Moin

Latest version: v1.9.11

Safety actively analyzes 681866 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 5 of 13

1.7.3

New features:
* Secure session cookies for https, see cfg.cookie_secure.
* Add left/center/right/justify classes to builtin themes.

Fixes:
* Python 2.3 compatibility fixes.
* Fixed https detection for servers using HTTPS=1 and also for wsgi servers
not using HTTPS/SSL_ environment, but just wsgi.url_scheme.
* GUI editor:
* Fix crash when editing a page with non-ASCII pagename and inserting a link
* Fix "headers already sent exception" with edit LOCKs.
* i18n.__init__: Bug fix for wiki language not installed.
* Fixed URLs given by sitemap action, if the wiki does not run at / URL.
* Search results: link to 'view' rendering of found attachments
* Logging:
* Removed superfluous linefeed in timing log output.
* Use logging framework for messages emitted by warnings module (e.g.
DeprecationWarning), silence some specific warnings.
* Fix dbw_hide_buttons javascript.
* Standalone server:
* fix serverClass argument processing
* fix --interface="" argument processing
* mointwisted:
* added missing pidFile parameter
* better use Config.name for pidFile to avoid conflicts and keep same
behaviour as in the past
* Jabber bot can now be configured to use an authentication realm which
is different from the server's hostname

1.7.2

Fixes:
* Fix leakage of edit-log file handles (leaked 1 file handle / request!).
* Fix for MoinMoinBugs/SystemAdminMailAccountData (using POST and forms)
* Wiki parser: avoid IndexError for empty ! line
* MonthCalendar macro: fix parameter parsing / url generation
* Xapian indexing filters (MoinMoin/filter/ or data/plugin/filter/):
Some indexing filter scripts (e.g. for MS Word documents or PDF files)
failed on windows because of the single-quote quoting we used (that
works on Linux and other Posix systems). The fix introduces platform-
dependant automatic quoting, using double-quotes on win32 and single-
quotes on posix.
HINT: if you use own filter plugins based on execfilter, you have to
update them as the filename quoting (was '%s') is now done automatically
and must not be part of the command string any more (now just use %s).
See MoinMoin/filter/ for some up-to-date code (esp. the PDF filter).
* Prevent CategoryTemplate being listed as a category (it is a Template,
but matched also the category regex) - added to sample wikiconfig.
* LDAP auth: fix processing of TLS options
* UpdateGroup xmlrpc server side: fix wrong arg count error
* UpdateGroup client: use multicall / auth_token, refactor code so that
updateGroup function is reusable.
* Improve Python 2.3 compatibility, add notes where 2.4 is required.

1.7.1

New features:
* New 'cache' action (see developer notes).

Fixes:
* Security fix: XSS fix for advanced search form
* Avoid creation of new pagedirs with empty edit-log files by just
accessing a non-existant page. If you used 1.7 before, you likely have
quite some trash pagedirs now and you can clean them up by using:
moin --config-dir=... --wiki-url=... maint cleanpage
This will output some shell script (please review it before running!)
that can be used to move trash pages into some trash/ directory and also
moves deleted pages into some deleted/ directory. Maybe keep a copy of
those directories for a while just for the case.
* Server specific fixes:
* standalone (wikiserver.py): fix --pidfile and --group option, fix
operation without a wikiserverconfig.py (use builtin defaults).
* mod_python: work around mod_python 3.3.1 problems with file uploads.
Note: if you are still using mod_python, we strongly recommend you
try out mod_wsgi (in daemon mode) - it has less bugs, better
security, better separation, WSGI is a Python standard, and moin
developers also use WSGI. See HelpOnInstalling/ApacheWithModWSGI.
* revert action: fixed for deleted pages.
* Search:
* Xapian indexing: Removed crappy "hostname" tokenization.
Fixes MoinMoinBugs/1.7 XapianNotWorkingWithLeadingNumbersInTitle.
Also tokenize CamelCase parts of non-wikiwords.
* Make query parser reject more invalid input.
* If query parsing raises a BracketError, at least tell what the problem
is (and not just raise empty ValueError).
* Category search: ignore traling whitespace after ----
* Argument parser:
* Fixed sort() usage in UnitArgument to be Python 2.3 compatible.
* Fixed MoinMoinBugs/TypeErrorInWikiutils.
* Macros:
* TableOfContents: skip outer-most <ol> levels when page isn't using
the biggest headings
* MonthCalendar: fix MoinMoinBugs/MonthCalendarBreaksOnApostrophe
* xslt parser: fix MoinMoinBugs/DoNotConvertUnicodeToUTF8ForXsltParser
* OpenID RP: make it compatible to python-openid 2.2.x
* PackagePages.collectpackage: removed encoding from file name of zipfile
* Surge protection: exclude localnet no matter whether user is known or not.
* Notifications: fix MoinMoinBugs/DuplicateNewUserNotification
* Script moin account create/disable/resetpw: checks for already existing
user now.

