-
-
Notifications
You must be signed in to change notification settings - Fork 67
Expand file tree
/
Copy pathCHANGES
More file actions
5355 lines (4836 loc) · 277 KB
/
CHANGES
File metadata and controls
5355 lines (4836 loc) · 277 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
MoinMoin Version History
========================
Please note: Starting from the MoinMoin version you used previously, you
should read all more recent entries (or at least everything marked with HINT).
This release has known bugs (see MoinMoin:MoinMoinBugs), but we think it is
already better than the previous stable release. Our release policy is not
trying to make a "perfect release" (as that release might NEVER get released),
but to make progress and don't delay releases too much.
Version 1.9.11 (2020-11-08)
SECURITY HINT: make sure you have allow_xslt = False (or just do not use
allow_xslt at all in your wiki configs, False is the internal default).
Allowing XSLT/4suite is very dangerous, see HelpOnConfiguration wiki page.
HINT: Python 2.7 is required! See docs/REQUIREMENTS for details.
HINT: please read the changelog below carefully before upgrading to 1.9.10.
This release has some fundamental changes you (and your wiki users)
should be aware of beforehands.
Fixes:
* security fix for CVE-2020-25074:
fix remote code execution via cache action
changeset with fix: d1e5fc7d
* security fix for CVE-2020-15275:
fix malicious SVG attachment causing stored XSS vulnerability
changeset with fix: 64e16037
* make setup.py and .cfg ascii-only, #40
* fix SubProcess' os.setsid usage, #44
* fix interwiki test fails that crept into 1.9.10 release
* highlight parser: use language as code_type rather than "highlight"
* catch indexer error for too long names, #57
* improved indexer logging so logging never crashes due to
encoding issues for non-ascii page or attachment names.
* fix mailheader parsing, add tests for mailimport, #53
* workaround werkzeug errors='fallback:...' regression, #37
* mailimport: fix AttributeError, #55
* surge protection / hosts_deny: fix broken html, #60
Other changes:
* upgrade werkzeug 0.14.1 -> 1.0.1, adapt imports
HINT: if you use the ProxyFix code, the required import has changed to:
from werkzeug.middleware.proxy_fix import ProxyFix
* add secure-cookie 0.1.0 (code was formerly part of werkzeug.contrib), adapt imports
* update pygments 2.1.3 -> 2.5.2
* update passlib 1.7.1 -> 1.7.2
* update parsedatetime 2.4 -> 2.6
Version 1.9.10 aka "the end of spam release" (2018-09-09)
Fixes:
* security fix for CVE-2017-5934, XSS in GUI editor related code
* fix wrong digestmod of hmac.new calls (incorporate 1.9.9 patch)
* fix broken table attribute processing (wikiutil.escape)
* fix AttributeError in multifile action
* read text attachments using universal newlines (including \r line seps)
* anywikidraw / twikidraw: check write permissions early
* fix exec_cmd for windows: preexec_fn is UNIX only
New features:
* added a convenient way to create a user account via the superuser's
"Settings" -> "Switch User" form:
just type in the new user's name there, switch to the account and
fill out the email address. You do not need to set a password, the
account will not be usable until the users claims it via the "forgot
my password" functionality on the login page (and sets a password).
* you now can also type in an existing user's name there to switch to the
account, instead of selecting it (convenient if you have many users).
* newaccount action by default only available for superusers.
This is to avoid spam bots creating huge amounts of crap accounts on
internet connected wikis.
This is done via a new cfg.actions_superuser = ['newaccount', ] default.
If you prefer to have newaccount action available for every visitor (not
advisable for internet connected wikis), use this in your wiki config:
actions_superuser = FarmConfig.actions_superuser[:]
actions_superuser.remove('newaccount')
For internet connected wikis, a safer way is to let potential new users
ask for an account. Everyone in the superuser list can easily create a new
account (wiki username and email address needed). If you run a public
MoinMoin wiki on the internet, document the way to get an account on
your front page.
* support tel: urls
Other changes:
* safer internal default ACL: Known and All now only have read permissions.
This is to avoid that you accidentally give r/w permissions to the world
when running a wiki on the internet.
Considering there are lots of spam bots out there, that can create a ton
of spam pages in little time, we advise you to keep the safer default for
internet connected wikis and only allow specific users / groups read/write
access.
See also the updated sample configs / the HelpOnAccessControlLists help
page.
* disable the gui editor / enforce the text editor by default
fckeditor 2.6.11 as we bundle it (latest available version, but years
old) might have security issues meanwhile as it is not maintained any
more.
also, there ever have been major issues with MoinMoin's integration of
that "gui editor" (as our documentation pointed out since long).
if you want to give wiki users the choice to choose the gui editor
nevertheless, you can re-enable it in your wiki config:
editor_force = False
editor_ui = 'freechoice'
* change log_reverse_dns_lookups default to False.
* update / upgrade bundled software:
* upgrade werkzeug to 0.14.1
* upgrade passlib to 1.7.1
* upgrade parsedatetime to 2.4
* moved MoinMoin 1.9.x development to GitHub:
https://github.com/moinwiki/moin-1.9/
* update mailing list address and download URL in pypi metadata
* enabled Travis CI to run the unit tests for PRs / branches
* fixed some stuff found by PyCharm Code Inspection
* make build reproducible
Version 1.9.9 aka "The undead MoinMoin Halloween Release" 2016-10-31
Fixes:
* security: fix XSS in AttachFile view (multifile related) CVE-2016-7148
* security: fix XSS in GUI editor's attachment dialogue CVE-2016-7146
* security: fix XSS in GUI editor's link dialogue CVE-2016-9119
* catch IOError for zipfile errors (sometimes triggered by zipfile.is_zipfile
false positives, see http://bugs.python.org/issue28494 ).
