Mailman 3 March 2007 - Mailman-coders

[ mailman-Bugs-645906 ] User supplied HTML with % kills index.ht
by SourceForge.net March 15, 2007

March 15, 2007

Bugs item #645906, was opened at 2002-11-30 01:52 Message generated for change (Comment added) made by zuse You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=645906&group_i… Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Pipermail Group: 2.1 beta Status: Closed Resolution: None Priority: 5 Private: No Submitted By: Joe R. Doupnik (jdoupnik) Assigned to: Nobody/Anonymous (nobody) Summary: User supplied HTML with % kills index.ht Initial Comment: Mailman 2.1b5. Edit archtoc.html or listinfo.html, include table with phrase width=100% and find that the list's archive overall index.html page is unformed (present but the various MM items are left as bare %(foobar)s style). After wasting a whole day on this the problem boils down to that percent sign in user-supplied HTML. It kills the high level index.html file. We don''t know about this until a full list archive operation is performed, because at the end the code creates the new index.html from the template files. Ugh. Likely some parser deep in the system is overreacting to the percent symbol. Needs fixing. ---------------------------------------------------------------------- Comment By: Holger Jeromin (zuse) Date: 2007-03-15 13:46 Message: Logged In: YES user_id=254889 Originator: NO The Problem might be solved for HTML pages, but it is not solved for text! When editing subscribeack.txt it is not possible to write something like "We can reach 20% of our users", because this leads to %(foobar)s stuff. In pure text there is no workaround like this width="100%" possible... My mailman provider uses version 2.1.9 ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2002-12-08 16:12 Message: Logged In: YES user_id=12800 archtoc.html and listinfo.html are templates (as implied by their being in the templates/xx directory :) which means Python substitutions are performed on the text. Python substitutions treat % as a special character so to get a literal % in the text you need to use %% E.g. change that to "width=100%%" and you'll be fine. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=645906&group_i…

1 0

[ mailman-Bugs-1679716 ] Mass subscription welcome message behavior is unclear
by SourceForge.net March 13, 2007

March 13, 2007

Bugs item #1679716, was opened at 2007-03-13 04:35 Message generated for change (Comment added) made by msapiro You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=1679716&group_… Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Web/CGI Group: 2.1 (stable) >Status: Closed >Resolution: Fixed Priority: 5 Private: No Submitted By: James Davis (pishmishy) Assigned to: Nobody/Anonymous (nobody) Summary: Mass subscription welcome message behavior is unclear Initial Comment: It's not clear that when you mass subscribe people to a list that the 'Send welcome messages to new subscribees?' option is affected by the send_welcome_msg. Please could a note or link to further help be added to the 'Send welcome messages to new subscribees?' option in Mass Subscription be added to make this clear to users. James ---------------------------------------------------------------------- >Comment By: Mark Sapiro (msapiro) Date: 2007-03-13 11:03 Message: Logged In: YES user_id=1123998 Originator: NO I recall now. This was fixed in Mailman 2.1.9. ---------------------------------------------------------------------- Comment By: James Davis (pishmishy) Date: 2007-03-13 10:52 Message: Logged In: YES user_id=977808 Originator: YES It's not clear (from the mass subscribe page) that when you mass subscribe people to a list that the 'Send welcome messages to new subscribees?' option does not work when send_welcome_msg is turned off. ---------------------------------------------------------------------- Comment By: Mark Sapiro (msapiro) Date: 2007-03-13 10:47 Message: Logged In: YES user_id=1123998 Originator: NO In what way is it affected? It shouldn't be. I seem to recall a bug in this area at one time, but I can't offhand find what it was or when it was fixed. What Mailman version are you using? ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=1679716&group_…

1 0

[ mailman-Bugs-1679716 ] Mass subscription welcome message behavior is unclear
by SourceForge.net March 13, 2007