Other changes:
* Prevent CategoryTemplate being listed as a category (it is a Template)
by changing the default page_category_regex.

Developer notes:
* New MoinMoin.action.cache - can be used to cache expensively rendered
output, e.g. generated images). Once put into the cache, moin can emit
a http response for that content very fast and very efficient (including
"304 not changed" handling.
* New file-like API in MoinMoin.caching (good for dealing with medium
to large files without consuming lots of memory).
* wikiutil.importPlugin supports getting the whole plugin module object
by giving function=None.

1.7.0

Note: This is a reduced CHANGES, ommitting details from rc/beta test and
also less interesting minor changes and fixes. It shows changes
relative to 1.6.3 release.
If you want to see full detail, read it there:
http://hg.moinmo.in/moin/1.7/file/76265568e8d3/docs/CHANGES

New Features: ==============================================================
* HINT: we added generic UPDATE instructions as docs/UPDATE.html.

* HINT: Standalone server usage changed:
* Standalone server can now be started via the "moin" script command,
optionally backgrounding itself.
See: moin server standalone --help
* In the toplevel dir, we have renamed moin.py to wikiserver.py (it was
often confused with the moin scripting command).
Now you have:
* wikiserver.py - to start the standalone server
* wikiserverconfig.py - to configure the standalone server
* wikiserverlogging.conf - to configure logging for it (default config
is ok for all day use, but can easily be modified for debugging)
* wikiconfig.py - to configure the wiki engine
* Removed old moin daemonizing script (replaced by moin server standalone
--start/stop)
* We now provide the "moin" script command also for people not using
setup.py, see wiki/server/moin.

* Logging
* New powerful and flexible logging, please see wiki/config/logging/ -
HINT: you have to upgrade your server adaptor script (e.g. moin.cgi)
and load a logging configuration that fits your needs from there, or
alternatively you can also set MOINLOGGINGCONF environment variable
to point at your logging config file.
If you use some of our sample logging configs, make sure you have a
look INTO them to fix e.g. the path of the logfile it will use.
* Moin now logs the path from where it loaded its configuration(s).

* Authentication / Sessions:
* HINT: New authentication plugin system, see HelpOnAuthentication. If
you do not use the builtin default for 'auth' list, you likely have to
change your configuration. See wiki/config/snippets/ for some samples.
* HINT: New session handling system (no moin_session any more, now done
internally and automatically), see HelpOnSessions for details.
* Added OpenID client and server support.
See: HelpOnAuthentication and HelpOnOpenIDProvider.
* cfg.trusted_auth_methods is a list of auth methods that put an
authenticated user into the "Trusted" ACL group.

* User profiles / password recovery / notification:
* New newacount action for creating new user accounts/profiles. If you
don't want users creating new accounts on their own, you can add this
action to actions_excluded list.
* New recoverpass action for password recovery:
If you forgot your password, recoverpass sends you an email with a
password recovery token (NOT the encrypted password) that is valid
for 12 hours.
* New moin account resetpw script for resetting a user's password by
the wiki admin.
* New preferences plugin system, see MoinMoin/userprefs/__init__.py.
* New notification system with an optional jabber notification bot, see
HelpOnNotification. HINT: wiki users have to check their notification
settings, esp. if they want to receive trivial update notifications.

