Bug#815054: Tables: rowbgcolor creates crappy html

[Norbert Warmuth]

Tags: patch

Hello Thomas,

Thomas Renard <cybae...@web.de> writes:
> after upgrading from squeeze 1.9.3-1 to jessie 1.9.8-1 the rowbgcolor
> and all other color tags of my wikis with "#color" do not work anymore.

> When looking into the the HTML code like the following is created:
>
> ||<rowbgcolor="#aabbcc"> ||
>
> looks now:
>
> <tr style="background color: &amp;quot;#aabbcc&amp;quot">

I'm experiencing this issue too and had a closer look at it:

Workaround: 

Replace wikiutil.escape (the line "escape = werkzeug.escape" in
MoinMoin/wikiutil.py) with a copy from MoinMoin/support/werkzeug/utils.py
(moin_1.9.8.orig.tar.gz).

Detailed description:

The debian package ignores the bundled support libraries and instead
uses the system-wide libraries (use_systemwide_libs.patch), i. e. on
jessie moin uses the system-wide (python-)werkzeug 0.9.6 instead of the 
bundled werkzeug 0.8.3.

The werkzeug.escape (>=0.9) function ignores the optional quote 
parameter and always translates the quotation mark character ("). This
breaks at least wikiutil.parseAttributes and thus moin tables formatted 
with HTML table attributes.

As far as I can see almost everything within moin uses the 
wikiutil.escape function, i.e. replacing it seems to be the minimal 
fix for this and possibly further issues (patch attached, slightly 
testet on top of moin 1.9.8-1 from jessie).

- Norbert


Description: Replace wikiutil.escape function
  The debian package ignores the bundled support libraries and instead
  uses the system-wide libraries (use_systemwide_libs.patch), i. e. on
  jessie moin uses the system-wide library werkzeug 0.9.6 instead of 
  the bundled werkzeug 0.8.3.
  .
  The werkzeug.escape (>=0.9) function ignores the optional quote parameter 
  and always translates the quotation mark character ("). This breaks
  at least parseAttributes (e.g. moin tables formatted with HTML
  table attributes).
  .
  As workaround replace wikiutil.escape with a verbatim copy from 
  MoinMoin/support/werkzeug/utils.py. Closes: #815054
Author: Norbert Warmuth

Index: moin-1.9.8/MoinMoin/wikiutil.py
===================================================================
--- moin-1.9.8.orig/MoinMoin/wikiutil.py
+++ moin-1.9.8/MoinMoin/wikiutil.py
@@ -177,7 +177,31 @@ def quoteWikinameURL(pagename, charset=c
     return werkzeug.url_quote(pagename, charset=charset, safe='/')
 
 
-escape = werkzeug.escape
+# escape = werkzeug.escape
+# Verbatim copy from MoinMoin/support/werkzeug/utils.py because
+# werkzeug.escape from the system-wide werkzeug  >= 0.9 ignores
+# the optional quote parameter and always translates the 
+# quotation mark character (").
+def escape(s, quote=False):
+    """Replace special characters "&", "<" and ">" to HTML-safe sequences.  If
+    the optional flag `quote` is `True`, the quotation mark character (") is
+    also translated.
+
+    There is a special handling for `None` which escapes to an empty string.
+
+    :param s: the string to escape.
+    :param quote: set to true to also escape double quotes.
+    """
+    if s is None:
+        return ''
+    elif hasattr(s, '__html__'):
+        return s.__html__()
+    elif not isinstance(s, basestring):
+        s = unicode(s)
+    s = s.replace('&', '&amp;').replace('<', '&lt;').replace('>', '&gt;')
+    if quote:
+        s = s.replace('"', "&quot;")
+    return s
 
 
 def clean_input(text, max_len=201):