.split('|')
+        descr = argv.pop(0)
+
+        if argv:
+            args = '?' + '&amp;'.join(argv)
         else:
-            if img_re.match(descr):
-                descr = '<img border="0" src="' + descr + '" />'
+            args = ''
 
-            return link_tag(name, descr, 'wikilink')
+        if descr:
+            # The "extthumb" nonsense works around a limitation of the HTML block model
+            return '<div class="extthumb"><div class="thumb"><a href="%s"><img border="0" src="%s" alt="%s" /></a><div class="caption">%s</div></div></div>' \
+                    % (name, name + args, descr, descr)
+        else:
+            return '<a href="%s"><img border="0" src="%s" /></a>' % (name, name + args)
 
     def _email_repl(self, word):
         return '<a href="mailto:%s">%s</a>' % (word, word)
 
     def _html_repl(self, word):
+        self.in_html += 1
         return word; # Pass through
 
     def _ent_repl(self, s):
+        if self.in_html and s == '>':
+            self.in_html -= 1
+            return '>'
         return {'&': '&amp;',
                 '<': '&lt;',
                 '>': '&gt;'}[s]
 
     def _li_repl(self, match):
-        return '<li>'
+        if self.in_li:
+            return '</li><li>'
+        else:
+            self.in_li = True
+            return '<li>'
 
     def _pre_repl(self, word):
         if word == '{{{' and not self.in_pre:
@@ -458,6 +467,9 @@ class PageFormatter:
         s = '</p>'
         while self._indent_level() > new_level:
             del(self.list_indents[-1])
+            if self.in_li:
+                s += '</li>'
+                self.in_li = False # FIXME
             s += '</ul>\n'
         while self._indent_level() < new_level:
             self.list_indents.append(new_level)
@@ -475,7 +487,7 @@ class PageFormatter:
     def replace(self, match):
         for type, hit in match.groupdict().items():
             if hit:
-                return apply(getattr(self, '_' + type + '_repl'), (hit,))
+                return getattr(self, '_' + type + '_repl')(hit)
         else:
             raise "Can't handle match " + `match`
 
@@ -492,20 +504,26 @@ class PageFormatter:
             + r"|(?P<tit>\={2,6})"
             + r"|(?P<br>\\\\)"
             + r"|(?P<rule>^-{3,})"
-            + r"|(?P<html><(/|)(div|span|iframe)[^<>]*>)"
-            + r"|(?P<ent>[<>&])"
             + r"|(?P<hi>\b(FIXME|TODO|DONE)\b)"
 
             # Links
-            + r"|(?P<img>\b[a-zA-Z0-9_-]+\.(png|gif|jpg|jpeg|bmp))"
+            + r"|(?P<macro>\<\<([^\s\|\>]+)(?:\s*\|\s*([^\>]+)|)\>\>)"
+            + r"|(?P<hurl>\[\[([^\s\|]+)(?:\s*\|\s*([^\]]+)|)\]\])"
+
+            # Inline HTML
+            + r"|(?P<html><(/|)(br|hr|div|form|iframe|input|span))"
+            + r"|(?P<ent>[<>&])"
+
+            # Auto links (LEGACY)
+            + r"|(?P<img>\b[a-zA-Z0-9_/-]+\.(png|gif|jpg|jpeg|bmp|ico))"
             + r"|(?P<word>\b(?:[A-Z][a-z]+){2,}\b)"
-            + r"|(?P<hurl>\[\[([^ \t\n\r\f\v\|]+)(?:\s*\|\s*([^\]]+)|)\]\])"
             + r"|(?P<url>(http|https|ftp|mailto)\:[^\s'\"]+\S)"
             + r"|(?P<email>[-\w._+]+\@[\w.-]+)"
 
             # Lists, divs, spans
             + r"|(?P<li>^\s+[\*#] +)"
             + r"|(?P<pre>\{\{\{|\s*\}\}\})"
+            + r"|(?P<inl>\{\{([^\s\|]+)(?:\s*\|\s*([^\]]+)|)\}\})"
 
             # Tables
             + r"|(?P<tr>^\s*\|\|(=|)\s*)"
@@ -521,33 +539,32 @@ class PageFormatter:
         indent_re = re.compile(r"^\s*")
         tr_re = re.compile(r"^\s*\|\|")
         eol_re = re.compile(r"\r?\n")
-        for line in eol_re.split(self.raw.expandtabs()):
+        for self.line in eol_re.split(self.raw.expandtabs()):
             # Skip ACLs
             if self.in_header:
-                if line.startswith('#'):
+                if self.line.startswith('#'):
                     continue
                 self.in_header = False
 
             if self.in_pre:
-                print re.sub(pre_re, self.replace, line)
+                print re.sub(pre_re, self.replace, self.line)
             else:
-                if self.in_table and not tr_re.match(line):
+                if self.in_table and not tr_re.match(self.line):
                     self.in_table = False
                     print '</tbody></table><p>'
 