March 13, 2007

Bugs item #1679716, was opened at 2007-03-13 11:35 Message generated for change (Comment added) made by pishmishy You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=1679716&group_… Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Web/CGI Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Private: No Submitted By: James Davis (pishmishy) Assigned to: Nobody/Anonymous (nobody) Summary: Mass subscription welcome message behavior is unclear Initial Comment: It's not clear that when you mass subscribe people to a list that the 'Send welcome messages to new subscribees?' option is affected by the send_welcome_msg. Please could a note or link to further help be added to the 'Send welcome messages to new subscribees?' option in Mass Subscription be added to make this clear to users. James ---------------------------------------------------------------------- >Comment By: James Davis (pishmishy) Date: 2007-03-13 17:52 Message: Logged In: YES user_id=977808 Originator: YES It's not clear (from the mass subscribe page) that when you mass subscribe people to a list that the 'Send welcome messages to new subscribees?' option does not work when send_welcome_msg is turned off. ---------------------------------------------------------------------- Comment By: Mark Sapiro (msapiro) Date: 2007-03-13 17:47 Message: Logged In: YES user_id=1123998 Originator: NO In what way is it affected? It shouldn't be. I seem to recall a bug in this area at one time, but I can't offhand find what it was or when it was fixed. What Mailman version are you using? ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=1679716&group_…

1 0

[ mailman-Bugs-1679716 ] Mass subscription welcome message behavior is unclear
by SourceForge.net March 13, 2007

March 13, 2007

Bugs item #1679716, was opened at 2007-03-13 04:35 Message generated for change (Comment added) made by msapiro You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=1679716&group_… Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Web/CGI Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Private: No Submitted By: James Davis (pishmishy) Assigned to: Nobody/Anonymous (nobody) Summary: Mass subscription welcome message behavior is unclear Initial Comment: It's not clear that when you mass subscribe people to a list that the 'Send welcome messages to new subscribees?' option is affected by the send_welcome_msg. Please could a note or link to further help be added to the 'Send welcome messages to new subscribees?' option in Mass Subscription be added to make this clear to users. James ---------------------------------------------------------------------- >Comment By: Mark Sapiro (msapiro) Date: 2007-03-13 10:47 Message: Logged In: YES user_id=1123998 Originator: NO In what way is it affected? It shouldn't be. I seem to recall a bug in this area at one time, but I can't offhand find what it was or when it was fixed. What Mailman version are you using? ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=1679716&group_…

1 0

[ mailman-Bugs-1679716 ] Mass subscription welcome message behavior is unclear
by SourceForge.net March 13, 2007

March 13, 2007

Bugs item #1679716, was opened at 2007-03-13 11:35 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=1679716&group_… Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Web/CGI Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Private: No Submitted By: James Davis (pishmishy) Assigned to: Nobody/Anonymous (nobody) Summary: Mass subscription welcome message behavior is unclear Initial Comment: It's not clear that when you mass subscribe people to a list that the 'Send welcome messages to new subscribees?' option is affected by the send_welcome_msg. Please could a note or link to further help be added to the 'Send welcome messages to new subscribees?' option in Mass Subscription be added to make this clear to users. James ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=1679716&group_…

1 0

[ mailman-Patches-943827 ] true virtual hosting patch for 2.1
by SourceForge.net March 1, 2007