Other changes:
* update moin.spec, setup.py: py27 only
Version 1.9.9rc1:
Fixes:
* add meta "viewport" for small device viewports
* add meta X-UA-Compatible IE=Edge, make IE happy on intranets
New features:
* AttachFile multifile operation: support copying multiple files to another page
* cfg.xmlrpc_overwrite_user is a new setting to control whether the xmlrpc
code overwrites an already authenticated user before processing a request.
True (default): behaviour as in 1.9.8 and before
False: use this if you want to use GivenAuth (e.g. http basic auth) for
xmlrpc requests.
Other changes:
* upgraded bundled 3rd party code:
* werkzeug 0.11.11
* passlib 1.6.5
* pygments 2.1.3
* parsedatetime 2.1
* FCKEditor 2.6.11
* removed some bundled stuff we needed due to stdlib issues in older Pythons:
* MoinMoin.support.difflib
* MoinMoin.support.tarfile
* MoinMoin.support.HeaderFixed (-> email.header)
* SubProcess: reimplement exec_cmd, remove our stdlib hacks
* remove own usage of python_compatibility module which we needed to support
older Pythons. the module is still there, in case some 3rd party moin
extensions used it.
Version 1.9.8:
New features:
* cfg.recovery_token_lifetime to determine how long the password recovery
token will be valid, default is 12 [h]. Check this setting to be adequate
before doing (global) password resets, so your users have enough time to
react before the toke times out!
* cfg.log_events_format can be used to configure the format of the records
written to <data_dir>/event-log:
0 = dot not create event-log entries (saves disk space, disk I/O)
1 = standard (like in moin <= 1.9.7) [default]
2 = extended (add infos about username, wikiname, url)
* add a tool to output the contents of the event-log to CSV:
moin export eventlog --file=output.csv
Output encoding is utf-8, columns are in this order:
time, event, username, ip, wikiname, pagename, url, referrer, ua
time: UNIX timestamp (float)
* reimplement cfg.log_timing - if True, emits INFO level log output like:
"timing: <REMOTE_ADDR> <URL> <REFERRER> <TIME> <SLOWNESS-INDICATOR>"
TIME is in seconds, the slowness indicator is "." for sub-second requests
or N times "!" for requests taking N seconds (so you easily can grep for
slow stuff).
* add "abuse" logging. this will log every attempt to login (successful ones
as well as unsuccessful ones). abuse logging is configured via the logging
configuration, see example in wiki/config/logging/abuse.
Currently, abuse logging is implemented for:
* authentication system
* "moin" auth
* "given" auth
* setuid (when superuser switches to another user)
* new user creation
* some security/ACL violations (xmlrpc and perhaps others not implemented)
* surge protection for authentication (currently only for MoinAuth):
a) surge protect by IP
This covers the case someone is trying to authenticate way too
often - we don't look at the username here, just at the remote IP
address. If surge protection kicks in for some specific IP, that IP
won't be able to try to authenticate any more until surge_lockout_time
is over.
Note: be careful with users behind proxies or NAT routers - these are
common and legitimate cases with (potentially lots of)
authentication requests coming from same IP.
if it is a trusted proxy, you can configure moin so it sees the
real remote IP address (not just the proxy's address).
b) surge protect by name
This covers the case someone is trying to authenticate for a
specific user name way too often (e.g. when someone tries to attack the
wiki admin's account). We don't look at the IP here, just at the user
name. If surge protection kicks in for some specific user name, that user
name will not be able to try to authenticate any more until
surge_lockout_time is over.
Note: this even covers widely distributed attacks against a user, but
you should only enable this if you are aware that the "real" user
also won't be able to authenticate while surge protection is active
(at least not using the account for that specific username).
Thus, there is some denial-of-service danger with this if the
attacker can guess or find your valid user names (which isn't too
difficult if your wiki is publicly readable).
This is bad, but technically hard to avoid.
Configuration (allowing 10 authentication attempts per hour):
surge_action_limits = {
# ...
'auth-ip': (10, 3600), # same remote ip (any name)
'auth-name': (10, 3600), # same name (any remote ip)
}
* backlinks performance tuning: the pagename in the theme has historically
been used to trigger a "linkto:ThisPage" search. While this is a nice
feature for human users of the wiki (esp. on category pages), it has one
big issue: as it is a normal link, stupid crawlers (ignoring "nofollow")
follow it and cause a lot of unneccessary load.
What moin shows in that "backlinks" place can now be configured in your
wiki config:
# always render the backlink as in moin < 1.9.8 (bad bots causing high load!):
backlink_method = lambda cfg, req: 'backlink'
# always render a simple link to same page, as in moin 2.0:
backlink_method = lambda cfg, req: 'pagelink'
# logged-in users get the backlink, anon users/bots get a pagelink (default):
backlink_method = lambda cfg, req: 'backlink' if req.user.valid else 'pagelink'
# logged-in users get the backlink, anon users/bots get simple text:
backlink_method = lambda cfg, req: 'backlink' if req.user.valid else 'text'
* AbandonedPages macro: check user agent to reduce load caused by bots
* RSS feed: check for bots and rather give them empty results than waste a
lot of time with them
* ldap_auth: support placeholders for basedn also, e.g. you could use:
base_dn='uid=%(username)s,ou=people,dc=company,dc=com'
* move or delete multiple attachments (see checkboxes and buttons on the
AttachFile view). Be careful: in the same way as you could delete a single
attachment with one click, you can now delete all attachments of a page
with one click (we don't ask for a 2nd confirmation, so think first).
