Merge pull request #898 from bambycha/editable

Disable editing from UI

lib/gollum/app.rb

@@ -13,6 +13,8 @@ require 'gollum/views/has_page'
 
 require File.expand_path '../helpers', __FILE__
 
+require 'gollum/editing_auth'
+
 #required to upload bigger binary files
 Gollum::set_git_timeout(120)
 Gollum::set_git_max_filesize(190 * 10**6)
@@ -42,6 +44,7 @@ module Precious
   class App < Sinatra::Base
     register Mustache::Sinatra
     include Precious::Helpers
+    use Precious::EditingAuth
 
     dir     = File.dirname(File.expand_path(__FILE__))
 
@@ -91,6 +94,8 @@ module Precious
       settings.wiki_options.merge!({ :base_path => @base_url })
       @css = settings.wiki_options[:css]
       @js  = settings.wiki_options[:js]
+      @mathjax_config = settings.wiki_options[:mathjax_config]
+      @allow_editing = settings.wiki_options[:allow_editing]
     end
 
     get '/' do
@@ -105,7 +110,6 @@ module Precious
     # name, path, version
     def wiki_page(name, path = nil, version = nil, exact = true)
       wiki = wiki_new
-
       path = name if path.nil?
       name = extract_name(name) || wiki.index_page
       path = extract_path(path)
@@ -126,6 +130,7 @@ module Precious
     end
 
     get '/edit/*' do
+      forbid unless @allow_editing
       wikip = wiki_page(params[:splat].first)
       @name = wikip.name
       @path = wikip.path
@@ -253,6 +258,7 @@ module Precious
     end
 
     get '/delete/*' do
+      forbid unless @allow_editing
       wikip = wiki_page(params[:splat].first)
       name  = wikip.name
       wiki  = wikip.wiki
@@ -267,6 +273,7 @@ module Precious
     end
 
     get '/create/*' do
+      forbid unless @allow_editing
       wikip = wiki_page(params[:splat].first.gsub('+', '-'))
       @name = wikip.name.to_url
       @path = wikip.path
@@ -476,6 +483,7 @@ module Precious
       elsif file = wiki.file(fullpath, wiki.ref, true)
         show_file(file)
       else
+        not_found unless @allow_editing
         page_path = [path, name].compact.join('/')
         redirect to("/create/#{clean_url(encodeURIComponent(page_path))}")
       end

lib/gollum/editing_auth.rb

@@ -0,0 +1,34 @@
+module Precious
+  class EditingAuth  < Sinatra::Base
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      @env = env
+      # Blocks all potentially editable pages. Use EditingAuth::whitelist_pages to unblock pages.
+      unless (env["REQUEST_METHOD"] == "GET") || App::settings.wiki_options[:allow_editing]
+        return block unless excluded_page?
+      end
+      @app.call(env)
+    end
+
+    def block
+      [403, {'Content-Type' => 'text/html', 'Content-Length' => '9'}, ['Forbidden']]
+    end
+
+    def excluded_page?
+      return false if env["REQUEST_PATH"].nil?
+      whitelist_pages.any? do |whitelisted_page|
+        env["REQUEST_PATH"].include? whitelisted_page
+      end
+    end
+
+  private
+    # List pages paths as str that you want to whitelist.
+    # Pages will be compared with env["REQUEST_PATH"] using String::include? method.
+    def whitelist_pages
+      return ["/compare/"]
+    end
+  end
+end

lib/gollum/helpers.rb

@@ -39,5 +39,17 @@ module Precious
       url.gsub('%2F', '/').gsub(/^\/+/, '').gsub('//', '/')
     end
 
+    def forbid(msg = "Forbidden.")
+      @message = msg
+      status 403
+      halt mustache :error
+    end
+
+    def not_found(msg = nil)
+      @message = msg || "The requested page does not exist."
+      status 404
+      return mustache :error
+    end
+
   end
 end

lib/gollum/templates/compare.mustache

@@ -8,8 +8,10 @@
     </li>
     <li class="minibutton"><a href="{{base_url}}/{{escaped_url_path}}"
        class="action-view-page">View Page</a></li>
-    <li class="minibutton"><a href="{{base_url}}/edit/{{escaped_url_path}}"
-       class="action-edit-page">Edit Page</a></li>
+    {{#allow_editing}}
+      <li class="minibutton"><a href="{{base_url}}/edit/{{escaped_url_path}}"
+         class="action-edit-page">Edit Page</a></li>
+    {{/allow_editing}}
     <li class="minibutton"><a href="{{base_url}}/history/{{escaped_url_path}}"
        class="action-page-history">Page History</a></li>
   </ul>
@@ -25,11 +27,13 @@
   <ul class="actions">
     <li class="minibutton"><a href="{{base_url}}/history/{{escaped_url_path}}"
        class="action-page-history">Back to Page History</a></li>
-    <li class="minibutton">
-      <form name="gollum-revert" action="{{base_url}}/revert/{{escaped_url_path}}/{{before}}/{{after}}" method="post" id="gollum-revert-form">
-      <a href="#" class="gollum-revert-button">Revert Changes</a>
-      </form>
-    </li>
+    {{#allow_editing}}
+      <li class="minibutton">
+        <form name="gollum-revert" action="{{base_url}}/revert/{{escaped_url_path}}/{{before}}/{{after}}" method="post" id="gollum-revert-form">
+        <a href="#" class="gollum-revert-button">Revert Changes</a>
+        </form>
+      </li>
+    {{/allow_editing}}
   </ul>
   {{/show_revert}}
 