* The diff action now has navigation buttons for prev/next change and also
a revert button to revert to the revision shown below the diff display.
* ThemeBase: support Universal Edit Button, see there for details:
http://universaleditbutton.org/
* ?action=info&max_count=42 - show the last 42 history entries of the page.
max_count has a default of default_count and a upper limit of
limit_max_count - you can configure both in your wiki config:
cfg.history_count = (100, 200) (default_count, limit_max_count) default
* The CSV parser can sniff the delimiter from the first CSV line so other
delimeters than ";" can be used.
* Admonition support. Added styling for tip, note, important, warning
and caution in the modern theme. For more info see HelpOnAdmonitions.
* DocBook-formatter:
* supports HTML entities like &rarr; and &9731;
* supports the FootNote macro
* supports bulletless lists
* support for admonitions
* will export the wiki page's edit history as the generated article's
revision history. Doesn't add history of included pages.
* supports for the MoinMoin comment element, though only inline comments
are likely to be valid since the DocBook remark is an inline element.
* New Hits macro: shows the total hits for the page it is used on.

Removed Features: ==========================================================
* HINT: Removed attachments direct serving (cfg.attachments - this was
deprecated since long!). Use AttachFile action to serve attachments.
* Duplicated file attachment upload code was removed from Load action (just
use AttachFile action to deal with attachments).
* Removed 'test' action. If you like to run unit tests, use py.test.
* Removed Login macro.

Bug Fixes: =================================================================
* Better handling of ImportErrors (farmconfig, macros, wikiserverconfig).
* Fix failure of detection of on-disk cache updates.
* Fix traceback in filesys.py on Mac OS X when "import Carbon" fails.

* AttachFile action / file up- and download / zip support:
* WSGI: use wsgi.file_wrapper (or a builtin simple wrapper). Fixes memory
consumption for sending of large file attachments.
* FastCGI: flush often. Fixes memory consumption for sending of large
file attachments.
* Use the open temporary file for receiving file attachment uploads
(fixes big memory consumption for large file uploads).
* Catch runtime errors raised by zipfile stdlib modules when trying to
process a defective zip.
* When unzipping member files, decode their filenames from utf-8 and
replace invalid chars.
* Make error msg less confusing when trying to overwrite a file attachment
without having 'delete' rights.

* HINT: page_*_regex processing had to be changed to fix category search.
If you don't use the builtin (english) defaults, you will have to change
your configuration:
old (default): page_category_regex = u'^Category[A-Z]'
new (default): page_category_regex = ur'(?P<all>Category(?P<key>\S+))'
As you see, the old regex did work for detecting whether a pagename is
a category, but it could not be used to search for a category tag in the
page text. The new regex can be used for both and identifies the complete
category tag (match in group 'all', e.g. "CategoryFoo") as well as the
category key (match in group 'key', e.g. "Foo") by using named regex
groups. \S+ means the category key can be anything non-blank.
If you like to simultaneously support multiple languages, use something
like this: ur'(?P<all>(Kategorie|Category)(?P<key>\S+))'
HINT: after changing your configuration, please rebuild the cache:
* stop moin
* moin ... maint cleancache
* start moin
If you don't do this, your groups / dicts will stop working (and also
your ACLs that use those groups). You better do a test whether it works.

* Xapian search / indexing / stemming:
* Use text/<format> as mimetype for pages.
* Index also major and minor for mimetypes, so it will find 'text' or
'plain' as well as 'text/plain'
* Fix searching for negative terms.
* Improve result list ordering.
* Index filters: redirect stderr to logging system.
* Remove crappy num regex from WikiAnalyzer, improve tokenization.
* Fix AttributeError that happened when trying to access an attribute only
used with xapian search (but regex search is not done by xapian)
* Fix IndexErrors happening when pages are renamed/nuked after the index
was built.
* Fixed indexing of WikiWords (index "WikiWords", "Wiki" and "Words").
* Fix crash if default language is un-stemmable.
* xapian_stemming: removed some strange code (fixes search
title:lowercaseword with xapian_stemming enabled)
* Fixed category indexing (index CategoryFoo correctly as CategoryFoo, not
Foo - for all languages, see page_*_regex change above).
* Builtin search: support mimetype: search for pages for the builtin search
engine (using text/<format>).

* Parser fixes:
* Wiki: fix subscript parsing (was broken for cases like 'a,,1,2,,').
* Docbook: fixed detection of WikiWords.
* All: Add ssh protocol to url_schemas for ssh:... URLs.

