Description

adding a file which contain non ascii characters in the filename fails.

Steps to reproduce

  1. create a file 'fööbär.töxt'
  2. AttachFile this one

  3. see Moin Stumble

Details

MoinMoin Version

1.3.0 - 1.3.1

Workaround

Do not use non-ascii filenames for attachments.

If this error occurs after migration you have to rename the file in the filesystem. Either recode the name into utf-8 or remove all non-ascii characters.

Discussion

This is probably related to the fact that we don't decode attachment file name in RequestBase._setup_args_from_cgi_form:

   1     def _setup_args_from_cgi_form(self, form=None):
   2         """ Setup args from a FieldStorage form
   3         
   4         Create the args from a standard cgi.FieldStorage to be used by
   5         derived classes, or from given form.
   6 
   7         All values are decoded using config.charset.
   8 
   9         @keyword form: a cgi.FieldStorage
  10         @rtype: dict
  11         @return dict with form keys, each contains a list of values
  12         """
  13         import cgi
  14         decode = wikiutil.decodeUserInput
  15 
  16         # Use cgi.FieldStorage by default
  17         if form is None:
  18             form = cgi.FieldStorage()
  19 
  20         args = {}
  21         # Convert form keys to dict keys, each key contains a list of
  22         # values.
  23         for key in form.keys():
  24             values = form[key]
  25             if not isinstance(values, types.ListType):
  26                 values = [values]
  27             fixedResult = []
  28             for i in values:
  29                 if isinstance(i, cgi.MiniFieldStorage):
  30                     data = decode(i.value, self.decode_charsets)
  31                 elif isinstance(i, cgi.FieldStorage):
  32                     data = i.value
  33                     if i.filename:
  34                         # TODO: why we don't decode this value?
  35                         # multiple uploads to same form field are stupid!
  36                         args[key+'__filename__'] = i.filename
  37                     else:
  38                         # we do not have a file upload, so we decode:
  39                         data = decode(data, self.decode_charsets)
  40                 # Append decoded value
  41                 fixedResult.append(data)
  42             
  43             args[key] = fixedResult
  44             
  45         return args

I think we should decode the filename, and save it on the server in quoted form, just like a wiki name. When sending back files to the client, we sould decode the filenamme and send the decoded name in the http headers.

In 1.2, this was not a problem, since the intenal format was 8bit, so it does not matter what characters you save to disk, its enough to use wikiutil.taintFilename to make it safe.

-- NirSoffer 2004-12-18 18:57:07

Plan


CategoryMoinMoinBugFixed CategoryRelease1.3.2

MoinMoin: MoinMoinBugs/AttachFileUnicodeFilenameFails (last edited 2007-10-29 19:19:45 by localhost)