March 1, 2007

Patches item #943827, was opened at 2004-04-29 02:57 Message generated for change (Comment added) made by tbble You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=943827&group_i… Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: list administration Group: Mailman 2.1 Status: Open Resolution: None Priority: 5 Private: No Submitted By: The Anarcat (anarcat) Assigned to: Nobody/Anonymous (nobody) Summary: true virtual hosting patch for 2.1 Initial Comment: [copy of the mail sent to -developpers@] We developped a reliable solution for running lists with the same name on different domains on the same Mailman installation. I implemented that on top of the Mailman 2.1.1-5.1 Debian stable package. All that is needed is to patch 2 files (bin/newlist, Mailman/MailList.py) in the mailman install, and here is the patch: http://bugs.koumbit.net/file_download.php?file_id=3&type=bug There's only one caveat right now: Mailman/Cgi/create.py might need to get patched too, but I haven't got around looking at it yet, and it "just works", for now. I don't know what's the current status of virtual hosting support on Mailman, but this patch is a simple hack that should bring joy in the homes of all Mailman admins around the world. :) I got my inspiration and part of the code from: http://mithrandr.moria.org/blog/139.html All it does is to add the domain to the internal_name() of a list. The real_name is kept as is, and the getListAddress() does the Right Thing. This makes Mailman generate aliases like: list-example.com: "|/var/lib/mailman/mail/mailman post list-example.com" Care will have to be taken on the MTA side to map those list-example.com to list(a)example.com. We are using alternc.org to manage our server, so we are using LDAP, so everything went pretty smoothly. :) But I guess it will require some magic on the Postfix side or something... Cheers, A. PS: for those wanting to see more, you can come to our Wiki: http://koumbit.net/wiki/VirtualMailman You'll probably have a little trouble finding your way if you don't read french though. :) Babelfish might help, haven't tried. ---------------------------------------------------------------------- Comment By: Paul Hampson (tbble) Date: 2007-03-02 09:57 Message: Logged In: YES user_id=87909 Originator: NO Grab mailman-vh-2.1.7.patch from http://nix.lauft.net/mailman/, it applies fine to 2.1.9. ---------------------------------------------------------------------- Comment By: GILLIG (fgillig) Date: 2007-03-01 22:18 Message: Logged In: YES user_id=1463624 Originator: NO I search this patch for mailman 2.1.9 ... (fc5). Anyone can help ? ---------------------------------------------------------------------- Comment By: Pedro Algarvio (s0undt3ch) Date: 2006-10-13 11:05 Message: Logged In: YES user_id=927681 +1 for this patch ---------------------------------------------------------------------- Comment By: Paul Hampson (tbble) Date: 2006-04-22 21:48 Message: Logged In: YES user_id=87909 Crud, wrapping... The changes are all on one line. ---------------------------------------------------------------------- Comment By: Paul Hampson (tbble) Date: 2006-04-22 21:47 Message: Logged In: YES user_id=87909 minfrin, create it as listname-domain or try this patch: diff -urNad mailman-2.1.5/Mailman/Cgi/create.py /tmp/dpep.bPHYjm/mailman-2.1.5/Mailman/Cgi/create.py --- mailman-2.1.5/Mailman/Cgi/create.py 2006-04-22 20:58:10.324872941 +1000 +++ /tmp/dpep.bPHYjm/mailman-2.1.5/Mailman/Cgi/create.py 2006-04-22 21:13:31.596133649 +1000 @@ -184,7 +184,7 @@ oldmask = os.umask(002) try: try: - mlist.Create(listname, owner, pw, langs, emailhost) + mlist.Create("%s@%s" % (listname,hostname), owner, pw, langs, emailhost) finally: os.umask(oldmask) except Errors.EmailAddressError, s: Which will add the '@domain' to the listname before passing it to mlist.Create, which the patch changes to deal with '@' the way we want. ---------------------------------------------------------------------- Comment By: Graham Leggett (minfrin) Date: 2006-03-18 07:39 Message: Logged In: YES user_id=129704 I tried the patch at http://al.blog.free.fr/mailman/mailman-vh-2.1.5.patch and it applied cleanly to mailman as provided by RHEL4. I tried to create a list called "list(a)domain1.com", but this failed with the error "Error: List name must not include "@"". Does this patch have any sort of instructions anywhere? ---------------------------------------------------------------------- Comment By: Arnaud Lavrard (arnaudlavrard) Date: 2005-07-20 23:52 Message: Logged In: YES user_id=1315788 I ported the patch to mailman 2.1.5 : http://al.blog.free.fr/mailman/mailman-vh-2.1.5.patch ---------------------------------------------------------------------- Comment By: The Anarcat (anarcat) Date: 2005-03-17 07:40 Message: Logged In: YES user_id=246797 I have ported the patch to 2.1.4, no news on 2.1.5 yet. I have also put the patch in a seperate CVS server. Fetch all the goods there: http://cvs.koumbit.net/cgi-bin/cvsweb/koumbit-maint/patches/mailman-true-vi… http://cvs.koumbit.net/cgi-bin/cvsweb/koumbit-maint/patches/mailman-true-vi… I've also updated the 2.1.1 patch to fix the list-id, so I delete the attachment, fetch the patch straight from our CVS for the latest fixes. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=943827&group_i…

