Mailman 3 February 2003 - Mailman-coders

[ mailman-Patches-674401 ] ToDigest.py i18n subject
by SourceForge.net Feb. 7, 2003

Feb. 7, 2003

Patches item #674401, was opened at 2003-01-25 01:08 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674401&group_i… Category: internationalization Group: Mailman 2.1 Status: Open Resolution: None Priority: 5 Submitted By: Tokio Kikuchi (tkikuchi) Assigned to: Nobody/Anonymous (nobody) Summary: ToDigest.py i18n subject Initial Comment: ToDigestl.py (v2.23) was considerably improved but there remain some oddities in digested message subject representation. Specificaly, MIME subject is not wrapped with the lheader() propperly. Please examine the files I am going to attach. 1. Test program to examine the behaviour of lheader() and improbed (but lengthy) header_in_a_line() which removes excessive CRLF and adjust folding white spaces. It simulates the subject-prefix which will be added in CookHeaders.py. 2. Result of test program. You will notice incompatiblity when the subject is once MIME encoded. 3. New patch which use header_in_a_line() and Utils.wrap() ---------------------------------------------------------------------- >Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-02-07 03:28 Message: Logged In: YES user_id=67709 Sorry, I have uploaded intermediate version. This is final, I hope. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-02-07 00:37 Message: Logged In: YES user_id=67709 updating patch for fixing new unicode-related error reported by Dan Mick. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-02-04 07:15 Message: Logged In: YES user_id=67709 This is my final patch. And, I like no blank line in TOC. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-31 07:01 Message: Logged In: YES user_id=67709 OK, Barry. I will compromise. Use u''.join() not u' '.join(). This eliminate extra space added when joining. Remember that all-ASCII header will get double space after the prefix for English text while the spaces after the prefix is removed for Japanese text. I think __unicode__() joining in the email package should take care the difference in RFC2822/2047 headers. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-31 05:55 Message: Logged In: YES user_id=67709 Looks like good for english text (may be for western) but folding white space should be treated as null string ('') in iso-2022-jp encoded japanese (and other RFC 2047 encoded MIME subject, I believe). u' '.join() must be u''.join() in these languages. You must alway check if the part of the header is mime encoded or not when joining. :-( ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-01-31 05:17 Message: Logged In: YES user_id=12800 Tell me what you think of the hial() function in the attached file. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-25 01:16 Message: Logged In: YES user_id=67709 Forget to note: This patch is revise of #668819 which was closed and differently applied in recent CVS. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674401&group_i…

1 0

[ mailman-Patches-674401 ] ToDigest.py i18n subject
by SourceForge.net Feb. 7, 2003

Feb. 7, 2003

Patches item #674401, was opened at 2003-01-25 01:08 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674401&group_i… Category: internationalization Group: Mailman 2.1 Status: Open Resolution: None Priority: 5 Submitted By: Tokio Kikuchi (tkikuchi) Assigned to: Nobody/Anonymous (nobody) Summary: ToDigest.py i18n subject Initial Comment: ToDigestl.py (v2.23) was considerably improved but there remain some oddities in digested message subject representation. Specificaly, MIME subject is not wrapped with the lheader() propperly. Please examine the files I am going to attach. 1. Test program to examine the behaviour of lheader() and improbed (but lengthy) header_in_a_line() which removes excessive CRLF and adjust folding white spaces. It simulates the subject-prefix which will be added in CookHeaders.py. 2. Result of test program. You will notice incompatiblity when the subject is once MIME encoded. 3. New patch which use header_in_a_line() and Utils.wrap() ---------------------------------------------------------------------- >Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-02-07 00:37 Message: Logged In: YES user_id=67709 updating patch for fixing new unicode-related error reported by Dan Mick. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-02-04 07:15 Message: Logged In: YES user_id=67709 This is my final patch. And, I like no blank line in TOC. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-31 07:01 Message: Logged In: YES user_id=67709 OK, Barry. I will compromise. Use u''.join() not u' '.join(). This eliminate extra space added when joining. Remember that all-ASCII header will get double space after the prefix for English text while the spaces after the prefix is removed for Japanese text. I think __unicode__() joining in the email package should take care the difference in RFC2822/2047 headers. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-31 05:55 Message: Logged In: YES user_id=67709 Looks like good for english text (may be for western) but folding white space should be treated as null string ('') in iso-2022-jp encoded japanese (and other RFC 2047 encoded MIME subject, I believe). u' '.join() must be u''.join() in these languages. You must alway check if the part of the header is mime encoded or not when joining. :-( ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-01-31 05:17 Message: Logged In: YES user_id=12800 Tell me what you think of the hial() function in the attached file. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-25 01:16 Message: Logged In: YES user_id=67709 Forget to note: This patch is revise of #668819 which was closed and differently applied in recent CVS. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674401&group_i…