* mailimport: use relative attachment link markup instead of absolute links,
enables some page renaming operations without needing to edit the markup.
* better caching and lookup optimizations for userprofile data:
* name, email, jid, openids -> userid lookups
* page subscriptions for notifications (as a consequence, determination of
subscribers when a page is saved is much faster now, esp. for wikis with
many users) - see also MoinMoinBugs/GetSubscribersSlow
* Notification template strings are now configurable via cfg.mail_notify_...
* page_text (this puts together the pieces for the mail body, used for all
changed / deleted / renamed page mail notifications)
* page_changed_subject, page_changed_intro
* page_deleted_subject, page_deleted_intro
* page_renamed_subject, page_renamed_intro
* att_added_subject, att_added_intro
* att_removed_subject, att_removed_intro
* user_created_subject, user_created_intro
* Best is to read HelpOnConfiguration and look at MoinMoin.config.multiconfig
to see the help text and the defaults.
* The defaults are chosen to be the same as the old hardcoded values, so the
translations keep working.
* If you overwrite the strings in your configuration moin will still try to
translate your strings, but it will only find translations if you add them
to the gettext catalogs, too.
* Examples:
a) notification mail body: you don't want the rendered diff, you don't
want to link to the diff, but to the full page view on your wiki.
# original (default) value
mail_notify_page_text = '%(intro)s%(difflink)s\n\n%(comment)s%(diff)s'
# put this in your wiki config
mail_notify_page_text = '%(intro)s%(pagelink)s\n\n%(comment)s'
b) notification mail subject:
# original (default) value
mail_notify_page_changed_subject = '[%(sitename)s] %(trivial)sUpdate of "%(pagename)s" by %(username)s'
c) notification mail intro:
# original (default) value
mail_notify_page_changed_intro = \
("Dear Wiki user,\n\n"
'You have subscribed to a wiki page or wiki category on "%(sitename)s" for change notification.\n\n'
'The "%(pagename)s" page has been changed by %(editor)s:\n')
Note: if you change "*_page_changed_*", you likely also want to change
"*_page_deleted_*" and "*_page_renamed_*", maybe even "*_att_added_*"
and "*_att_removed_*".
Fixes:
* security fix: XSS in useragents stats
* do not create empty pagedirs (with empty edit-log). To clean up all the
trash pagedirs, use moin ... maint cleanpage.
* page rename/delete, attachment add/remove email notifications work now
(somehow we had an event for this, but no code handling it)
* AttachFile do=get and do=view: send 404 status if file does not exist
* link rel="Alternate" links: rather use page.url than request.href, so
url_prefix_action gets used for the (print and raw) action URLs
* fixed wrong detection of UI language from accept-language header for not
logged-in users if the language identifier there was (partially) uppercase.
* fix Python 2.7.4/5 compatibility issue with rss_rc action using handler._out
* fix "moin import wikipage" timestamp confusion
* use 302 http status for #redirect as some clients cache 301 redirects, but
the #redirect might get changed or removed later (so it should not be
cached and we also can't really say it is permanent)
* fix crash when macro names contain non-ascii chars
* CopyPage action: fix NameError exception when TextCha was answered wrong
* docbook formatter: fix image URL generation, avoid script name duplication
* fix caching scope of name2id/openid2id caches (was: "wiki", now:
"userdir"). this is relevant for shared user_dir configurations.
* moin maint cleancache: cleans up openid2id cache now also
* "userdir" caching scope used for userid lookup caches (the previously used
name2id cache with "wiki" caching scope could have outdated data if you
share the user_dir between multiple wikis)
* catch "filename too long" exception if some crap URL refers to a too long
pagename that the filesystem can not represent. It is treated like a not
existing page then, so you don't get a traceback in your log file.
Other changes:
* rss_rc action (RSS feed) is now much faster / much less resource consuming
when requested for a specific single page. As we have a link to this in
every page's html output, this likely also lightens the load caused by bots
and search engine crawlers.
* tuned editlog.news() - only open/read log if there is new stuff in it after
last read position
* improve python2.5 compatibility (with_statement)
* add bingbot to ua_spiders
* upgraded bundled werkzeug to 0.8.3
* upgraded bundled passlib to 1.6.2
* upgraded bundled pygments to 1.6
Version 1.9.7:
New features:
* passlib support - enhanced password hash security. Special thanks go to
the Python Software Foundation (PSF) for sponsoring development of this!
Docs for passlib: http://packages.python.org/passlib/
If cfg.passlib_support is True (default), we try to import passlib and set
it up using the configuration given in cfg.passlib_crypt_context (default
is to use sha512_crypt with default configuration from passlib).
The passlib docs recommend 3 hashing schemes that have good security, but
some of them have additional requirements:
sha512_crypt needs passlib >= 1.3.0, no other requirements.
pbkdf2_sha512 needs passlib >= 1.4.0, no other requirements.
bcrypt has additional binary/compiled package requirements, please refer to
the passlib docs.
cfg.password_scheme should be '{PASSLIB}' (default) to tell that passlib is
wanted for new password hash creation and also for upgrading existing
password hashes.
For the moin code as distributed in our download release archive, passlib
support should just work, as we have passlib 1.6.1 bundled with MoinMoin
as MoinMoin/support/passlib. If you use some other moin package, please
first check if you have moin AND passlib installed (and also find out the
passlib version you have installed).