1 0

[ mailman-Bugs-209499 ] Security hole: passwords mailed in clear
by SourceForge.net March 1, 2007

March 1, 2007

Bugs item #209499, was opened at 2000-07-13 23:26 Message generated for change (Comment added) made by jimpop You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=209499&group_i… Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: None Group: None Status: Closed Resolution: Wont Fix Priority: 5 Private: No Submitted By: L. Peter Deutsch (lpd) Assigned to: Nobody/Anonymous (nobody) Summary: Security hole: passwords mailed in clear Initial Comment: I recently signed up on a SourceForge mailing list. The software mailed a confirmation notice to my mailbox, with the password in clear in the message. This is a basic security hole. I reported this as a SourceForge bug, and they said "Contact the gnu-mailman project." In my opinion, passwords should never be mailed in clear, especially not to the e-mail address with which they are associated. Please consider changing this. ---------------------------------------------------------------------- Comment By: Jim Popovitch (jimpop) Date: 2007-03-01 14:03 Message: Logged In: YES user_id=3142 Originator: NO Did you read the text on the SF mailinglist subscription page? It goes like this: "You may enter a privacy password below. This provides only mild security, but should prevent others from messing with your subscription. Do not use a valuable password as it will occasionally be emailed back to you in cleartext." So, it's not a "bug", it's a "user following the instructions" issue. ;-) -Jim P. ---------------------------------------------------------------------- Comment By: Mark Sapiro (msapiro) Date: 2007-03-01 13:44 Message: Logged In: YES user_id=1123998 Originator: NO This will finally be fixed in Mailman 2.2. ---------------------------------------------------------------------- Comment By: Benjamin Bl�mchen (bburkhart) Date: 2006-11-26 14:23 Message: Logged In: YES user_id=597317 Originator: NO Hello everyone, to me, mailing passwords in clear text is never acceptable. In some setups. one never knows who else is looking at the mail. The lack of biological RAM in layer 8 is also not an excuse. There are better ways of dealing with the password remembering problem. Anyway, mailman is now out of question and also uninstalled from my machine. Cheers Benjamin ---------------------------------------------------------------------- Comment By: L. Peter Deutsch (lpd) Date: 2000-07-24 02:31 Message: It's OK with me if you want to close this report; in my opinion, the Resolution should say "Wont fix". ---------------------------------------------------------------------- Comment By: Thomas Wouters (twouters) Date: 2000-07-17 05:43 Message: The Mailman password is in no way a secure password. Mailman is intended for a wide variety of users, most of which are unable to remember even the simplest password ;) The Mailman password is not used as an authentication method, but more as a *confirmation* method. You'll get a password reminder every month or so (if the list admin and site admin enabled that) and the only thing you use the password for are for unsubscribing, changing your options and viewing the private archive (if any.) In future versions of Mailman it might be possible to use external passwords for mailinglist subscribers, but currently the infrastructure for that is missing. It's on the TODO list, in any case :) ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=209499&group_i…

1 0

[ mailman-Bugs-209499 ] Security hole: passwords mailed in clear
by SourceForge.net March 1, 2007