* XMLRPC:
* Fix xmlrpc request.read() call to use content-length, if available,
fixes hangs with wsgiref server.
* Wiki xmlrpc getPageInfoVersion() fixed:
* works correctly now for old page versions (was unsupported)
* works correctly now for current page version (reported wrong
data when a page had attachment uploads after the last page
edit)
* returns a Fault if it did not find a edit-log entry

Other Changes: =============================================================
* Using better ACLs and comments on system/help pages now, just taking
away 'write' permission, but using default ACLs for everything else.
* HINT: If you want to use xapian based indexed search, you need to have
Xapian >= 1.0.0 (and you can remove PyStemmer in case you have installed
it just for moin - we now use the stemmer built into Xapian as it
supports utf-8 since 1.0.0).
* Changed default value of cfg.search_results_per_page to 25.
* Surge Protection: If a user is authenticated by a trusted authentication
(see also cfg.auth_methods_trusted) then he/she won't trigger surge
protection, but moin will just log a INFO level log msg with the user's
name so you can find the culprit in case he/she is overusing ressources.
* HINT: Added MyPages and CopyPage to actions_excluded because MyPages
doesn't work without special SecurityPolicy anyway and CopyPage has
questionable behaviour.
* Load action now just creates a new revision of the target page, the
target pagename defaults to the current page name and can be edited.
If the target pagename is empty, moin tries to derive the target pagename
from the uploaded file's name.
Load tries to decode the file contents first using utf-8 coding and, if
that fails, it forces decoding using iso-8859-1 coding (and replacing
invalid characters).
* HINT: cfg.show_login is gone, see code in theme/__init__.py, this may
affect many themes!
* HINT: a new userprefs/ plugin directory will be created by the usual
"moin migration data" command.
* DocBook-formatter:
* generates a valid DOCTYPE
* table support has been improved
* handling of definitions and glossaries is more robust
* supports program language and line numbering in code areas
* HINT: ldap_login behaves a bit different now:
In previous moin versions, ldap_login tended to either successfully
authenticate a user or to completely cancel the whole login process in
any other case (including ldap server down or exceptions happening).
This made subsequent auth list entries rather pointless.
Now it behaves like this:
* user not found in LDAP -> give subsequent auth list entries a
chance to authenticate the user (same happens if it finds multiple
LDAP entries when searching - it logs an additional warning then).
* user found, but wrong password -> cancel login
* ldap server not reachable or other exceptions -> give subsequent
auth list entries a chance
So please make sure that you really trust every auth list entry you have
configured when upgrading or it might maybe change behaviour in a
unexpected or unwanted way.
* ldap_login now supports failover: if it can't contact your LDAP server
(e.g. because it is down or unreachable), it will just continue and
try to authenticate with other authenticators (if there are any in
cfg.auth list). So if you have some mirroring LDAP backup server, just
put another authenticator querying it there:
ldap_auth1 = LDAPAuth(server_uri='ldap://mainserver', ...)
ldap_auth2 = LDAPAuth(server_uri='ldap://backupserver', ...)
auth = [ldap_auth1, ldap_auth2, ]

Developer notes: ===========================================================
* Page.last_edit() is DEPRECATED, please use Page.edit_info().
* Page._last_edited() is GONE (was broken anyway), please use
Page.editlog_entry().
* New request.send_file() call, making it possible to use server-specific
optimizations.
* getText's (aka _()) 'formatted' keyword param (default: True in 1.6 and
early 1.7) was renamed/changed: it is now called 'wiki' and defaults to
False. Example calls:
_('This will NOT get parsed/formatted by MoinMoin!')
_('This will be parsed/formatted by MoinMoin!', wiki=True)
_('This will be used as a left side of percent operator. %s',
wiki=True, percent=True)
* Page.url 'relative' keyword param (default: True in 1.6 and early 1.7)
was changed to default False).
* The themedict no longer contains 'page_user_prefs' and 'user_prefs',
this may affect custom themes.
* The rst-parser's admonition class names are no longer prepended with
"admonition_". Instead the class names are now for example "note"
and not "admonition_note".