If you do NOT want to (not recommended!) or can't use (still using python
2.4?) passlib, you can disable it your wiki config:
passlib_support = False # do not import passlib
password_scheme = '{SSHA}' # use best builtin hash (like moin < 1.9.7)
Please note that after you have used moin with passlib support and have user
profiles with passlib hashes, you can't just switch off passlib support,
because if you did, moin would not be able to log in users with passlib
password hashes. Password recovery would still work, though.
password_scheme always gives the password scheme that is wanted for new or
recomputed password hashes. The code is able to upgrade and downgrade hashes
at login time and also when setting / resetting passwords for one or all
users (via the wiki web interface or via moin account resetpw script
command).
So, if you want that everybody uses strong, passlib-created hashes,
resetting the passwords for all users is strongly recommended:
First have passlib support switched on (it is on by default), use
password_scheme = '{PASSLIB}' (also default), then reset all passwords.
Same procedure can be used to go back to weaker builtin hashes (not
recommended): First switch off passlib support, use password_scheme =
'{SSHA}', then reset all passwords.
Wiki farm admins sharing the same user_dir between multiple wikis must use
consistent password hashing / passlib configuration settings for all wikis
sharing the same user_dir. Using the builtin defaults or doing the
configuration in farmconfig.py is recommended.
Admins are advised to read the passlib docs (especially when experiencing
too slow logins or when running old passlib versions which may not have
appropriate defaults for nowadays):
http://packages.python.org/passlib/new_app_quickstart.html#choosing-a-hash
http://packages.python.org/passlib/password_hash_api.html#choosing-the-right-rounds-value
* Password mass reset/invalidation support, see docs/resetpw/.
This is useful to make sure everybody sets a new password and moin computes
the password hash using the current configuration.
* Customizable default password checker:
Moin's default password checker used and still uses min_length=6 (minimum pw
length) and min_different=4 (minimum count of different chars in the password).
If you feel that you need to require better passwords from your users, you
can customize it now like that in your wiki config:
password_checker = lambda cfg, request, name, pw: multiconfig._default_password_checker(cfg, request, name, pw, min_length=10, min_different=7)
* Removing/disabling inactive users (moin ... account inactive)
Many wikis have a lot of inactive users, that never ever made a single edit.
See help of the command for more details, be careful.
* SystemAdmin user browser: show disabled user accounts at the bottom of
the list
* At startup, announce moin version and code path in log output (makes
support and debugging easier).
* AttachList: introduced search_term parameter (optional) for listing
attachments filtered by a regular expression on their name.
* sign release archive using GnuPG with the key of tw@waldmann-edv.de
ID 31A6CB60 (main key ID FAF7B393)
Fixes:
* logging: if the logging config file can't be read, give a helpful error msg
* logging: use info loglevel (not warning) for telling about using the builtin
default logging config
* moin script commands: warn if someone gave ... to the moin script, avoids a
strange and unhelpful 'empty module name' error message
* reorder html input fields in recoverpass form, to help browsers remember
the user name and password (not erroneously the recovery token and password)
* don't try to send password recovery email to user if email address in
user profile is empty
* cache action: fix 304 http status
* rst parser: fix safe_import for level param in __import__ call of docutils 0.10
* moin maint cleancache: also kill the i18n cache 'meta' pickle file
* sendmail: catch unicode errors when E-Mail addr has non-ascii chars
* redirect last visited: if last visited page is on same wiki, use a local
redirect, do not compute via interwiki map (fixes https: usage)
Version 1.9.6:
Fixes:
* fix remote code execution vulnerability in twikidraw/anywikidraw action
* fix path traversal vulnerability in AttachFile action
* fix XSS issue, escape page name in rss link
* escape user- or admin-defined css url
* make taintfilename more secure
* use a constant time str comparison function to prevent timing attacks
* Attachment handler: catch all Zip-related errors
Version 1.9.5:
Fixes:
* Security fix: fix virtual group bug in ACL evaluation.
* Avoid crash if #refresh processing instruction is used without arguments.
* Fix issue with non-ASCII textchas.
* Xapian indexing: remove copy.copy() that crashed on Windows/IIS/isapi-wsgi
after page save.
* Fix dictionary file reading crash under Windows.
* Work around crash of AdvancedSearch macro rendering caused by non-ascii
mimetypes.types_map entries.
* Added migration script for moin 1.8.9.
* rss_rc: Fix diffs added in RSS with diffs=1 (now they correspond to item
listed in feed and not just last page diffs). Links generated with ddiffs=1
also fixed.
* rss_rc: fix double escaping issue.
* rss_rc: respect show_names configuration option.
* rss_rc: proper support of rename, revert, page creation.
* modern/modernized theme: fix padding/width for editor preview
* group/pagelinks formatters: avoid to create unnecessary output, redirect
output of send_page call with the groups formatter, it must not be written
to the output stream
* rst parser: fix include and macro directives
* wikisync: fix unicode pagename sending for python 2.7 httplib
New features:
* add a comment_required config option (default: False) to require a
non-empty comment when saving a page
* when a save error happens, show the editor again and highlight the error
* rss_rc: several new options added: lines parameter gives ability to set
maximum size of diffs showed in RSS. show_att parameter gives ability
to show information aboout attachment-related items in RSS. page parameter
gives ability to specify set of pages for which changes RSS feed should be
generated. Configuration of defaults and limits can now be done via wiki
configuration mechanism.
* As soon as it is now possible to provide RSS for page change history,
appropriate alternate link is now added for every page (controlled by
rss_show_page_history_link configuration parameter).
* Search: "no_highlight:" search query option provided for suppressing
highlighting search results.
