jenkins-bot has submitted this change. (
https://gerrit.wikimedia.org/r/c/pywikibot/core/+/1241139?usp=email )
Change subject: requirements: Prefer Pillow 12.1.1 or above
......................................................................
requirements: Prefer Pillow 12.1.1 or above
Due to security vulnerability Pillow 12.1.1 or above should be used.
For older version, PSD files cannot be used.
Bug: T418046
Change-Id: Idc29614237c2ec81030923f03af948d6ae99416e
---
M pywikibot/userinterfaces/gui.py
M requirements.txt
M setup.py
3 files changed, 36 insertions(+), 11 deletions(-)
Approvals:
Xqt: Looks good to me, approved
jenkins-bot: Verified
diff --git a/pywikibot/userinterfaces/gui.py b/pywikibot/userinterfaces/gui.py
index a6aa5b6..8c47ef9 100644
--- a/pywikibot/userinterfaces/gui.py
+++ b/pywikibot/userinterfaces/gui.py
@@ -10,14 +10,23 @@
.. note:: idlelib, tkinter and pillow modules are required.
.. caution::
- Pillow probably cannot be installed with GraalPy. PyPy 3.9 needs
- Pillow 10.4.0, PyPy 3.10 needs Pillow 11.3.0. CPython and other
- Python versions needs Pillow >= 10.4.0 to use this module.
+ Pillow may not be installable on GraalPy.
+ PyPy 3.9 needs Pillow 10.4.0, PyPy 3.10 needs Pillow 11.3.0.
+ CPython and other Python versions needs Pillow >= 11.3.0 to use this
+ module.
+
+.. danger::
+ Due to security vulnerability, use Pillow >= 12.1.1.
+ Requires PyPy >= 3.11 or CPython >= 3.10.
.. seealso:: :mod:`editor`
"""
from __future__ import annotations
+import pathlib
+
+from packaging.version import Version
+
import pywikibot
@@ -508,16 +517,32 @@
self.description_scrollbar.grid(row=14, column=5)
@staticmethod
- def get_image(photo, width, height):
- """Take the BytesIO object and build an imageTK thumbnail."""
+ def get_image(photo: str, width, height):
+ """Take the BytesIO object and build an imageTK thumbnail.
+
+ .. versionchanged:: 11.1
+ PSD files are not allowed for ``Pillow < 12.1.1``.
+
+ :raises ImportError: Pillow is not installed
+ :raises ValueError: if a PSD file is passed and Pillow < 12.1.1
+ """
try:
- from PIL import Image, ImageTk
+ from PIL import Image, ImageTk, __version__
except ImportError:
pywikibot.warning('This script requires ImageTk from the'
'Python Imaging Library (PIL).')
raise
- image = Image.open(photo)
+ path = pathlib.Path(photo)
+ pil_version = Version(__version__)
+ if pil_version < Version('12.1.1') and path.suffix.lower() == '.psd':
+ raise ValueError(
+ f'PSD files are not allowed with Pillow {pil_version} due to'
+ ' Pillow security advisory. Please update your Pillow and'
+ ' if necessary your Python.'
+ )
+
+ image = Image.open(path)
image.thumbnail((width, height))
return ImageTk.PhotoImage(image)
diff --git a/requirements.txt b/requirements.txt
index a1ceded..83219c8 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -43,9 +43,9 @@
# Pillow cannot be installed with GraalPy
Pillow==10.4.0; platform_python_implementation == "PyPy" and python_version ==
"3.9"
Pillow==11.3.0; platform_python_implementation == "PyPy" and python_version ==
"3.10"
-Pillow==12.1.0; platform_python_implementation == "PyPy" and python_version >=
"3.11"
+Pillow>=12.1.1; platform_python_implementation == "PyPy" and python_version >=
"3.11"
Pillow==11.3.0; platform_python_implementation == "CPython" and python_version
== "3.9"
-Pillow>=12.1.0; platform_python_implementation == "CPython" and
python_version >= "3.10"
+Pillow>=12.1.1; platform_python_implementation == "CPython" and
python_version >= "3.10"
# core pagegenerators
googlesearch-python >= 1.3.0
diff --git a/setup.py b/setup.py
index f0315d5..f90c198 100755
--- a/setup.py
+++ b/setup.py
@@ -51,11 +51,11 @@
'and python_version == "3.9"',
'Pillow==11.3.0; platform_python_implementation == "PyPy" '
'and python_version == "3.10"',
- 'Pillow==12.1.0; platform_python_implementation == "PyPy" '
+ 'Pillow>=12.1.1; platform_python_implementation == "PyPy" '
'and python_version >= "3.11"',
'Pillow==11.3.0; platform_python_implementation == "CPython" '
'and python_version == "3.9"',
- 'Pillow>=12.1.0; platform_python_implementation == "CPython" '
+ 'Pillow>=12.1.1; platform_python_implementation == "CPython" '
'and python_version >= "3.10"',
],
'mwoauth': [
--
To view, visit
https://gerrit.wikimedia.org/r/c/pywikibot/core/+/1241139?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.wikimedia.org/r/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: pywikibot/core
Gerrit-Branch: master
Gerrit-Change-Id: Idc29614237c2ec81030923f03af948d6ae99416e
Gerrit-Change-Number: 1241139
Gerrit-PatchSet: 1
Gerrit-Owner: Xqt <[email protected]>
Gerrit-Reviewer: Xqt <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
Pywikibot-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
