Mailman 3 January 2003 - Mailman-coders

[ mailman-Feature Requests-676051 ] smarter ./configure script
by SourceForge.net 28 Jan '03

28 Jan '03

Feature Requests item #676051, was opened at 2003-01-28 12:20 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=350103&aid=676051&group_i… Category: None Group: None Status: Open Resolution: None Priority: 5 Submitted By: Szilard Vizi (szilardv) Assigned to: Nobody/Anonymous (nobody) Summary: smarter ./configure script Initial Comment: Mailman 2.1 supports different languages and maybe the ./configure script should check whether the language defined in the LC_LANG variable is among the supported languages. If so, "make install" notifies the user that the Mailman can be used in her/his language and can set up the DEAFULT_SERVER_LANGUAGE to this one with the approval of the user. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=350103&aid=676051&group_i…

1 0

[ mailman-Bugs-675979 ] Reply-To available, FollowUp-To missing
by SourceForge.net 28 Jan '03

28 Jan '03

Bugs item #675979, was opened at 2003-01-28 10:24 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=675979&group_i… Category: Pipermail Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Submitted By: Andreas Kotes (count) Assigned to: Nobody/Anonymous (nobody) Summary: Reply-To available, FollowUp-To missing Initial Comment: Hi! instead of either 'Reply-To or no Reply-To mailman could/should offer an option to use FollowUp-To, too. http://cr.yp.to/proto/replyto.html This should help against lots of discussion like the one we had a few days ago about the 'reply-to-harmful' or 'reply-to-useful' points of view. Count ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=675979&group_i…

1 0

[ mailman-Patches-640518 ] SpamAssassin handler
by SourceForge.net 28 Jan '03

28 Jan '03

Patches item #640518, was opened at 2002-11-18 21:26 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=640518&group_i… Category: list administration Group: Mailman 2.2 / 3.0 Status: Open Resolution: None Priority: 5 Submitted By: Jon Parise (jparise) Assigned to: Nobody/Anonymous (nobody) Summary: SpamAssassin handler Initial Comment: I've updated the existing SpamAssassin patch (534577) for Mailman 2.1. ---------------------------------------------------------------------- Comment By: Shamanic Acid (shamanicacid) Date: 2003-01-27 23:18 Message: Logged In: YES user_id=698712 I am a bit confused in which SpamAssassin.py file to use. There does not seem to be an embedded version number in the download links. The diff I see is as follows: $ diff SpamAssassin.1.py SpamAssassin.py 62,65d61 < # First, play footsie with _ so that the following are marked as translated, < # but aren't actually translated until we need the text later on. < def _(s): < return s 71,73d66 < reason = _('SpamAssassin identified this message as spam') < rejection = _('You message was identified as spam.') < 78,80d70 < reason = _('SpamAssassin identified this message as spam') < rejection = _('You message was identified as spam.') < Question # 1. Do I want to use the SpamAssassin.py file with the "footsie" code? Question # 2. Does the SpamAssassin.py code allow for exceptions when the e-mail is from the $list-owner ( bounces to moderator ) ? I ask because I ran into a problem with a mailer-loop occuring when SpamAssassin errantly tagged the $list-owner moderator bounces as spam. ( spamassasin marks pending e-mails from $list-owner with score 7.6 ) I have not read through all the code, I am curious if mlist.isMember(sender) includes the owner alias? Many Thanks in Advance ---------------------------------------------------------------------- Comment By: Jon Parise (jparise) Date: 2003-01-12 08:01 Message: Logged In: YES user_id=485579 I've updated the SpamAssassin handler to report a more detailed reason when a DiscardMessage and HoldMessage exception is raised. ---------------------------------------------------------------------- Comment By: Jon Parise (jparise) Date: 2002-12-31 16:33 Message: Logged In: YES user_id=485579 The attached patch adds the SpamAssassin handler to Mailman's mail processing pipelines. ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2002-11-27 08:13 Message: Logged In: YES user_id=12800 I'm only moving this to the MM2.2/3.0 group so I can concentrate on patches for 2.1. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=640518&group_i…

1 0

[ mailman-Patches-674553 ] patch for options.py cross site scripting bug
by SourceForge.net 27 Jan '03

