FinalsClub / karmaworld

KarmaNotes.org v3.0
GNU Affero General Public License v3.0
7 stars 6 forks source link

bleach_whitelist prevents server from starting with models #399

Closed btbonval closed 9 years ago

btbonval commented 9 years ago
20:59:51 web.1  | Validating models...
20:59:51 web.1  | 
20:59:51 web.1  | Traceback (most recent call last):
20:59:51 web.1  |   File "/home/vagrant/karmanotes-web/local/lib/python2.7/site-packages/django/core/management/commands/runserver.py", line 93, in inner_run
20:59:51 web.1  |     self.validate(display_num_errors=True)
...
20:59:51 web.1  |   File "/vagrant/karmaworld/apps/notes/sanitizer.py", line 93, in <module>
20:59:51 web.1  |     class PreserveFormattingSanitizer(SuppressingSanitizer):
20:59:51 web.1  |   File "/vagrant/karmaworld/apps/notes/sanitizer.py", line 98, in PreserveFormattingSanitizer
20:59:51 web.1  |     allowed_elements = bleach_whitelist.generally_xss_safe
20:59:51 web.1  | AttributeError: 'module' object has no attribute 'generally_xss_safe'
btbonval commented 9 years ago
$ grep -r "bleach_whitelist"
karmaworld/apps/notes/sanitizer.py:import bleach_whitelist
karmaworld/apps/notes/sanitizer.py:    allowed_elements = bleach_whitelist.markdown_tags
karmaworld/apps/notes/sanitizer.py:    allowed_elements = bleach_whitelist.generally_xss_safe
karmaworld/apps/notes/sanitizer.py:    allowed_css_properties = bleach_whitelist.all_styles

Testing in an interpreter, only generally_xss_safe fails.

btbonval commented 9 years ago

Looks like generally_xss_safe is in the upstream repo of @yourcelf but has not been pushed to pip?

btbonval commented 9 years ago

pip install --upgrade bleach_whitelist fixed the issue.

Collecting bleach-whitelist from https://pypi.python.org/packages/source/b/bleach-whitelist/bleach-whitelist-0.0.7.tar.gz#md5=9bad5e8990408c6ba9189e3c02a3fee5
  Downloading bleach-whitelist-0.0.7.tar.gz
...

Not sure why pip -r didn't run the upgrade properly? The requirements.txt file is pretty explicit on the version.

yourcelf commented 9 years ago

Strange.. I thought pip -r requirements.txt would do upgrading if needed. I know pip install won't upgrade unless you also do pip install --upgrade.