Description

If you create a page with a colon in the name, for example HowTo:DoSomeTask, when you try to edit the page, all of the buttons (save, preview, cancel, etc) are broken.

I tracked the problem down. It seems that in the PageEditor.py, where it generates the form for the editor, the action= part gets a string from request.href(self.page_name). It seems the href method is what doesn't like the colons, and if you pass a page name with a colon in it, the href method doesn't return the /full/path/to/pagename, but just the page_name itself. This breaks the submission form.

I tried to escape it before passing it to href, but it ends up double escaped. Did some further digging, and it seems that werkzeug's href uses a method called url_quote which by default marks both '/' and ':' as "safe" chars, so they don't get quoted. Not exactly sure how to get around this.

Steps to reproduce

1. Create a page with a colon in the name, like HowTo:DoSomeTask

2. Try to edit the page
3. Try to click save, cancel, or preview once you've entered the editor

Example

Component selection

• Error is in the PageEditor.py (and any other files that generate the edit form)

• Problem is either with werkzeug's href method, or the fact that moinmoin doesn't escape the page before sending it to the href method, depending on how you look at it.

Details

Workaround

No real work around. A good solution would probably entail modifying werkzeug's code to either remove the ':' from the safe char list in it's url_quote method, or some how allow you to pass in your own safe char list to over ride the default.

Discussion

Isn't the colon syntax recognized as an InterWiki?

Can the Request.href function be passed a URL which actually has a http: prefix? I'm not sure, but in this case, : should be part of safe_chars. Prefixing the relative URLs with ./ before passing it to werkzeug's Href seems to make it do the correct thing. Here is a horrible patch that implements this hack. --BernardB.

Very similar issue: MoinMoinBugs/PagenameContainingColumn

I filed a werkzeug bug about this, let's see what happens:

https://github.com/mitsuhiko/werkzeug/issues#issue/46

Plan

• Priority:
• Assigned to:
• Status: looks like fixed in more recent werkzeug releases (we'll bundle a more recent one into 1.9.4 also)

CategoryMoinMoinBugFixed