* Search macros: new options for FullSearch, FullSearchCached and PageList
available:
* highlight_titles option controls highlighting of matches in search
results provided by these macros. Default value is set in
search_macro_highlight_titles configuration option)
* highlight_pages option controls adding of highlight URL parameter to
page links (so search term is highlighted when user goes to one of
these pages via provided link) in search results. Default value is set
in search_macro_highlight_pages configuration option.
Usage of these options is disabled (via search_macro_parse_args
configuration option) by default due to behavioural changes introduced
in macro parameter parsing mechanism to support them. Related to
http://moinmo.in/FeatureRequests/FullSearchResultsWithoutHighlight .
Other changes:
* Remove 4suite dependency for docbook formatter, use minidom (included in
Python).
* Upgraded FCKeditor to 2.6.8.
Version 1.9.4:
HINT: Python >= 2.5 is maybe required! See docs/REQUIREMENTS for details.
Fixes:
* Fix XSS / remove javascript URL support in rst parser (CVE-2011-1058).
* werkzeug: Removed a dummy import. Fixes Python 2.7 compatibility.
* Fix linux-to-windows edit-log migration/upgrade issue (wrong line endings)
* logfile: strip \n lineends from line data (\n is part of the file
structure, not of the data)
* Fix for MoinMoinBugs/SinglePageSlideShowAndParserMarkup.
* Simplify auto scroll initialization; fix bug in IE init discovered when
using IE7 on pages with wide tables.
* Fix timestamp in edit lock message to show the time when edit-locking ends.
* Updated wikiserverconfig.py from internal defaults, sync the one in
toplevel dir and the one in wiki/server/ - fixes hostname setting.
* SubProcess: make sure files are closed at the end (experimental change).
* text plain formatter: fix bullet_list, see number_list.
* Add some image mimetypes to MIMETYPES_MORE to fix windows issues.
* Include page name in password reset URL.
* Fix moin export dump to generate relative URLs.
* Fix MonthCalendar mouseover for pages with ampersand in page name.
* ldap_login: assign server early, it is used in exception handler.
* OpenID server preferences: fix traceback related to request method.
* Work around page.mtime_usecs() returning 0 for pages without edit-log.
* revert action: catch and display all SaveErrors when revert failed.
* Fixed bug in groups formatter which caused the last list item to be not in the group.
* Avoid strange exception in zipfile.py for pre-1980 timestamps.
* TableOfContents: fix for other markups than default wiki markup, e.g. rst
* script.account.homepage: added wiki format to homepage_default_text
* Enable webkit based browsers (try chrome/safari/konqueror now) for GUI
editing (after fixing selection FCKeditor plugin for chrome).
* Parsers: avoid crash when Parser.format() call gets inhibit_p kw arg.
* advancedsearch: fix problem with non-ascii chars breaking up words for OR
and NOT terms
* fix globaledit script to keep comments on Homepage...Template pages
New features:
* Added print mode to action.SlideShow, see
FeatureRequests/PrintableSinglePageSlideshows.
* xmlrpc: new methods xmlrpc_getProcessingInstruction(Version)
* Add support for other password hashes (all of them will get auto-upgraded
to SSHA when user logs in):
* {DES} (Unix crypt(3))
* {MD5} (MD5-based crypt())
* {APR1} (Apache .htpasswd).
* Experimental queued indexing support to work around memory leak - use it like this:
# put all pages into indexer queue:
python MoinMoin/script/moin.py index build --mode=makequeue
# take <count> pages out of the indexer queue and index them,
# you need to repeat the following line respective to the total amount of pages
# in your wiki (doing more indexer calls does no harm, doing less means an
# incomplete index):
python MoinMoin/script/moin.py index build --mode=buildnewindexqueued --count=500
python MoinMoin/script/moin.py index build --mode=buildnewindexqueued --count=500
python MoinMoin/script/moin.py index build --mode=buildnewindexqueued --count=500
# ...
# switch to new index:
python MoinMoin/script/moin.py index build --mode=usenewindex
Other changes:
* Raise exceptions as recommended in PEP 8.
* Updated i18n / underlay pages.
* Updated interwiki map.
* Use logging.traceback to get more information if a indexing filter crashes.
* u200b is not considered a space any more in unicode 4.0.1.
* Improve textcha security, use some crypto and timing to make cheating
harder - use cfg.textchas_expiry_time = 600 (default, seconds) to set the
time a textcha is valid.
* Upgraded bundled werkzeug to 0.8.1, pygments to 1.4, flup to repo tip.
Version 1.9.3:
Fixes:
* Fix XSS in Despam action (CVE-2010-0828).
* Fix XSS issues (see MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg):
* by escaping template name in messages
* by fixing other places that had similar issues
* Make moin compatible to werkzeug 0.5 .. 0.6.2 (1.9.2 had issues
with xmlrpc when used with werkzeug 0.6.x).
* MoinMoin.util.filesys: disable usage of dircache, deprecate dc* functions,
because the dircache stdlib module can't work correctly for fast updates of
directories.
* rss_rc and sisterpages actions: fix Content-Type header (mimetype)
* Fix associating OpenID identity with user, wasn't adapted to werkzeug yet.
* openidrp auth: fix undefined _ (gettext)
* Fix auth.cas and userprefs.oidserv request object usage.
* highlight parser: fixed MoinMoinBugs/LineNumberSpansForProcessInstructionsMissed
* Pygments syntax highlighting: add missing code files
* Notifications: use same email subject format for every notification
* Fix docbook formatter crashing, see MoinMoinPatch/IncludeMacroWithDocBookFormatter
* Fix regex content search for xapian search.