-                if blank_re.match(line):
+                if blank_re.match(self.line):
                     print '</p><p>'
                 else:
-                    indent = indent_re.match(line)
+                    indent = indent_re.match(self.line)
                     print self._indent_to(len(indent.group(0)))
-                    print re.sub(scan_re, self.replace, line)
+                    print re.sub(scan_re, self.replace, self.line)
 
         if self.in_pre: print '</pre>'
         if self.in_table: print '</tbody></table><p>'
         print self._undent()
         print '</p></div>'
 
-# ----------------------------------------------------------
 class Page:
     def __init__(self, page_name):
         self.page_name = page_name
@@ -558,7 +575,7 @@ class Page:
         # look for the end of words and the start of a new word and insert a space there
         return re.sub('([a-z])([A-Z])', r'\1 \2', self.page_name)
 
-    def _text_filename(self):
+    def _filename(self):
         return path.join(data_dir, self.page_name)
 
     def _tmp_filename(self):
@@ -566,7 +583,7 @@ class Page:
 
     def exists(self):
         try:
-            os.stat(self._text_filename())
+            os.stat(self._filename())
             return True
         except OSError, er:
             if er.errno == errno.ENOENT:
@@ -582,20 +599,36 @@ class Page:
 
     def get_raw_body(self):
         try:
-            return open(self._text_filename(), 'rb').read()
+            return open(self._filename(), 'rb').read()
         except IOError, er:
             if er.errno == errno.ENOENT:
                 return '' # just doesn't exist, use default
             if er.errno == errno.EISDIR:
-                return 'DIR'
+                return self.format_dir()
             raise er
 
+    def format_dir(self):
+        out = '== '
+        path = ''
+        for dir in self.page_name.split('/'):
+            path = (path + '/' + dir) if path else dir
+            out += '[[' + path + '|' + dir + ']]/'
+        out += ' ==\n'
+        for file in page_list(self._filename(), file_re):
+            if img_re.match(file):
+                if image_maxwidth:
+                    maxwidth_arg = '|maxwidth=' + str(image_maxwidth)
+                out += '{{' + self.page_name + '/' + file + '|' + file + maxwidth_arg + '}}\n'
+            else:
+                out += ' * [[' + self.page_name + '/' + file + ']]\n'
+        return out
     def get_attrs(self):
-        if self.__dict__.has_key('attrs'):
+        if 'attrs' in self.__dict__:
             return self.attrs
         self.attrs = {}
         try:
-            file = open(self._text_filename(), 'rt')
+            file = open(self._filename(), 'rt')
             attr_re = re.compile(r"^#(\S*)(.*)$")
             for line in file:
                 m = attr_re.match(line)
@@ -604,7 +637,7 @@ class Page:
                 self.attrs[m.group(1)] = m.group(2).strip()
                 #print "bernie: attrs[" + m.group(1) + "] = " + m.group(2) + "<br>\n"
         except IOError, er:
-            if er.errno != errno.ENOENT:
+            if er.errno != errno.ENOENT and er.errno != errno.EISDIR:
                 raise er
         return self.attrs
 
@@ -612,6 +645,7 @@ class Page:
         return self.get_attrs().get(name, default)
 
     def can(self, action, default=True):
+        acl = None
         try:
             #acl SomeUser:read,write All:read
             acl = self.get_attr("acl", None)
@@ -621,7 +655,8 @@ class Page:
                     return action in perms.split(',')
             return False
         except Exception, er:
-            pass
+            if acl:
+                self.msg_text = 'Illegal acl line: ' + acl
         return default
 
     def can_write(self):
@@ -630,26 +665,28 @@ class Page:
     def can_read(self):
         return self.can("read", True)
 
-    def send_page(self):
-        page_name = None
-        if self.can_write():
-            page_name = self.page_name
-
-        #css foo.css bar.css
-        global css_url
-        css_url = self.get_attr("css", "").split() + css_url
-
-        send_title(page_name, self.split_title(), msg_text=self.msg_text, msg_type=self.msg_type)
+    def send_naked(self):
         if self.can_read():
-            PageFormatter(self.get_raw_body()).print_html()
+            WikiFormatter(self.get_raw_body()).print_html()
         else:
             send_guru("Read access denied by ACLs", "notice")
-        send_footer(page_name, self._last_modified())
+
+    def format(self):
+        #css foo.css
+        value = self.get_attr("css", None)
+        if value:
+            global link_urls
+            link_urls += [ [ "stylesheet", value ] ]
+
+        send_title(self.page_name, self.split_title(),
+            msg_text=self.msg_text, msg_type=self.msg_type, writable=self.can_write())
+        self.send_naked()
+        send_footer(self.page_name, self._last_modified())
 
     def _last_modified(self):
         try:
             from time import localtime, strftime
-            modtime = localtime(os.stat(self._text_filename())[stat.ST_MTIME])
+            modtime = localtime(os.stat(self._filename())[stat.ST_MTIME])
         except OSError, er:
             if er.errno != errno.ENOENT:
                 raise er
@@ -662,25 +699,37 @@ class Page:
             send_guru("Write access denied by ACLs", "error")
             return
 
