Mailman 3 October 2015 - Mailman-coders

[Bug 1491187] [NEW] mailmanctl check_privs should check effective uid, not real uid
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: Situations can arise where mailmanctl is running with an effective uid of 'mailman' and a real uid of 'root'. Such a situation is if logrotate does 'su mailman mailman' to rotate mailman's logs and then invokes 'mailmanctl reopen' in a postrotate script. In this case, mailmanctl gets its real uid which is 'root' and then tries to do os.setgroups, but the effective uid is 'mailman' which doesn't have permission to set groups. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1491187 Title: mailmanctl check_privs should check effective uid, not real uid To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1491187/+subscriptions

2 2

[Bug 1507241] [NEW] Bad regexps in *_these_nonmembers, subscribe_auto_approval and ban_list should be logged
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: The list attributes *_these_nonmembers, subscribe_auto_approval and ban_list accept lists of email addresses and regexps (beginning with '^') matching email addresses. Currently, if the regexp is invalid, it is silently ignored. The GUI does not accept invalid regexp entries, but there are other ways they could be introduced. An invalid regexp should at least be logged. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1507241 Title: Bad regexps in *_these_nonmembers, subscribe_auto_approval and ban_list should be logged To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1507241/+subscriptions

2 3

[Bug 1505878] [NEW] Mailman can cause extraneous tabs to be displayed in Subject: headers
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: The genesis of this problem is that the header folding and unfolding algorithms specified in RFC822 could introduce extraneous white space in headers which have been folded and unfolded. RFC822 says when folding, "a CRLF immediately followed by AT LEAST one LWSP-char" may be inserted where linear-white-space is allowed, and unfolding "is accomplished by regarding CRLF immediately followed by a LWSP-char as equivalent to the LWSP-char." Thus, one can insert "AT LEAST one LWSP-char" when folding but not remove any when unfolding. The later RFCs 2822 and 5322 clarify the situation by specifying folding as inserting CRLF preceding existing white-space and unfolding as removing any CRLF which is immediately followed by white-space. Various MUAs and supporting libraries including the Python 2 email library used by Mailman still follow the RFC822 method of folding and can fold by inserting CRLF followed by TAB and the TAB then doesn't get removed in unfolding. There is actually control in the Python email library to use TAB or SPACE, and Mailman attempts to determine what character has been used and uses that, but in the case where a Subject: header is not folded but becomes long enough to be folded because of the insertion of a subject_prefix for example, Mailman defaults to a TAB which doesn't get removed in unfolding. The situation will never be perfect as long as there are MUAs that fold per RFC822 and MUAs that attempt to compensate by removing some white- space following CRLF, but it will be improved somewhat by defaulting to folding with SPACE rather than TAB. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1505878 Title: Mailman can cause extraneous tabs to be displayed in Subject: headers To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1505878/+subscriptions

2 3

[Bug 1503422] [NEW] Mailman's provided init.d script may not work with systemctl.
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: The provided misc/mailman.in script contains the line # pidfile: @prefix@/data/master-qrunner.pid While this is a comment, it may be used by chkconfig, etc. and it's wrong. It should be # pidfile: @VAR_PREFIX@/data/master-qrunner.pid ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: Fix Committed -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1503422 Title: Mailman's provided init.d script may not work with systemctl. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1503422/+subscriptions

2 3

[Bug 1496632] [NEW] visiting the user options page with crafted post data or query fragments can produce "we hit a bug"
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: If one visits the user options page with a hand crafted query fragment or post data containing for example language=en&email=&email=test&password=&login-remind=Remind the fact that the options CGI sees 'email' as a list rather than a string throws an exception in Utils.websafe(). We will defend against this by testing in Utils.websafe() for a sequence argument and if so, returning only websafe of the first element. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1496632 Title: visiting the user options page with crafted post data or query fragments can produce "we hit a bug" To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1496632/+subscriptions

2 3

[Bug 1496620] [NEW] Mailman sometimes fails to remove redundant Re: when prefixing subject.
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: When processing the subject_prefix for list mail, Mailman attempts to remove all the redundant Re: bits in the Subject. Under some circumstances this can fail resulting in messages being delivered to the list with subjects like, e.g., Subject: [prefix] Re: Re: Re: Re: some message subject Of course, it was a user's MUA that created a subject with multiple Re: to begin with, but it may not have been so blatant before prefixing manipulations. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1496620 Title: Mailman sometimes fails to remove redundant Re: when prefixing subject. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1496620/+subscriptions

2 3

[Bug 1486263] [NEW] cron/gate_news doesn't catch EOFError on opening the newsgroup.
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: The Summary says it all. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1486263 Title: cron/gate_news doesn't catch EOFError on opening the newsgroup. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1486263/+subscriptions

2 3

[Bug 1476298] [NEW] User-options available for digest despite this option unavailable
by Mla 03 Feb '16

03 Feb '16

Public bug reported: When message digests are disabled by the administrator ("Edit_digestable") the user option page for turning digests on is still available. It should be removed when it's no longer available to avoid any confusion. ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1476298 Title: User-options available for digest despite this option unavailable To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1476298/+subscriptions

3 4

[Bug 1450826] [NEW] DMARC entries in the vette log don't include the list name.
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: The list name should be included along with the result of the DMARC lookup in the vette log entry from checking dmarc_moderation_action. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1450826 Title: DMARC entries in the vette log don't include the list name. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1450826/+subscriptions

2 3

[Bug 1482940] [NEW] A bounced probe can throw AttributeError
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: If the site has set 'VERP_PROBES = Yes', when a user's bounce score reaches threshold, that user's score is reset and a probe message with a confirmation token is sent to the user. If the probe bounces, the user's delivery is disabled by bounce. The issue is if the probe bounces, but for some reason, the bounce is not returned within bounce_info_stale_after days, the user's bounce_info can be deleted before the probe bounce is returned. Then the probe processing gets the user's bounce_info which is None and attempts to disable the member's delivery with bounce_info = None, and disableBouncingMember attempts to get the cookie attribute from None resulting in AttributeError: 'NoneType' object has no attribute 'cookie' ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1482940 Title: A bounced probe can throw AttributeError To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1482940/+subscriptions

2 3