27 Jan '03

Patches item #674553, was opened at 2003-01-25 07:42 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i… Category: Web UI Group: Mailman 2.1 Status: Open Resolution: None Priority: 8 Submitted By: Tokio Kikuchi (tkikuchi) Assigned to: Nobody/Anonymous (nobody) Summary: patch for options.py cross site scripting bug Initial Comment: fix this issue Example: ----------------- This is a simple example for version 2.1: 1) With mailman options the email variable is vulnerable to cross-site scripting. You can recognise the vulnerabilities with this type of URL: https://www.yourserver.com:443/mailman/options/yourlist? language=en&email=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> and that prove that any (malicious) script code is possible on web interface part of Mailman. 2) The default error page mailman generates does not adequately filter its input making it susceptible to cross-site scripting. https://www.yourserver.com:443//mailman/options/yourlist? language=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> ---------------------------------------------------------------------- >Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-01-26 16:33 Message: Logged In: YES user_id=12800 Very good. Here's the patch I intend to commit and advertise as a fix for the cross-site scripting bug. This additionally fixes a crash when the language cgi variable is deliberately given a bogus value. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-25 23:17 Message: Logged In: YES user_id=67709 Please review my second patch. It use Utils.ValidateEmail() and return immediately if the input string is insecure. Also, websafe(user) again to secure the final output. Note that the Exapmle is circulated in bugtraq ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-01-25 10:24 Message: Logged In: YES user_id=12800 Please try this more comprehensive fix. If it looks good, I will issue a security patch later today. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i…

1 0

[ mailman-Patches-674553 ] patch for options.py cross site scripting bug
by SourceForge.net 26 Jan '03

26 Jan '03

Patches item #674553, was opened at 2003-01-25 12:42 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i… Category: Web UI Group: Mailman 2.1 Status: Open Resolution: None Priority: 8 Submitted By: Tokio Kikuchi (tkikuchi) Assigned to: Nobody/Anonymous (nobody) Summary: patch for options.py cross site scripting bug Initial Comment: fix this issue Example: ----------------- This is a simple example for version 2.1: 1) With mailman options the email variable is vulnerable to cross-site scripting. You can recognise the vulnerabilities with this type of URL: https://www.yourserver.com:443/mailman/options/yourlist? language=en&email=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> and that prove that any (malicious) script code is possible on web interface part of Mailman. 2) The default error page mailman generates does not adequately filter its input making it susceptible to cross-site scripting. https://www.yourserver.com:443//mailman/options/yourlist? language=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> ---------------------------------------------------------------------- >Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-26 04:17 Message: Logged In: YES user_id=67709 Please review my second patch. It use Utils.ValidateEmail() and return immediately if the input string is insecure. Also, websafe(user) again to secure the final output. Note that the Exapmle is circulated in bugtraq ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-01-25 15:24 Message: Logged In: YES user_id=12800 Please try this more comprehensive fix. If it looks good, I will issue a security patch later today. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i…

1 0

[ mailman-Patches-674553 ] patch for options.py cross site scripting bug
by SourceForge.net 26 Jan '03

26 Jan '03

Patches item #674553, was opened at 2003-01-25 07:42 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i… Category: Web UI Group: Mailman 2.1 Status: Open Resolution: None >Priority: 8 Submitted By: Tokio Kikuchi (tkikuchi) Assigned to: Nobody/Anonymous (nobody) Summary: patch for options.py cross site scripting bug Initial Comment: fix this issue Example: ----------------- This is a simple example for version 2.1: 1) With mailman options the email variable is vulnerable to cross-site scripting. You can recognise the vulnerabilities with this type of URL: https://www.yourserver.com:443/mailman/options/yourlist? language=en&email=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> and that prove that any (malicious) script code is possible on web interface part of Mailman. 2) The default error page mailman generates does not adequately filter its input making it susceptible to cross-site scripting. https://www.yourserver.com:443//mailman/options/yourlist? language=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-01-25 10:24 Message: Logged In: YES user_id=12800 Please try this more comprehensive fix. If it looks good, I will issue a security patch later today. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i…

1 0

[ mailman-Patches-674553 ] patch for options.py cross site scripting bug
by SourceForge.net 26 Jan '03

