Crash on Preview: AttributeError: 'SpooledTemporaryFile' object has no attribute 'encode'

[sebix]

A user clicked the Preview button when the Moin wiki threw an Internal Server Error. This is the corresponding traceback from the logs.

Traceback (most recent call last):
  File "/home/intevation/source/moin.git-venv-python3/lib/python3.11/site-packages/flask/app.py", line 1511, in 
    response = self.full_dispatch_request()
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/intevation/source/moin.git-venv-python3/lib/python3.11/site-packages/flask/app.py", line 919, in f
    rv = self.handle_user_exception(e)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/intevation/source/moin.git-venv-python3/lib/python3.11/site-packages/flask/app.py", line 917, in f
    rv = self.dispatch_request()
         ^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/intevation/source/moin.git-venv-python3/lib/python3.11/site-packages/flask/app.py", line 902, in d
    return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)  # type: ignore[no-any-return]
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/intevation/source/moin.git/src/moin/apps/frontend/views.py", line 951, in modify_item
    ret = item.do_modify(item_may=item_may)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/intevation/source/moin.git/src/moin/items/__init__.py", line 1604, in do_modify
    edit_utils.put_draft(data)
  File "/home/intevation/source/moin.git/src/moin/utils/edit_locking.py", line 175, in put_draft
    data_in = data_in.encode(self.coding)
              ^^^^^^^^^^^^^^
AttributeError: 'SpooledTemporaryFile' object has no attribute 'encode'
2025-08-08 10:00:02,923 ERROR moin:875 Exception on /+modify/A2/49 [POST]
Traceback (most recent call last):
  [same as above]

Using Moin 2.0.0b3-73-g44a66b21 (latest revision as of now).

[bernhardreiter]

A little worrying was that because "preview" was not working, the user clicked to submit the page and then the contents of a different file was somehow submitted as new page contents.

[roland-ruedenauer]

Could you please check what Content Type is listed in the metadata view of the affected page (A2/49)?

[sebix]

All revisions have content type text/x-markdown;charset=utf-8.

[UlrichB22]

A little worrying was that because "preview" was not working, the user clicked to submit the page and then the contents of a different file was somehow submitted as new page contents.

This is unlikely, as the names of the preview files contain “revid” and “userid”. You can check this in your wiki directory, e.g.

$ ls -l preview/
total 4
-rw-rw-r-- 1 hu hu 332 Feb 22 18:35 be7556a9a778481c938ff656fe230c9d-testuser1

$ find . | grep be7556a9a778481c938ff656fe230c9d
./preview/be7556a9a778481c938ff656fe230c9d-testuser1
./data/default/meta/be7556a9a778481c938ff656fe230c9d

[bernhardreiter]

This is unlikely

I know it is unlikely, but it is what I saw and it really surprised me. I am just describing the observations. The different "attachment" that somehow appeared in there was not handled recently. The most likly explanation is a data confusion on the backend side. However as it is not reproducible, all we have is the backtrace and the description from memory. As the possible consequences are severe, it makes sense to add the observation here.

[roland-ruedenauer]

You can reproduce the traceback shown above as follows

• modify an existing mark-down item in moin-2
• in the item content editing form click on "Choose File" and select a local file to replace the item content with when uploaded
• next click on the Preview button
• ModifyForm._dump() will find a data_file with a filename != "" and return the value "text/markdown" in contenttype_guessed (using Chromium as browser)
• the data returned by _dump() is the stream object created by werkzeug and has the type <tempfile.SpooledTemporaryFile>
• when entering Edit_Utils.put_draft() the parameter data_in is an instance of SpooledTemporaryFile and the attempt to encode it using "utf-8" at https://github.com/moinwiki/moin/blob/master/src/moin/utils/edit_locking.py#L175 will fail

[roland-ruedenauer]

Unfortunately, the details provided in the issue description were a bit lacking (meaning no clear way to reproduce the problem).

After looking at the code in detail, the only explanation of what might have happened is

• Page content was modified by uploading a file from the local file system.
• Previewing the content did fail because of a bug in Moin (fixed in Modify form: make loading content from file upload work #1994), but a draft for the current user has been stored anyways.
• Going back in the browser history after the preview crash and saving the page did (unexpectedly) replace the page content with the content of the file uploaded before the crash.

With the fixes applied in #1994, I suggest to close the issue.

[UlrichB22]

With the fixes applied in #1994, I suggest to close the issue.

Agree.