* Get rid of the empty line at the end of code highlights.
* GUI editor: compute editor height like the text editor does.
* Added help texts for: standalone server and moin migration.
* script.maint.cleancache: clean also i18n cache files
* Improved formatter.text_plain, see FeatureRequests/TextPlainFormatterRewrite
(fixes many issues of this formatter).
* text_html_text_moin_wiki: fixed index error for width="", see also:
MoinMoinBugs/GUI_convertor_list_index_out_of_range
* xmlrpc: disable editor backup for putPage, renamePage and revertPage
because if pages get uploaded by xmlrpc then the draft cache file can
rapidly increase in size, causing high memory usage because it needs to
get loaded into memory for updating/processing.
* Emit Content-Type header (with charset) for SlideShow action and many other
actions that just call send_title().
* ActionBase: better compatibility to moin 1.8, use request.values by
default, optionally use request.form data only
New features:
* RenamePage action: added ability to create redirect pages when renaming
(turned off by default, see show_rename_redirect config option).
* formatter/text_html: Added line number links to code blocks.
* diff action:
* Fixed whitespace in generated (html) diff view table so white-space: pre
can be used (and whitespace in diffs preserved).
* Added links to first/last revision.
* MoinMoin.widget.browser: introduced feature for sorting tables, see:
http://moinmo.in/FeatureRequests/SortableTables
* SystemAdmin user and attachment browsers: sorting feature used there now
* Scrolling the text editor to the double clicked line.
* Enable double-click-editing by default.
* WikiConfigHelp macro: make heading and description display optional,
heading level as a parameter (default 2)
* If edit ticket check fails, send the editor with the current content.
* moin import wikipage - use this script to import local files as a wiki page
Other changes:
* upgraded pygments from 1.2.2 to 1.3.1
* upgraded FCKeditor from 2.6.4.1 to 2.6.6
* added configuration snippet for ldap authentication against 2 servers
* improved script help output
Version 1.9.2:
Fixes:
* Fixed CVE-2010-0668: major security issues were discovered in misc. parts
of moin.
HINT: if you have removed superuser configuration to workaround the issue
(following our security advisory), you may re-add it after installing this
moin release. If you don't need superuser capabilities often, it might be
wise to not have superusers configured all the time, though.
* Fixed CVE-2010-0669: potential security issue due to incomplete user profile
input sanitizing.
* Improved package security: cfg.packagepages_actions_excluded excludes
unsafe or otherwise questionable package actions by default now.
* wiki parser: fixed transclusion of (e.g. video) attachments from other
pages.
* Fixed edit locking for non-logged in editors and cfg.log_remote_addr=False.
* mailimport: fix missing wikiutil import for normalize_pagename
* SubProcess: fix "timeout" AttributeError
* "standalone" wikiserver.py: fixed calling non-existing os.getuid on win32
* HTTPAuth deprecation warning moved from class level to __init__
* Fixed MoinMoinBugs/1.9DiffActionThrowsException.
* Fixed misc. session related problems, avoid unneccessary session file
updates.
* Fix/improve rename-related problems on Win32 (depending on Windows version).
* Fixed spider / user agent detection.
* Make sure to use language_default when language_ignore_browser is set.
* diff action: fix for case when user can't revert page.
* Fix trail size (was off by one).
* Updated bundled flup middleware (upstream repo checkout), avoids
socket.fromfd AttributeError on win32 if cgi is forced, gives helpful
exception msg.
* wikiutil: Fixed required_arg handling (no exception when trying to raise
exception that choice is wrong).
* Do not use MoinMoin.support.* to import 3rd party code, give dist packages
a chance.
* wikiutil.clean_input: avoid crash if it gets str type
* request: fixed for werkzeug 0.6 and 0.5.1 compatibility. Please note that
we didn't do much testing with 0.6 yet. So, if you use 0.6, please do some
testing and provide feedback to us.
* AttachFile._build_filelist: verifies readonly flag for unzip file link
* attachUrl: fix wrongly generated tickets (e.g. for AttachList macro)
* http headers: fix duplicated http headers (e.g. content-type)
New features:
* info action: added pagination ability to revision history viewer.
Use cfg.history_paging = True [default] / False to enable/disable it.
* ldap_login auth: add report_invalid_credentials param to control wrong
credentials error message (this is typically used when using multiple
ldap authenticators).
* Add RenderAsDocbook to actions_excluded if we have no python-xml.
* Upgraded pygments to 1.2.2 (some fixes, some new lexers).
* Text editor: if edit_rows==0 (user profile or config), we dynamically size
the text editor height. This avoids double sliders for the editor page
in most cases.
Other changes:
* New docs/REQUIREMENTS.
* Added a less magic cgi/fcgi driver (moin.fcgi), added fixer middleware
for apache2/win32 to it.
Version 1.9.1:
Bug fixes:
* Fixed CVE-2010-0667: sys.argv security issue.
* Fixed FileSessionService - use session_dir from CURRENT request.cfg (it
mixed up session_dirs in farm setups).
HINT: if you added the hotfix to your wikiconfig, please remove it now.
* Fixed creation of lots of session files (if anon session were enabled and
user agent did not support cookies).
* Fixed session file storage for a non-ascii base path.
* Fixed session cookie confusion for nested URL paths (like path=/ and
path=/mywiki - for more info, see also "New features").
* Handle cookie_lifetime / anonymous_session_lifetime upgrade issue
gracefully: emit errors/warnings to log, use old settings to create
cfg.cookie_lifetime as expected by moin 1.9.
* flup based frontends: fixed SCGI and AJP (didn't work).
