On Mon, Jan 07, 2013 at 09:07:10PM -0500, Sanjoy Mahajan wrote: >Package: python-moinmoin >Version: 1.9.4-8+deb7u1~bpo60+1 >Severity: normal > >On my Debian server, which runs squeeze plus squeeze backports, I was >running python-moinmoin 1.9.4-8+deb7u1~bpo60+1 from squeeze backports. >After the recent security upgrade, moinmoin stopped working. The >webserver (cherokee) log files had this error: > > 2013-01-07 20:48:32,231 WARNING MoinMoin.log:139 using logging configuration > read from built-in fallback in MoinMoin.log module! > Traceback (most recent call last): > File "/usr/share/moin/server/moin.fcgi", line 44, in <module> > app = make_application(shared=True) # <-- adapt here as needed > File "/usr/lib/pymodules/python2.6/MoinMoin/web/serving.py", line 82, in > make_application > from MoinMoin.wsgiapp import application > File "/usr/lib/pymodules/python2.6/MoinMoin/wsgiapp.py", line 14, in > <module> > from MoinMoin.web.contexts import AllContext, Context, XMLRPCContext > File "/usr/lib/pymodules/python2.6/MoinMoin/web/contexts.py", line 16, in > <module> > from MoinMoin import i18n, error, user, config, wikiutil > File "/usr/lib/pymodules/python2.6/MoinMoin/user.py", line 32, in <module> > from werkzeug.security import safe_str_cmp as safe_str_equal > ImportError: cannot import name safe_str_cmp > >It seems that werkzeug.security contains safe_str_cmp only from version >0.7. See the documentation of werkzeug.security.safe_str_cmp in ><http://werkzeug.pocoo.org/docs/utils/>. However, in squeeze, >python-werkzeug is only at version 0.6.2-1 (and the wheezy version of >python-werkzeug, namely 0.8.3, isn't in backports). > >I worked around the problem by downgrading to the python-moinmoin in >squeeze (1.9.3-1+squeeze4) and changing /moin_static194/ to >/moin_static193/ in cherokee's config file. > >Is a better solution to backport python-werkzeug? I tried recompiling >it from the source package, but it required upgrading many other >packages so I just took the shortcut above.
Apologies, I missed the safe_str_cmp dependency when I did the latest backport upload. I'll drop that change and upload a new backport build shortly. -- Steve McIntyre, Cambridge, UK. [email protected] Welcome my son, welcome to the machine. -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