March 1, 2007

Bugs item #209499, was opened at 2000-07-13 20:26 Message generated for change (Comment added) made by msapiro You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=209499&group_i… Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: None Group: None Status: Closed Resolution: Wont Fix Priority: 5 Private: No Submitted By: L. Peter Deutsch (lpd) Assigned to: Nobody/Anonymous (nobody) Summary: Security hole: passwords mailed in clear Initial Comment: I recently signed up on a SourceForge mailing list. The software mailed a confirmation notice to my mailbox, with the password in clear in the message. This is a basic security hole. I reported this as a SourceForge bug, and they said "Contact the gnu-mailman project." In my opinion, passwords should never be mailed in clear, especially not to the e-mail address with which they are associated. Please consider changing this. ---------------------------------------------------------------------- >Comment By: Mark Sapiro (msapiro) Date: 2007-03-01 10:44 Message: Logged In: YES user_id=1123998 Originator: NO This will finally be fixed in Mailman 2.2. ---------------------------------------------------------------------- Comment By: Benjamin Bl�mchen (bburkhart) Date: 2006-11-26 11:23 Message: Logged In: YES user_id=597317 Originator: NO Hello everyone, to me, mailing passwords in clear text is never acceptable. In some setups. one never knows who else is looking at the mail. The lack of biological RAM in layer 8 is also not an excuse. There are better ways of dealing with the password remembering problem. Anyway, mailman is now out of question and also uninstalled from my machine. Cheers Benjamin ---------------------------------------------------------------------- Comment By: L. Peter Deutsch (lpd) Date: 2000-07-23 23:31 Message: It's OK with me if you want to close this report; in my opinion, the Resolution should say "Wont fix". ---------------------------------------------------------------------- Comment By: Thomas Wouters (twouters) Date: 2000-07-17 02:43 Message: The Mailman password is in no way a secure password. Mailman is intended for a wide variety of users, most of which are unable to remember even the simplest password ;) The Mailman password is not used as an authentication method, but more as a *confirmation* method. You'll get a password reminder every month or so (if the list admin and site admin enabled that) and the only thing you use the password for are for unsubscribing, changing your options and viewing the private archive (if any.) In future versions of Mailman it might be possible to use external passwords for mailinglist subscribers, but currently the infrastructure for that is missing. It's on the TODO list, in any case :) ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=209499&group_i…

1 0

[ mailman-Bugs-1671784 ] Storing of passwords
by SourceForge.net March 1, 2007

March 1, 2007

Bugs item #1671784, was opened at 2007-03-01 07:38 Message generated for change (Comment added) made by msapiro You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=1671784&group_… Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: security/privacy Group: None Status: Open >Resolution: Accepted Priority: 5 Private: No Submitted By: Lars Monsees (larsen255) Assigned to: Nobody/Anonymous (nobody) Summary: Storing of passwords Initial Comment: Hi, I don´t have mailman installed, I just use mailing lists and really like mailman. But as some mailing lists send out reminder mails the passwords obviously are not stored encrypted. IMHO passwords shouldn´t be stored in cleartext anywhere. Please fix this. Lars ---------------------------------------------------------------------- >Comment By: Mark Sapiro (msapiro) Date: 2007-03-01 10:42 Message: Logged In: YES user_id=1123998 Originator: NO This is a long standing issue (See https://sourceforge.net/tracker/index.php?func=detail&aid=209499&group_id=1…>) and will finally be fixed in Mailman 2.2. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=1671784&group_…

1 0

[ mailman-Bugs-1671925 ] difficult to use radio and check boxes in admin interface
by SourceForge.net March 1, 2007

March 1, 2007

Bugs item #1671925, was opened at 2007-03-01 20:32 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=1671925&group_… Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Web/CGI Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Private: No Submitted By: Paul Pogonyshev (doublep) Assigned to: Nobody/Anonymous (nobody) Summary: difficult to use radio and check boxes in admin interface Initial Comment: Currently, in admin interface you have to click on right the radio/check symbol (i.e. on the circle or square), while clicking on text label gives nothing. This is very simple to change with standard HTML code: instead of <input type="radio"... /> Some text label, write <label><input type="radio"... /> Some text label</label>. This will not change the appearance, but will make using admin interface easier. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=1671925&group_…

1 0