add config option to lock pages explicitly

realms/modules/wiki/models.py

@@ -86,6 +86,8 @@ class Wiki():
             if m.group(1):
                 return "```" + unescape(m.group(1)) + "```"
 
+        cname = to_canonical(name)
+
         # prevents p tag from being added, we remove this later
         content = '<div>' + content + '</div>'
         content = re.sub(r"```(.*?)```", escape_repl, content, flags=re.DOTALL)
@@ -115,7 +117,6 @@ class Wiki():
 
         content = re.sub(r"```(.*?)```", unescape_repl, content, flags=re.DOTALL)
 
-        cname = to_canonical(name)
         filename = self.cname_to_filename(cname)
         with open(self.path + "/" + filename, 'w') as f:
             f.write(content)

realms/modules/wiki/views.py

@@ -51,6 +51,10 @@ def edit(name):
     cname = to_canonical(name)
     if request.method == 'POST':
         edit_cname = to_canonical(request.form['name'])
+
+        if edit_cname in config.LOCKED:
+            return redirect(url_for(config.ROOT_ENDPOINT))
+
         if edit_cname.lower() != cname.lower():
             wiki.rename_page(cname, edit_cname)
 
@@ -61,6 +65,7 @@ def edit(name):
     else:
         if data:
             name = remove_ext(data['name'])
+
             content = data.get('data')
             g.assets['js'].append('editor.js')
             return render_template('wiki/edit.html', name=name, content=content, partials=data.get('partials'))
@@ -79,6 +84,14 @@ def delete(name):
 @login_required
 def create(name):
     if request.method == 'POST':
+        cname = to_canonical(request.form['name'])
+
+        if cname in config.LOCKED:
+            return redirect(url_for("wiki.create"))
+
+        if not cname:
+            return redirect(url_for("wiki.create"))
+
         wiki.write_page(request.form['name'],
                         request.form['content'],
                         message=request.form['message'],