1.6.3

Fixes:
* Security fix: a check in the user form processing was not working as
expected, leading to a major ACL and superuser priviledge escalation
problem. If you use ACL entries other than "Known:" or "All:" and/or
a non-empty superuser list, you need to urgently install this upgrade.
* Security fix: if acl_hierarchic=True was used (False is the default),
ACL processing was wrong for some cases, see
MoinMoinBugs/AclHierarchicPageAclSupercededByAclRightsAfter
* For {{transclusion_targets}} we checked the protocol to be http(s),
this check was removed (because file: and ftp: should work also) and
it's not moin's problem if the user uses silly protocols that can't
work for that purpose.
* Fixed TableOfContents macro for included pages.
* server_fastcgi: added Config.port = None. If you want to use some port
(not a fd), you can set it now in your Config, e.g. port = 8888.
* category: search matches categories even if there are comment lines
between the horizontal rule and the real categories, e.g.:
... some page text ...
----
optionally some comments, e.g. about possible categories:
CategoryJustACommentNotFound
CategoryTheRealAndOnly

Note: there might be multiple comment lines, but all real categories
must be on a single line either directly below the ---- or
directly below some comment lines.

Other changes:
* Added 'notes' to config.url_schemas, so you can use notes://notessrv/...
to invoke your Lotus Notes client.
* After creating a new user profile via UserPreferences, you are logged
in with that user (no need to immediately enter the same name/password
again for logging in).

1.6.2

Fixes:
* Security fix: check the ACL of the included page for the rst parser's
include directive.
* Potential security/DOS fix: we removed cracklib / python-crack support
in password_checker as it is not thread-safe and caused segmentation
faults (leading to server error 500 because the moin process died).
* Fix moin_session code for auth methods other than moin_login (e.g. http).
If you have worked around this using moin_anon_session, you can remove
this workaround now (except if you want anon sessions for other reasons).
* Fix moin_session code to delete invalid session cookies and also create
a new session cookie if it got a valid user_obj at the same time.
* Fix xmlrpc applyAuthToken: give good error msg for empty token.
* Fixed category search, use category:CategoryFoo as search term.
* xapian_stemming = False (changed default) to workaround some problems
in the code enabled by it. Fixes the problems when searching for
lowercase or numeric titles or word fragments with the builtin search.
* Fix trail for anon users without a session, do not show a single page.
* Fix MoinMoinBugs/WikiSyncComplainsAboutTooOldMoin.
* Wiki parser: fixed strange insertion of unwanted paragraphs.
* Wiki parser: fix interwiki linking:
Free interwiki links did not change since 1.5 (they still require to match
[A-Z][A-Za-z]+ for the wikiname part, i.e. a ASCII word beginning with an
uppercase letter).
Bracketed interwiki links now behave similar to how they worked in 1.5:
Moin just splits off the part left of the colon - no matter how it looks
like. It then tries to find that in the interwiki map. If it is found,
a interwiki link gets rendered. If it is not found, moin will render a
link to a local wiki page (that has a colon in the pagename). It will
also render a local wiki page link if there is no colon at all, of course.
Examples:
[[lowercasewikiname:somepage]] does an interwiki link (if in the map).
[[ABC:n]] does a local link to page ABC:n (if ABC is NOT in the map).
* Wiki parser: fix interwiki linking for the case that there are query args
in the interwiki map entry and you give additional query args via link
markup (uses correct query arg separator now), e.g.:
[[Google:searchterm|search this|&foo=bar]]
* Creole parser: fixed bug that prevents images inside links.
* Python parser: catch indentation error.
* PageEditor: fixed copyPage for write restricted pages.
* GUI editor: fixed javascript error with too complex word_rule regex,
see MoinMoinBugs/GuiEditorSyntaxError.
* Fixed FCKeditor dialog boxes for FireFox3.
* NewPage macro/newpage action: fixed for non-ascii template pagenames.
* FootNote macro: Fix MoinMoinBugs/FootNoteNumbering.
* EmbedObject macro: bug fix for image mimetype
* WSGI:
* fix TWikiDraw saving a drawing by also evaluating the query args.
* work around unpythonic WSGI 1.0 read() API, fixing broken xmlrpc
putPage with mod_wsgi
* Fix highlighting (see MoinMoinBugs/SearchForPagesWithComments).
* Fix logfile code for EACCESS errors.
* Removed the "logging initialized" log messages because it was issued once
per request for CGI.

Other changes:
* Show "Comments" toggling link in edit bar only if the page really
contains comments.
* Made default configuration of surge protection a bit more forgiving,
especially for edit action which is currently also used for previews.
* Updated i18n, system/help pages, added Macedonian system text translation.
* Improved moin xmlrpc write command's builtin docs and auto-append
?action=xmlrpc2 to the target wiki url given.

Page 5 of 13

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.