* farmconfig example: remove wrong comment, add sample http/https entry.
* Fixed password reset url (email content needs full URL).
* Page: fixed adding of page contents (only data added now, without metadata) -
fixes MoinMoinBugs/DeprecatedPageInclusionErrornousPageInstructionsProcessing
* xmlrpc:
* Process attachname in get/putAttachment similarly.
* revertPage: convert pagename to internal representation.
* Fixed auth calls used by jabberbot (needs more work).
* Added missing config.umask support code (setting was not used), fixed
config.umask usage for page packages.
* Fixed browser language detection.
* Fixed language pack generation/installation for pt-br, zh, zh-tw.
* Fixed caching of formatted msgs, see MoinMoinBugs/1.9EditPageHelpLinksBroken.
* Fixed usage of i18n.wikiLanguages() on class level (moved to method), failed
when tools import the module (e.g. pydoc -k foo).
* highlight parser:
* fixed caching issue for "toggle line numbers" link.
* added missing support for console/bash session
* Fixed precedence of parsers: more special parsers now have precedence
before moin falls back to using the HighlightParser (syntax highlighting).
* Added extensions to the rst, moin and creole parser (example.rst, example.moin and
example.creole attachments are rendered now when viewed).
* Fixed MoinMoinBugs/LineNumberSpansForProcessInstructionsMissed for
moin_wiki, highlight and plain parser.
* Fixed MoinMoinBugs/LineNumberAnchorsInPreformattedText for highlight and
plain parser.
* Fixed MoinMoinBugs/TableOfContentsBrokenForIncludedPages.
* Exception raised on calling add_msg() after send_title(), which leads to
Internal Server Error on calling several actions (diff, preview) for
deprecated pages, is replaced with warning and call stack information in
the log.
* AttachFile.move_file: send events (so e.g. xapian index update happens)
* SubProcess: fixed win32-specific parts, fixed imports (fixes calling of
external xapian index filters)
* Fixed auth methods that use redirects (like OpenID).
* OpenID client:
* Add setting cfg.openidrp_allowed_op, default is [].
* Fixed logging in with openid and associating with an existing account.
* openidrp_sreg extension: handle UnknownTimeZoneError gracefully
* OpenID server:
* Fixed TypeError.
* Fixed processing POSTed form data AND URL args.
New features:
* diff: Added displaying of information about revisions (editor, size,
timestamp, comment), added revision navigation.
* text editor: added @TIMESTAMP@ variable for adding a raw time stamp
* xmlrpc: added renamePage and deleteAttachment methods.
* Accept "rel" attribute for links (moin wiki parser).
* Generate session cookie names to fix cookie path confusion and enable port-
based wiki farming.
HINT: New setting cfg.cookie_name:
None (default): use MOIN_SESSION_<PORT>_<PATH> as session cookie name. This
should work out-of-the-box for most setups.
'siteidmagic': use MOIN_SESSION_<SITEID>, which is unique within a wiki farm
created by a single farmconfig (currently, cfg.siteid is just
the name of the wiki configuration module).
'other_value': use MOIN_SESSION_other_value - this gives YOU control. Just
use same value to share the session between wikis and use a
different value, if you want a separate session.
HINT: Please do not use cfg.cookie_path any more - it usually should not be
needed any more, as we now always put path=/ into the cookie except if you
explicitly configure something else (only do that if you know exactly what
you're doing and if the default does not work for you).
HINT: see also the HelpOnSessions page which shows some typical configs.
* Store expiry into sessions, use moin maint cleansessions script to clean up.
HINT: use moin ... maint cleansessions --all once after upgrading.
HINT: you may want to add a cron job calling moin ... maint cleansessions
to regularly cleanup expired sessions (it won't remove not expired
sessions).
Other changes:
* Added rtsp, rtp, rtcp protocols to url_schemas.
* Added more info about index building to xapian wikiconfig snippet.
* Updated the wikicreole parser to version 1.1.
Version 1.9.0:
Note: This is a reduced CHANGES, ommitting details from rc/beta test and
also less interesting minor changes and fixes. It shows changes
relative to 1.8.6 release.
If you want to see full detail, read it there:
http://hg.moinmo.in/moin/1.9/file/b290d938be63/docs/CHANGES
New features: ==============================================================
* HINT: MoinMoin requires Python 2.4 now. If you only have Python 2.3 and
you don't want to upgrade it, please use MoinMoin 1.8.x.
* HINT: MoinMoin is now a WSGI application.
Please read the new install docs about how to use it, see:
http://master19.moinmo.in/InstallDocs
You also have a local copy of that page as docs/INSTALL.html.
* HINT: due to big changes in the request processing and the request
object (related to the WSGI refactoring), many 3rd party plugins might
need code updates to work with moin 1.9.
* HINT: We now offer different sized sets of system/help pages and the default
underlay just contains a single page: LanguageSetup. You need to be
superuser, visit that page and then install the language packs you like
(minimum is the essential set for English).
* HINT: LanguageSetup is the default page_front_page, you need to change that
after installing language packs (see above).
* New modular group and dict data access, you can use group and dict
backend modules to access group and dict data stored anywhere you like.
Currently we provide these backends:
* WikiGroups and WikiDicts backends get data from wikipages. They work
similar to old wikidicts code (but with less caching issues :).
* ConfigGroups and ConfigDicts backends get data from a dictionary
defined in the wiki config.
* CompositeGroups and CompositeDicts compose several backends, so data
may be retrieved from several sources. For example, groups may be
defined in the wiki config and on wiki pages.