1 0

[ mailman-Bugs-681505 ] no moderation after changing email
by SourceForge.net Feb. 6, 2003

Feb. 6, 2003

Bugs item #681505, was opened at 2003-02-06 06:50 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=681505&group_i… Category: security/privacy Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Submitted By: Roland Dworschak (cod3rs) Assigned to: Nobody/Anonymous (nobody) Summary: no moderation after changing email Initial Comment: we're using Mailman v2.1. Our list has set "default_member_moderation" to "Yes" and all new members have the "mod"-value set correctly, but if any of this members changes his email address via the webinterface (/mailman/options/<list>/<email>) his "mod"-value is no longer set and he's able to post to the list without any moderation. I haven't found anything in the archive, maybe someone has a solution to this. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=681505&group_i…

1 0

[ mailman-Patches-645297 ] Add PGP support
by SourceForge.net Feb. 6, 2003

Feb. 6, 2003

Patches item #645297, was opened at 2002-11-28 09:54 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=645297&group_i… Category: None Group: Mailman 2.2 / 3.0 Status: Open Resolution: None Priority: 5 Submitted By: Ben Laurie (benl) Assigned to: Nobody/Anonymous (nobody) Summary: Add PGP support Initial Comment: Support PGP encrypted lists using GnuPG. ---------------------------------------------------------------------- Comment By: Nicolas Marchildon (elecnix) Date: 2003-02-06 00:16 Message: Logged In: YES user_id=106549 My vote goes to a PGP whitelist and blacklist feature. Messages signed with a key present in the whitelist could go skip moderation, messages in the blacklist would be either ignored or rejected, and all other messages could go through moderation. That way, PGP signatures are not required, but those using them would see their messages delivered quickly. Mailman would have two keyrings, and would manage them by specifying --keyring to gpg. PGP keys would be retreived from a PGP key server. When moderating a message that was signed with a key missing from the whitelist, there would be an option named "Add key to whitelist", and an other one for the blacklist. Keys could be added to the white/blacklist through the web interface by specifying at least a key ID, and mailman would ask gpg to fetch the key from mailman's default key server. Initially proposed in French on: http://www.linux-quebec.org/archives/general/msg03787.html Nicolas Marchildon ---------------------------------------------------------------------- Comment By: David Shaw (dmshaw) Date: 2003-01-04 14:59 Message: Logged In: YES user_id=606006 Another vote of support. I actually submitted an enhancement request earlier today for exactly this. ---------------------------------------------------------------------- Comment By: captain larry (captainlarry) Date: 2002-12-23 14:37 Message: Logged In: YES user_id=147905 Adding a vote of support for this patch. Please add it as soon as it's appropriate! I've been waiting a long time for this functionality and I'd hate to see the patch bitrot. :-) Adam. ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2002-12-11 22:56 Message: Logged In: YES user_id=12800 I have to defer this patch until after MM2.1 since we're about ready for the first release candidate. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=645297&group_i…

1 0

[ mailman-Patches-444884 ] Integration of Mailman & htdig for archi
by SourceForge.net Feb. 5, 2003