26 Jan '03

Patches item #674553, was opened at 2003-01-25 07:42 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i… Category: Web UI Group: Mailman 2.1 Status: Open Resolution: None Priority: 5 Submitted By: Tokio Kikuchi (tkikuchi) Assigned to: Nobody/Anonymous (nobody) Summary: patch for options.py cross site scripting bug Initial Comment: fix this issue Example: ----------------- This is a simple example for version 2.1: 1) With mailman options the email variable is vulnerable to cross-site scripting. You can recognise the vulnerabilities with this type of URL: https://www.yourserver.com:443/mailman/options/yourlist? language=en&email=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> and that prove that any (malicious) script code is possible on web interface part of Mailman. 2) The default error page mailman generates does not adequately filter its input making it susceptible to cross-site scripting. https://www.yourserver.com:443//mailman/options/yourlist? language=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> ---------------------------------------------------------------------- >Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-01-25 10:24 Message: Logged In: YES user_id=12800 Please try this more comprehensive fix. If it looks good, I will issue a security patch later today. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i…

1 0

[ mailman-Patches-674553 ] patch for options.py cross site scripting bug
by SourceForge.net 25 Jan '03

25 Jan '03

Patches item #674553, was opened at 2003-01-25 12:42 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i… Category: Web UI Group: Mailman 2.1 Status: Open Resolution: None Priority: 5 Submitted By: Tokio Kikuchi (tkikuchi) Assigned to: Nobody/Anonymous (nobody) Summary: patch for options.py cross site scripting bug Initial Comment: fix this issue Example: ----------------- This is a simple example for version 2.1: 1) With mailman options the email variable is vulnerable to cross-site scripting. You can recognise the vulnerabilities with this type of URL: https://www.yourserver.com:443/mailman/options/yourlist? language=en&email=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> and that prove that any (malicious) script code is possible on web interface part of Mailman. 2) The default error page mailman generates does not adequately filter its input making it susceptible to cross-site scripting. https://www.yourserver.com:443//mailman/options/yourlist? language=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i…

1 0

[ mailman-Patches-674433 ] Add post_id information to messages
by SourceForge.net 25 Jan '03

25 Jan '03

Patches item #674433, was opened at 2003-01-24 22:09 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674433&group_i… Category: None Group: Mailman 2.1 Status: Open Resolution: None >Priority: 3 Submitted By: Steve Huston (srhuston) Assigned to: Nobody/Anonymous (nobody) Summary: Add post_id information to messages Initial Comment: This patch will add the value of mlist.post_id to the mail during processing. It adds a X-Post-ID header, which can then be searched for and placed in the header/footer of the message (non-digest only). It will also grab this information to put it in the archives, so if you use a searchable archive you can search for a message by post_id. This part is a little 'iffy'. The patch assumes you have the ht://Dig patches installed, but should work fine without them; will likely complain about templates/en/article.html and templates/en/htdig-conf.txt There is also added the ability to inflate the post_id value from the "General" section in the GUI. It makes sure you keep the value as a float, as well as only lets you increase it. This is handy if you are importing messages from an old archive and need to start the post_id at a larger number so as not to interfere with old messages. Left to do as of this writing: i18n (somebody?), documentation in Gui/General.py explaining post_id better (and why you might want/need to mess with it), documentation in Gui/NonDigest.py or templates/en/headfoot.html explaining %(post_id)s variable. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674433&group_i…

1 0

[ mailman-Patches-674433 ] Add post_id information to messages
by SourceForge.net 25 Jan '03

25 Jan '03

Patches item #674433, was opened at 2003-01-24 22:09 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674433&group_i… Category: None Group: Mailman 2.1 Status: Open Resolution: None Priority: 5 Submitted By: Steve Huston (srhuston) Assigned to: Nobody/Anonymous (nobody) Summary: Add post_id information to messages Initial Comment: This patch will add the value of mlist.post_id to the mail during processing. It adds a X-Post-ID header, which can then be searched for and placed in the header/footer of the message (non-digest only). It will also grab this information to put it in the archives, so if you use a searchable archive you can search for a message by post_id. This part is a little 'iffy'. The patch assumes you have the ht://Dig patches installed, but should work fine without them; will likely complain about templates/en/article.html and templates/en/htdig-conf.txt There is also added the ability to inflate the post_id value from the "General" section in the GUI. It makes sure you keep the value as a float, as well as only lets you increase it. This is handy if you are importing messages from an old archive and need to start the post_id at a larger number so as not to interfere with old messages. Left to do as of this writing: i18n (somebody?), documentation in Gui/General.py explaining post_id better (and why you might want/need to mess with it), documentation in Gui/NonDigest.py or templates/en/headfoot.html explaining %(post_id)s variable. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674433&group_i…

1 0