+        file = ''
+        if 'file' in form:
+            file = form['file'].value
+
         print ('<p><b>Editing ' + self.page_name
             + ' for ' + cgi.escape(remote_user())
             + ' from ' + cgi.escape(get_hostname(remote_host()))
             + '</b></p>')
-        print '<div class="editor"><form method="post" action="%s">' % relative_url(self.page_name)
+        print '<div class="editor"><form name="editform" method="post" enctype="multipart/form-data" action="%s">' % relative_url(self.page_name)
         print '<input type="hidden" name="edit" value="%s">' % (self.page_name)
-        print """<textarea wrap="off" spellcheck="true" id="editor" name="savetext" rows="17" cols="100">%s</textarea>""" % (preview or self.get_raw_body())
+        print '<input type="input" id="editor" name="changelog" value="Edit page %s" accesskey="c" /><br />' % (self.page_name)
+        print '<textarea wrap="off" spellcheck="true" id="editor" name="savetext" rows="17" cols="100" accesskey="e">%s</textarea>' % (preview or self.get_raw_body())
+        print '<label for="file" accesskey="u">Or Upload a file:</label> <input type="file" name="file" value="%s" />' % file
         print """
             <br />
-            <input type="submit" name="save" value="Save" />
-            <input type="submit" name="preview" value="Preview" />
+            <input type="submit" name="save" value="Save" accesskey="s">
+            <input type="submit" name="preview" value="Preview" accesskey="p" />
             <input type="reset" value="Reset" />
             <input type="submit" name="cancel" value="Cancel" />
             <br />
-            </form></div>"""
+            </form></div>
+            <script language="javascript">
+            <!--
+            document.editform.savetext.focus()
+            //-->
+            </script>
+            """
         print "<p>" + Page('EditingTips').link_to() + "</p>"
         if preview:
             print "<div class='preview'>"
-            PageFormatter(preview).print_html()
+            WikiFormatter(preview).print_html()
             print "</div>"
         send_footer(self.page_name)
 
@@ -692,32 +741,43 @@ class Page:
         else:
             send_title(None, msg_text='Read access denied by ACLs', msg_type='notice')
 
-    def _write_file(self, text):
+    def send_image(self, mimetype, args=[]):
+        if 'maxwidth' in args:
+            import subprocess
+            emit_header(mimetype)
+            sys.stdout.flush()
+            subprocess.check_call(['gm', 'convert', self._filename(),
+                '-scale', args['maxwidth'].value + ' >', '-'])
+        else:
+            self.send_raw(mimetype)
+
+    def _write_file(self, data):
         tmp_filename = self._tmp_filename()
-        open(tmp_filename, 'wt').write(text.replace('\r\n', '\n'))
-        text = self._text_filename()
+        open(tmp_filename, 'wb').write(data)
+        name = self._filename()
         if os.name == 'nt':
             # Bad Bill!  POSIX rename ought to replace. :-(
             try:
-                os.remove(text)
+                os.remove(name)
             except OSError, er:
                 if er.errno != errno.ENOENT: raise er
-        os.rename(tmp_filename, text)
+        os.rename(tmp_filename, name)
 
-    def save_text(self, newtext):
+    def save(self, newdata, changelog):
         if not self.can_write():
             self.msg_text = 'Write access denied by ACLs'
             self.msg_type = 'error'
             return
 
-        self._write_file(newtext)
+        self._write_file(newdata)
         rc = 0
         if post_edit_hook:
             # FIXME: what's the std way to perform shell quoting in python?
             cmd = ( post_edit_hook
                 + " '" + data_dir + '/' + self.page_name
                 + "' '" + remote_user()
-                + "' '" + remote_host() + "'"
+                + "' '" + remote_host()
+               + "' '" + changelog + "'"
             )
             out = os.popen(cmd)
             output = out.read()
@@ -735,16 +795,11 @@ class Page:
 try:
     execfile("geekigeeki.conf.py")
     form = cgi.FieldStorage()
-    handlers = {
-        'fullsearch':  do_fullsearch,
-        'titlesearch': do_titlesearch,
-        'edit':        do_edit,
-        'raw':         do_raw,
-    }
-
-    for cmd in handlers.keys():
-        if form.has_key(cmd):
-            apply(handlers[cmd], (form[cmd].value,))
+
+    for cmd in form:
+        handler = globals().get('handle_' + cmd)
+        if handler:
+            handler(form[cmd].value)
             break
     else:
         path_info = environ.get('PATH_INFO', '')
@@ -755,14 +810,21 @@ try:
 
         if file_re.match(query):
             if word_re.match(query):
-                Page(query).send_page()
+                Page(query).format()
             else:
                 from mimetypes import MimeTypes
                 type, encoding = MimeTypes().guess_type(query)
-                Page(query).send_raw(mimetype=type)
+                #type = type or 'text/plain'
+                #Page(query).send_raw(mimetype=type)
+                if type:
+                    if type.startswith('image/'):
+                        Page(query).send_image(mimetype=type,args=form)
+                    else:
+                        Page(query).send_raw(mimetype=type)
+                else:
+                    Page(query).format()
         else:
-            print "Status: 404 Not Found"
-            send_title(None, msg_text='Can\'t work out query: ' + query)
+            send_httperror("403 Forbidden", query)
 except Exception:
     import traceback
     msg_text = traceback.format_exc()