Mailman 3 January 2014 - Mailman-coders

[Bug 1269959] [NEW] check_perms does not change UID
by Joshua Brandt 17 Jan '14

17 Jan '14

*** This bug is a security vulnerability *** Private security bug reported: When running check_perms, the script fixes the GID for everything, however it does not fix the UID, which could allow users to still have access to those files. Granted, it is a remote possibility, however I feel it is significant enough to be fixed. I have included a patch in this report that will fix it as well (as I cannot get Bazaar to play nice with me). If you have any questions please feel free to ask them, I can be contacted here, or at joshua.brandt(a)cpanel.net as well. Cheers, Joshua Brandt cPanel Quality Assurance Analyst ** Affects: mailman Importance: Undecided Status: New ** Patch added: "This is a patch that will fix the script, since I can't seem to get Bazaar to play nice and get a good branch for me" https://bugs.launchpad.net/bugs/1269959/+attachment/3950418/+files/check_pe… -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1269959 Title: check_perms does not change UID To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1269959/+subscriptions

2 2

[Merge] lp:~flo-fuchs/postorius/postorius_persona into lp:postorius
by Florian Fuchs 14 Jan '14

14 Jan '14

Florian Fuchs has proposed merging lp:~flo-fuchs/postorius/postorius_persona into lp:postorius. Requested reviews: Terri (terriko) For more details, see: https://code.launchpad.net/~flo-fuchs/postorius/postorius_persona/+merge/20… Hi, this change is mostly a switch from the django_social_auth library to django_browserid. It also includes some additions to the Persona audience verification process: Usually, django_browserid uses the SITE_URL setting to check if the domain of the site matches the one provided with the Persona assertion (to prevent audience spoofing). In most cases, SITE_URL might probably only contain one domain. There are however possible scenarios running Postorius/Mailman under multiple domains (say, an Apache catch-all configuration). In those cases, adding new domains to the SITE_URL setting is a redundant task, because those domains also have to be added to the Mailman DB via Postorius (or REST). This change includes a ``get_audience`` function which includes domains from the Mailman DB when verifying the audience in the Persona assertion. The function is disabled by default, but can be activated in settings.py. The code is tested (although I haven't run coverage...). But it sure won't hurt having someone else having a look at it. Thanks! Florian -- https://code.launchpad.net/~flo-fuchs/postorius/postorius_persona/+merge/20… Your team Mailman Coders is subscribed to branch lp:postorius.

1 0

[Bug 265627] Re: Text and link colors in web interface
by Michal Suchanek 02 Jan '14

02 Jan '14

this page has still broken styles: https://mail.python.org/mailman/listinfo/mailman-users -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/265627 Title: Text and link colors in web interface To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/265627/+subscriptions

1 0