Feb. 5, 2003

Patches item #444884, was opened at 2001-07-26 18:27 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=444884&group_i… Category: Pipermail Group: Mailman 2.2 / 3.0 Status: Open Resolution: None Priority: 3 Submitted By: Richard Barrett (ppsys) Assigned to: Barry A. Warsaw (bwarsaw) Summary: Integration of Mailman & htdig for archi Initial Comment: This patch is applicable to Mailman 2.0.6 release that has had search enhancement patch 444879 patch installed - if your Defaults.py has the ARCHIVE_INDEXING_ENABLE and ARCHIVE_INDEXING_DISABLE in it then you've got that patch. It replaces earlier patches 401670 and 402423 and is mainly to correct some problems arising from fixes introduced into Mailman by bug fix releases since the 402423 patch. This patch integrates htdig with Mailman and provides: 1. per list search facility with a search form on the list's TOC page. 2. maintenance of privacy of private archives which requires the user to establish their credentials via the normal private archive access before any access via htdig is allowed. 3. a common base URL for both public and private archive access via htsearch results so that htdig indices are unaffected by changingan archive from private to public and vice versa. All access to archives via htdig is controlled by a new wrapped cgi- bin script called htdig.py. 4. a new cron activated script and extra crontab entry which runs htdig regularly to maintain the per list search indices. 5. automatic creation, deletion and maintenance of htdig configuration files and such. Beyond installing htdig and telling Mailman where it is via mm_cfg you do not have to do any other setup. Well not quite you do have to set up a single per installation symlink to allow htdig to find the automatically generated per list htdig configuration files. You probably want to run this patch as follows: cd <mailman 2.0.6 untarred and unzipped directory> patch -p1 < <this patch file> ---------------------------------------------------------------------- >Comment By: Richard Barrett (ppsys) Date: 2003-02-05 18:12 Message: Logged In: YES user_id=75166 It seems it is possible, if this patch is installed, for a list's htdig conf file and the list specific htdig index db files to be read directly through the web interface for list archives. Even if this patch isn't installed it seems a list's pipermail.pck file can also be read directly through the web interface for list archives. This seems to be true for accesses via /pipermail for public lists and via /mailman/private for private lists. The problem does not occur for htdig search results accessed via /mailman/htdig as the htdig.py script is more protective than private.py Broadly speaking the data affected is availble to a user in normal operation which is why I do not consider the issue to be a security breach as such. Adding the following RewriteRule to Apache's httpd.conf prevents the situation, assuming you got the RewriteEngine On: RewriteRule ^(/pipermail/.*)/(pipermail.pck|htdig/[^/]*)$ $1/index.html [F] RewriteRule ^(/mailman/private/.*)/(pipermail.pck|htdig/[^/]*)$ $1/index.htm l [F] You could, of course, substitute an R flag for the F flag on the RewriteRules and be more hacker friendly. ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2003-01-22 14:20 Message: Logged In: YES user_id=75166 htdig-2.1-0.3.patch corrects yet another bug in htdig.py. Hope that all of them! Stops use of obsolete config variable DEFAULT_HOST in several files. ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2003-01-15 20:18 Message: Logged In: YES user_id=75166 htdig-2.1-0.2.patch corrects a bug in htdig.py and deals with an adverse interaction between htdig.py and a bug in $prefix/scripts/driver (see #668685 for a patch to fix this). It also improves the content type and security handling by htdig.py for MM 2.1 version of patch ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2003-01-15 20:14 Message: Logged In: YES user_id=75166 Uploaded wrong file mailer-2.0.13-0.4.patch on last attempt. Should have been htdig-2.0.13-0.4.patch which improves the content type and security handling by htdig.py for MM 2.0.13 version of patch. Please ignore mailer-2.0.13-0.4.patch file ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2003-01-15 20:09 Message: Logged In: YES user_id=75166 mailer-2.0.13-0.4.patch improves the content type and security handling by htdig.py for MM 2.0.13 version of patch ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2003-01-02 16:07 Message: Logged In: YES user_id=75166 htdig-2.1-0.1.patch is a revised version of the patch that is compatible with MM 2.1 ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-12-11 11:48 Message: Logged In: YES user_id=75166 htdig-2.1b6-0.1.patch is a revised version of the patch that is compatible with MM 2.1b6 ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-12-04 10:53 Message: Logged In: YES user_id=75166 htdig-2.0.13-0.3.patch corrects a minor typo in text appearing in the list TOC after the patch is applied. ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-11-27 10:24 Message: Logged In: YES user_id=75166 htdig-2.1b5-0.1.patch is a revised version of the patch that is compatible with MM 2.1b5 ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-10-30 11:43 Message: Logged In: YES user_id=75166 htdig-2.1b4-0.1.patch is a revised version of the patch that is compatible with MM 2.1b4 ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-10-14 11:50 Message: Logged In: YES user_id=75166 htdig-2.1b3-0.3.patch removes use of the file() function, used instead of the open() function, in three cron scripts added by the patch. Use of the file() function created an unnecessary dependency on Python 2.2 ---------------------------------------------------------------------- Comment By: Colin Mackinlay (cmackinlay) Date: 2002-10-12 16:51 Message: Logged In: YES user_id=624179 Got a workaround! The line referred to in the traceback: file(rundig_run_file, 'w').close() is used to create a 'rundig_last_run' file of lenght 0 bytes Creating this manually (or copying it) means the line isn't called and everything seems to work. Either file() is not a valid function call or my python is broken - I'm not literate enough in python to know the answer though! ---------------------------------------------------------------------- Comment By: Colin Mackinlay (cmackinlay) Date: 2002-10-06 14:18 Message: Logged In: YES user_id=624179 Just rebuilt MM as 2.1b3 with htdig. Upgraded lists which had htdig before work fine New lists give the obvious error: Unable to read word database file Did you run htmerge? Running the cronjob doesn't fix as it used to, message is: Output from command /usr/bin/python - S /usr/local/mailman/cron/nightly_htdig .. Traceback (most recent call last): File "/usr/local/mailman/cron/nightly_htdig", line 153, in ? main() File "/usr/local/mailman/cron/nightly_htdig", line 118, in main file(rundig_run_file, 'w').close() NameError: global name 'file' is not defined The archive/htdig folder only contains the xx.conf file, but no db.xx files If I copy in db.xx files from another list then the problem goes away (except I've now got an invalid set of references!) Is this my elementary error or is it more sinister?! ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-08-15 11:02 Message: Logged In: YES user_id=75166 htdig-2.1b3-0.2.patch corrects a dumb syntax error in htdig- 2.1b3-0.1.patch which will typically show up as logged errors in the operation of the ArchRunner qrunner at line 721 of HyperArch.py ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-08-14 16:51 Message: Logged In: YES user_id=75166 htdig-2.1b3-0.1.patch is a revised version of the patch that is compatible with MM 2.1b3 ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2002-08-08 16:33 Message: Logged In: YES user_id=12800 I've sent Richard some comments off-line about this patch. Meta comments: the 2.0.x patches can't be officially supported, but I'm going to create an unofficial patches page off the wiki for where the 2.0 patches can be migrated. I think this patch set is too big for MM2.1, but if it's cleaned up as per my private message, let's re-evaluate it for MM2.2 (or 3.0). ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-08-05 10:11 Message: Logged In: YES user_id=75166 htdig-2.0.13-0.2.patch just adds a GPL notice to the patch ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-08-01 16:35 Message: Logged In: YES user_id=75166 htdig-2.1b2-0.1.patch is a revised version of the patch that is compatible with MM 2.1b2 ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-07-30 11:25 Message: Logged In: YES user_id=75166 htdig-2.0.13-0.1.patch is purely cosmetic to get no mumble application to MM 2.0.13 ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-07-25 15:07 Message: Logged In: YES user_id=75166 Do not use htdig-2.0.12-0.1.patch there is an error in it. Use htdig-2.0.12-0.2.patch instead ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-07-25 14:10 Message: Logged In: YES user_id=75166 htdig-2.0.12-0.1.patch is a revised version of the patch that applies without complaint to MM 2.0.12. It also add a facility for adding site wide htdig configuration attributes to all list specific htdig configuration files. ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-05-23 09:59 Message: Logged In: YES user_id=75166 htdig-2.0.11-0.1.patch is a revised version of the patch that is compatible with MM 2.0.11 This version removes an incompatibility with Python 2.2 which caused warning messages to be generated when any of the family cron/nightly_htdig scripts were run. Some guidance on file access permissions for some htdig database files needed by rundig have been added to installation notes. ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-04-19 10:59 Message: Logged In: YES user_id=75166 htdig-2.0.10-0.1.patch is a revised version of the patch that is compatible with MM 2.0.10 ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-04-08 17:46 Message: Logged In: YES user_id=75166 htdig-2.0.9-0.1.patch is a revised version of the patch that is compatible with MM 2.0.9 ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2002-03-06 16:22 Message: Logged In: YES user_id=75166 htdig-2.1cvs-20020306.patch is a revised version of the patch that is compatible with the code published in mailman CVS on sourceforge as 12:30 GMT 6 Mar 2002 Known deficiency is that the non-English versions of files under $build/templates still contain text in English and need translations I cannot do. Also the necessary pygettext activity and subsequent translations in files under $build/messages remain to be done. ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2001-12-17 16:56 Message: Logged In: YES user_id=75166 htdig-2.1cvs-20011217.patch is a revised version of the patch that is compatible with the code published in mailman CVS on sourceforge as 11:50 GMT 17 Dec 2001 The only known deficiency is that the non-English versions of files under $build/templates still contain text in English and need translations I cannot do. Also the necessary pygettext activity and subsequent translations in files under $build/messages remain to be done. ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2001-12-13 16:58 Message: Logged In: YES user_id=75166 htdig-2.1a3-0.1.patch is a revised version of the patch that is compatible with the code published in mailman-2.1a3.tgz on sourceforge. The only known deficiency is that the non-English versions of files under $build/templates still contain text in English and need translations I cannot do. Also the necessary pygettext activity and subsequent translations in files under $build/messages remain to be done. ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2001-11-28 17:33 Message: Logged In: YES user_id=75166 The htdig-2.0.8-0.1.patch version of the patch resolves a problem that can arise with htdig indexing if the web_page_url for a list uses other than the http addressing (some folks want to use https). While specified as for MM 2.0.8 the revised patch should work OK with 2.0.7, 2.0.6 and probably back as far as 2.0.3. If you do not have the requirement for using other than http addressing in you lists web_page_urls it probably isn't worth the trouble of upgrading to this patch level. ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2001-11-28 11:08 Message: Logged In: YES user_id=75166 This patch should also apply without problems to MM 2.0.8 ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2001-11-27 12:00 Message: Logged In: YES user_id=75166 This patch should also apply without problems to Mm 2.0.7 ---------------------------------------------------------------------- Comment By: Richard Barrett (ppsys) Date: 2001-11-09 11:54 Message: Logged In: YES user_id=75166 The htdig-2.0.6-03.patch version of the patch makes some previously hard-coded things configurable and enhances the capability to run the htdig searches and indexing on a different machine to the one delivering Mailman and Mailman's web UI. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=444884&group_i…