* Using cfg.groups and cfg.dicts, you can define the backend to use to
access group and dict information (default: WikiGroups / WikiDicts
backend).
See the wiki/config/more_samples/ directory (groups_wikiconfig_snippet
and dicts_wikiconfig_snippet).
* See also the new HelpOnDictionaries and HelpOnGroups pages.
* Improved Xapian indexing / search:
* Moin's Xapian based search code was refactored:
* It is now based on the xappy library (see MoinMoin.support.xappy).
* Minimum Xapian requirement is 1.0.6 now.
* Outdated and unmaintained xapwrap lib was removed.
* regex search with Xapian enabled also is based on the xapian index now
* Safe 2-stage xapian index rebuilding:
moin index build --mode=buildnewindex # slow, concurrent
<stop wiki>
moin index build --mode=usenewindex # fast
<start wiki>
* Added wikiconfig snippet for xapian search.
* Improved drawing support:
* TWikiDraw:
* Support code was refactored/moved to the twikidraw action.
* Use drawing:example.tdraw to invoke it (drawing:example also still
works for backwards compatibility)
* Drawings are now stored as a single attachment foo.tdraw.
We added a migration script that converts your existing drawings.
* AnyWikiDraw:
* Java applet added, source code see contrib/.
* Support code for it is in anywikidraw action.
* Use drawing:example.adraw to invoke it.
* Drawings are stored in a similar way as foo.adraw.
* cfg.extensions_mapping added for mapping of attachment file extensions
to actions (currently used for anywikidraw/twikidraw action)
* Themes / static files related:
* Added modernized_cms theme (hides most wiki widgets from modernized if the
user is not logged in).
* Static file serving built-in (moved wiki/htdocs to MoinMoin/web/static/htdocs).
MoinMoin.web.static has a static file serving wrapper that uses the files
from htdocs subdirectory by default (docs=True).
You can also give another path or switch off creation of that static wrapper.
See the docstring of the static package for details.
* Theme packages: do_copythemefile now copies theme files to
MoinMoin/web/static/htdocs.
* Syntax highlighting is based on the pygments library now, it does this for
LOTS of stuff (programming languages, config files, ...) - use it like this:
{{{#!highlight xxx
...
}}}
xxx is any of the markups pygments supports (see HelpOnParsers).
Note: we still have some (deprecated) small wrappers around pygments,
so the old syntax #!python/pascal/cplusplus/... still works.
* Authentication improvements:
* HTTP auth related (see also HelpOnAuthentication):
* HTTPAuthMoin: http basic auth done by moin
* HINT: auth.http.HTTPAuth is now auth.GivenAuth
This was badly named from the beginning as for most servers, it just
looked at REMOTE_USER environment variable and relied on the server
doing the authentication (could be http basic auth or any other auth).
* LDAP/AD auth: new name_callback param to create a custom wiki username (not
the ldap login username)
* OpenID auth:
* Support for Simple Registration (SREG) extension.
Basic profile fields can be copied from OpenID provider when logging in.
* Support for Teams extension.
* Ability to accept logins from specific OpenID providers.
Login form changes based on configuration for better usability:
* 0 providers: normal text input box for OpenID URL
* 1 provider: hidden field, automatic form submission with JavaScript
* 2+ providers: select field, uses directed identity
* Sessions / cookies:
* HINT: cfg.cookie_lifetime is now a tuple (anon, loggedin), giving the
lifetime of the cookie in hours, accepting floats, for anon sessions and
logged-in sessions. Default is (0, 12). 0 means not to use a session
cookie (== not to establish a session) and makes only sense for anon users.
* cfg.cookie_httponly is new and defaults to False. Please note that if you
set it to True, TWikiDraw and similar stuff won't be able to use the session
cookie. Thus, if your wiki page doesn't allow writing for everybody, saving
a drawing will fail, because there is no session (== no logged in user) for
the TWikiDraw applet's saving POSTs.
* Macros:
* WikiConfigHelp: added section keyword for selecting a subset of the
description, e.g. <<WikiConfigHelp(section="xapian")>>
* HighlighterList: show Pygments syntax highlighters (see HelpOnParsers)
* Actions:
* SlideShow action added (please use the "modernized" theme [default])
* raw action mimetype support: ...?action=raw&mimetype=text/css
* PackagePages: create package file on-the-fly in memory and send it to the
client (do NOT create package.zip attachment)
* Improved logging / debugging / developer support:
* Main exception handler: include request url in log output.
* Environment variable MOIN_DEBUGGER=off/web/external (default is "off").
* Handle wikiserverconfig(_local) in the same way as wikiconfig(_local).
* GUI editor: improved attachment dialog
* "moin ... account homepage" script to create user homepages.
Removed features: ==========================================================
* Removed cfg.traceback_* settings (use logging configuration)
* Removed old session code and settings:
* Removed cfg.session_handler and session_id_handler (use cfg.session_service)
* Removed cfg.anonymous_session_lifetime (use cfg.cookie_lifetime)
Bug fixes: =================================================================
* Xapian indexing:
* Rely on xapian's locking (remove moin's additional and sometimes broken
locking, that blocked index-rebuilds or updates sometimes).
* Removed indexer threading.
* Fixed (reimplemented) indexer queue.
* Less disruptive xapian index rebuild.
* AdvancedSearch: example didn't work, fixed
* With the groups/dicts code rewrite, we fixed the caching problems that the
old code (< 1.9) sometimes had.
* Actions:
* Abort RenamePage if renaming of main page fails (do not try to rename
subpages).
* AttachFile do=view: quote filename and pagename params for EmbedObject
macro call
* unsubscribe action: add msg types so icons get displayed