@@ -52,9 +56,11 @@
     <li class="minibutton"><a href="{{base_url}}/history/{{escaped_url_path}}"
        class="action-page-history">Back to Page History</a></li>
     {{#show_revert}}
-    <li class="minibutton">
-      <a href="#" class="gollum-revert-button">Revert Changes</a>
-    </li>
+    {{#allow_editing}}
+      <li class="minibutton">
+        <a href="#" class="gollum-revert-button">Revert Changes</a>
+      </li>
+    {{/allow_editing}}
     {{/show_revert}}
     <li class="minibutton"><a href="#">Back to Top</a></li>
   </ul>

lib/gollum/templates/history.mustache

@@ -7,8 +7,10 @@
     </li>
     <li class="minibutton"><a href="{{base_url}}/{{escaped_url_path}}"
        class="action-view-page">View Page</a></li>
-    <li class="minibutton"><a href="{{base_url}}/edit/{{escaped_url_path}}"
-       class="action-edit-page">Edit Page</a></li>
+    {{#allow_editing}}
+      <li class="minibutton"><a href="{{base_url}}/edit/{{escaped_url_path}}"
+         class="action-edit-page">Edit Page</a></li>
+    {{/allow_editing}}
   </ul>
 </div>
 <div id="wiki-history">

lib/gollum/templates/page.mustache

@@ -18,18 +18,28 @@ Mousetrap.bind(['e'], function( e ) {
       class="action-all-pages">All</a></li>
     <li class="minibutton"><a href="{{base_url}}/fileview"
     class="action-fileview">Files</a></li>
-    <li class="minibutton jaws">
-      <a href="#" id="minibutton-new-page">New</a></li>
-    {{#allow_uploads}}
-    <li class="minibutton jaws">
-      <a href="#" id="minibutton-upload-page">Upload</a></li>
-    {{/allow_uploads}}
-    {{#editable}}
-    <li class="minibutton jaws">
-      <a href="#" id="minibutton-rename-page">Rename</a></li>
-    <li class="minibutton"><a href="{{base_url}}/edit/{{escaped_url_path}}"
-       class="action-edit-page">Edit</a></li>
-    {{/editable}}
+    {{#allow_editing}}
+      <li class="minibutton jaws">
+        <a href="#" id="minibutton-new-page">New</a></li>
+    {{/allow_editing}}
+    {{#allow_editing}}
+      {{#allow_uploads}}
+      <li class="minibutton jaws">
+        <a href="#" id="minibutton-upload-page">Upload</a></li>
+      {{/allow_uploads}}
+    {{/allow_editing}}
+    {{#allow_editing}}
+      {{#editable}}
+        <li class="minibutton jaws">
+          <a href="#" id="minibutton-rename-page">Rename</a></li>
+      {{/editable}}
+    {{/allow_editing}}
+    {{#allow_editing}}
+      {{#editable}}
+        <li class="minibutton"><a href="{{base_url}}/edit/{{escaped_url_path}}"
+           class="action-edit-page">Edit</a></li>
+      {{/editable}}
+    {{/allow_editing}}
     {{#page_exists}}
     <li class="minibutton jaws">
     <li class="minibutton"><a href="{{base_url}}/history/{{escaped_url_path}}"
@@ -75,9 +85,11 @@ Mousetrap.bind(['e'], function( e ) {
 </div>
 <div id="footer">
   <p id="last-edit">Last edited by <b>{{author}}</b>, {{date}}</p>
-  <p>
-    <a id="delete-link" href="{{base_url}}/{{escaped_url_path}}" data-confirm="Are you sure you want to delete this page?"><span>Delete this Page</span></a>
-  </p>
+  {{#allow_editing}}
+    <p>
+      <a id="delete-link" href="{{base_url}}/{{escaped_url_path}}" data-confirm="Are you sure you want to delete this page?"><span>Delete this Page</span></a>
+    </p>
+  {{/allow_editing}}
 </div>
 </div>
 

lib/gollum/templates/pages.mustache

@@ -7,9 +7,10 @@
     </li>
     <li class="minibutton"><a href="{{base_url}}/"
        class="action-home-page">Home</a></li>
-    <li class="minibutton jaws">
-    <a href="#" id="minibutton-new-page">New</a>
-    </li>
+    {{#allow_editing}}
+      <li class="minibutton jaws">
+      <a href="#" id="minibutton-new-page">New</a></li>
+    {{/allow_editing}}
   </ul>
 </div>
 <div id="pages">

lib/gollum/views/compare.rb

@@ -3,7 +3,7 @@ module Precious
     class Compare < Layout
       include HasPage
 
-      attr_reader :page, :diff, :versions, :message
+      attr_reader :page, :diff, :versions, :message, :allow_editing
 
       def title
         "Comparison of #{@page.title}"

lib/gollum/views/history.rb

@@ -3,7 +3,7 @@ module Precious
     class History < Layout
       include HasPage
 
-      attr_reader :page, :page_num
+      attr_reader :page, :page_num, :allow_editing
 
       def title
         @page.title

lib/gollum/views/page.rb

@@ -47,6 +47,10 @@ module Precious
         @page_exists
       end
 
+      def allow_editing
+        @allow_editing
+      end
+
       def allow_uploads
         @allow_uploads
       end

lib/gollum/views/pages.rb

@@ -3,7 +3,7 @@ require "pathname"
 module Precious
   module Views
     class Pages < Layout
-      attr_reader :results, :ref
+      attr_reader :results, :ref, :allow_editing
 
       def title
         "All pages in #{@ref}"