1 0

no longer moderated if changing email
by Roland Dworschak Feb. 5, 2003

Feb. 5, 2003

hi there, we're using Mailman v2.1. Our list has set "default_member_moderation" to "Yes" and all new members have the "mod"-value set correctly, but if any of this members changes his email address via the webinterface (/mailman/options/<list>/<email>) his "mod"-value is no longer set and he's able to post to the list without any moderation. I haven't found anything in the archive, maybe someone has a solution to this. regards -- Roland Dworschak <roland.dworschak(a)cod3rs.com> http://cod3rs.com/ fingerprint : 0ED3 5AF2 CE34 26C5 10CA A63B 1F99 C37F 4748 90F3 pgp/gpg key : http://cod3rs.com/pgp-gpg/roland.dworschak.asc

1 0

[ mailman-Patches-674401 ] ToDigest.py i18n subject
by SourceForge.net Feb. 4, 2003

Feb. 4, 2003

Patches item #674401, was opened at 2003-01-25 01:08 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674401&group_i… Category: internationalization Group: Mailman 2.1 Status: Open Resolution: None Priority: 5 Submitted By: Tokio Kikuchi (tkikuchi) Assigned to: Nobody/Anonymous (nobody) Summary: ToDigest.py i18n subject Initial Comment: ToDigestl.py (v2.23) was considerably improved but there remain some oddities in digested message subject representation. Specificaly, MIME subject is not wrapped with the lheader() propperly. Please examine the files I am going to attach. 1. Test program to examine the behaviour of lheader() and improbed (but lengthy) header_in_a_line() which removes excessive CRLF and adjust folding white spaces. It simulates the subject-prefix which will be added in CookHeaders.py. 2. Result of test program. You will notice incompatiblity when the subject is once MIME encoded. 3. New patch which use header_in_a_line() and Utils.wrap() ---------------------------------------------------------------------- >Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-02-04 07:15 Message: Logged In: YES user_id=67709 This is my final patch. And, I like no blank line in TOC. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-31 07:01 Message: Logged In: YES user_id=67709 OK, Barry. I will compromise. Use u''.join() not u' '.join(). This eliminate extra space added when joining. Remember that all-ASCII header will get double space after the prefix for English text while the spaces after the prefix is removed for Japanese text. I think __unicode__() joining in the email package should take care the difference in RFC2822/2047 headers. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-31 05:55 Message: Logged In: YES user_id=67709 Looks like good for english text (may be for western) but folding white space should be treated as null string ('') in iso-2022-jp encoded japanese (and other RFC 2047 encoded MIME subject, I believe). u' '.join() must be u''.join() in these languages. You must alway check if the part of the header is mime encoded or not when joining. :-( ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-01-31 05:17 Message: Logged In: YES user_id=12800 Tell me what you think of the hial() function in the attached file. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-25 01:16 Message: Logged In: YES user_id=67709 Forget to note: This patch is revise of #668819 which was closed and differently applied in recent CVS. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674401&group_i…

1 0

[ mailman-Patches-667026 ] HyperArch.py unicode substitution
by SourceForge.net Feb. 4, 2003

Feb. 4, 2003

Patches item #667026, was opened at 2003-01-13 07:42 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=667026&group_i… Category: Pipermail Group: Mailman 2.1 Status: Open Resolution: None Priority: 5 Submitted By: Tokio Kikuchi (tkikuchi) Assigned to: Nobody/Anonymous (nobody) Summary: HyperArch.py unicode substitution Initial Comment: bin/arch and HyperArch.py produced error when i18n characters are present in the message body. I suspect that the text is in unicode string. This patch tests if text is unicode and then make the substitute string unicode. File "/usr/home/mailman/mailman-21/Mailman/Archiver/pipermail.py", line 592, i n add_article temp = self.format_article(article) File "/usr/home/mailman/mailman-21/Mailman/Archiver/HyperArch.py", line 1192, in format_article self.__processbody_URLquote(lines) File "/usr/home/mailman/mailman-21/Mailman/Archiver/HyperArch.py", line 1131, in __processbody_URLquote text = re.sub('@', _(' at '), text) File "/usr/local/lib/python2.1/sre.py", line 63, in sub return _compile(pattern, 0).sub(repl, string, count) File "/usr/local/lib/python2.1/sre.py", line 164, in _sub return _subn(pattern, template, string, count)[0] File "/usr/local/lib/python2.1/sre.py", line 185, in _subn append(filter(m)) File "/usr/local/lib/python2.1/sre.py", line 173, in filter return sre_parse.expand_template(template, match) File "/usr/local/lib/python2.1/sre_parse.py", line 732, in expand_template return string.join(literals, sep) File "/usr/local/lib/python2.1/string.py", line 128, in join return sep.join(words) UnicodeError: ASCII decoding error: ordinal not in range(128) ---------------------------------------------------------------------- >Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-02-04 06:45 Message: Logged In: YES user_id=67709 Update this patch for small bug. Charset defaults to 'us-ascii'. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=667026&group_i…

