Merge pull request #1556 from UlrichB22/werkzeug3.0

Raise werkzeug to 3.0 and remove werkzeug.urls usage

setup.py

@@ -87,7 +87,7 @@
         'Jinja2>=3.1.0',  # template engine
         'markupsafe<=2.2.0',  # safe html and xml
         'pygments>=1.4',  # src code / text file highlighting
-        'Werkzeug<2.4.0',  # wsgi toolkit
+        'Werkzeug',  # wsgi toolkit
         'whoosh>=2.7.0',  # needed for indexed search
         'pdfminer.six',  # pdf -> text/plain conversion
         'passlib>=1.6.0',  # strong password hashing (1.6 needed for consteq)

src/moin/auth/__init__.py

@@ -3,6 +3,7 @@
 # Copyright: MoinMoin:FrankieChow, MoinMoin:NirSoffer
 # Copyright: 2005-2012 MoinMoin:ThomasWaldmann
 # Copyright: 2007      MoinMoin:JohannesBerg
+# Copyright: 2023      MoinMoin project
 # License: GNU GPL v2 (or any later version), see LICENSE.txt for details.
 
 """
@@ -133,9 +134,10 @@
 name of the authentication method.
 """
 
+from urllib.parse import quote, quote_plus
 from werkzeug.exceptions import abort
-from werkzeug.urls import url_quote, url_quote_plus
 from werkzeug.utils import redirect
+
 from flask import url_for, session, request
 from flask import g as flaskg
 from flask import current_app as app
@@ -411,8 +413,8 @@ def handle_login(userobj, **kw):
         if ret.redirect_to:
             nextstage = get_multistage_continuation_url(authmethod.name)
             url = ret.redirect_to
-            url = url.replace('%return_form', url_quote_plus(nextstage))
-            url = url.replace('%return', url_quote(nextstage))
+            url = url.replace('%return_form', quote_plus(nextstage))
+            url = url.replace('%return', quote(nextstage))
             abort(redirect(url))
         msg = ret.message
         if msg and msg not in flaskg._login_messages:

src/moin/converters/image_in.py

@@ -1,4 +1,5 @@
 # Copyright: 2010 MoinMoin:ThomasWaldmann
+# Copyright: 2023 MoinMoin project
 # License: GNU GPL v2 (or any later version), see LICENSE.txt for details.
 
 """
@@ -7,8 +8,7 @@
 Convert image to <object> tag for the DOM Tree.
 """
 
-from werkzeug.urls import url_decode
-from urllib.parse import urlencode
+from urllib.parse import urlencode, parse_qs
 
 from moin.constants.contenttypes import CHARSET
 from moin.utils.iri import Iri
@@ -38,7 +38,7 @@ def __call__(self, rev, contenttype=None, arguments=None):
             query = arguments.keyword.get(xinclude.href)
             if query and query.query:
                 # query.query value is similar to  "w=75" given a transclusion "{{jpeg||&w=75 class="top"}}"
-                query_keys.update(url_decode(query.query))
+                query_keys.update(parse_qs(query.query))
             attrib = arguments.keyword
 
         query = urlencode(query_keys, encoding=CHARSET)

src/moin/utils/send_file.py

@@ -1,5 +1,6 @@
 # Copyright: 2010 by Armin Ronacher (initial implementation)
 # Copyright: 2011 by MoinMoin:ThomasWaldmann (modifications)
+# Copyright: 2023 by MoinMoin project
 # License: BSD (see license of flask)
 
 """
@@ -24,8 +25,8 @@
 from time import time
 from zlib import adler32
 
+from urllib.parse import quote
 from werkzeug.datastructures import Headers
-from werkzeug.urls import url_quote
 from werkzeug.wsgi import wrap_file
 from flask import current_app, request
 
@@ -38,7 +39,7 @@ def encode_rfc2231(value, coding='UTF-8', lang=''):
     :param coding: the coding (charset) to use. it is a good idea to use 'UTF-8'.
     :param lang: the language to use. defaults to empty string (no language given).
     """
-    return "{0}'{1}'{2}".format(coding, lang, url_quote(value, charset=coding))
+    return "{0}'{1}'{2}".format(coding, lang, quote(value, encoding=coding))
 
 
 def send_file(filename=None, file=None,