1 0

[ mailman-Patches-674553 ] patch for options.py cross site scripting bug
by SourceForge.net Feb. 4, 2003

Feb. 4, 2003

Patches item #674553, was opened at 2003-01-25 12:42 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i… Category: Web UI Group: Mailman 2.1 >Status: Closed Resolution: None Priority: 8 Submitted By: Tokio Kikuchi (tkikuchi) Assigned to: Nobody/Anonymous (nobody) Summary: patch for options.py cross site scripting bug Initial Comment: fix this issue Example: ----------------- This is a simple example for version 2.1: 1) With mailman options the email variable is vulnerable to cross-site scripting. You can recognise the vulnerabilities with this type of URL: https://www.yourserver.com:443/mailman/options/yourlist? language=en&email=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> and that prove that any (malicious) script code is possible on web interface part of Mailman. 2) The default error page mailman generates does not adequately filter its input making it susceptible to cross-site scripting. https://www.yourserver.com:443//mailman/options/yourlist? language=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> ---------------------------------------------------------------------- >Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-02-04 06:20 Message: Logged In: YES user_id=67709 I think this can be closed now. ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-01-26 21:33 Message: Logged In: YES user_id=12800 Very good. Here's the patch I intend to commit and advertise as a fix for the cross-site scripting bug. This additionally fixes a crash when the language cgi variable is deliberately given a bogus value. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-26 04:17 Message: Logged In: YES user_id=67709 Please review my second patch. It use Utils.ValidateEmail() and return immediately if the input string is insecure. Also, websafe(user) again to secure the final output. Note that the Exapmle is circulated in bugtraq ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-01-25 15:24 Message: Logged In: YES user_id=12800 Please try this more comprehensive fix. If it looks good, I will issue a security patch later today. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=674553&group_i…

1 0

[ mailman-Patches-670167 ] fix i18n attachment description in archive
by SourceForge.net Feb. 4, 2003

Feb. 4, 2003

Patches item #670167, was opened at 2003-01-18 05:58 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=670167&group_i… Category: Pipermail Group: Mailman 2.1 Status: Open Resolution: Accepted Priority: 5 Submitted By: Tokio Kikuchi (tkikuchi) Assigned to: Nobody/Anonymous (nobody) Summary: fix i18n attachment description in archive Initial Comment: Bug-ID 669081 (Major attachment handling bug!) is caused inaccurate handling of charset in Scrubber.py. This is caused by misuse of email functions (or by bug in email package). In Scrubber.py, attempt is made to get message charset by part.get_charset() but it returns only None, as far as I experimented. In this patch, message charset is extracted from regular expression pattern in content-type header. This also set the charset of internally crafted message part. ---------------------------------------------------------------------- >Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-02-04 06:08 Message: Logged In: YES user_id=67709 I made a new patch to fix embedded multipart messages are stripped bug. this patch is for CVS. see http://mail.python.org/pipermail/mailman-users/2003-February/026071.html ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-01-20 05:13 Message: Logged In: YES user_id=12800 Reopening so this issue doesn't get lost. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-20 04:03 Message: Logged In: YES user_id=67709 We, Japanese, need additional process of stringify and regenerate message instance.. Internal message is in 'euc-jp' but return value of get_content_charset() becomes 'iso-2022-jp' even though the get_payload() returns euc-jp text. The message and part body is converted to iso-2022-jp when it is output to SMTP (or whatever accepts in string format). ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-01-20 02:18 Message: Logged In: YES user_id=12800 Accepted, with changes. ---------------------------------------------------------------------- Comment By: Tokio Kikuchi (tkikuchi) Date: 2003-01-19 00:52 Message: Logged In: YES user_id=67709 Update of patch. Please backout the first one if you have already applied. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=670167&group_i…

1 0