Mailman 3 September 2015 - Mailman-coders

[Bug 1491187] [NEW] mailmanctl check_privs should check effective uid, not real uid
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: Situations can arise where mailmanctl is running with an effective uid of 'mailman' and a real uid of 'root'. Such a situation is if logrotate does 'su mailman mailman' to rotate mailman's logs and then invokes 'mailmanctl reopen' in a postrotate script. In this case, mailmanctl gets its real uid which is 'root' and then tries to do os.setgroups, but the effective uid is 'mailman' which doesn't have permission to set groups. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1491187 Title: mailmanctl check_privs should check effective uid, not real uid To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1491187/+subscriptions

2 2

[Bug 1496632] [NEW] visiting the user options page with crafted post data or query fragments can produce "we hit a bug"
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: If one visits the user options page with a hand crafted query fragment or post data containing for example language=en&email=&email=test&password=&login-remind=Remind the fact that the options CGI sees 'email' as a list rather than a string throws an exception in Utils.websafe(). We will defend against this by testing in Utils.websafe() for a sequence argument and if so, returning only websafe of the first element. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1496632 Title: visiting the user options page with crafted post data or query fragments can produce "we hit a bug" To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1496632/+subscriptions

2 3

[Bug 1496620] [NEW] Mailman sometimes fails to remove redundant Re: when prefixing subject.
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: When processing the subject_prefix for list mail, Mailman attempts to remove all the redundant Re: bits in the Subject. Under some circumstances this can fail resulting in messages being delivered to the list with subjects like, e.g., Subject: [prefix] Re: Re: Re: Re: some message subject Of course, it was a user's MUA that created a subject with multiple Re: to begin with, but it may not have been so blatant before prefixing manipulations. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1496620 Title: Mailman sometimes fails to remove redundant Re: when prefixing subject. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1496620/+subscriptions

2 3

[Bug 1486263] [NEW] cron/gate_news doesn't catch EOFError on opening the newsgroup.
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: The Summary says it all. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1486263 Title: cron/gate_news doesn't catch EOFError on opening the newsgroup. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1486263/+subscriptions

2 3

[Bug 1476298] [NEW] User-options available for digest despite this option unavailable
by Mla 03 Feb '16

03 Feb '16

Public bug reported: When message digests are disabled by the administrator ("Edit_digestable") the user option page for turning digests on is still available. It should be removed when it's no longer available to avoid any confusion. ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1476298 Title: User-options available for digest despite this option unavailable To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1476298/+subscriptions

3 4

[Bug 1450826] [NEW] DMARC entries in the vette log don't include the list name.
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: The list name should be included along with the result of the DMARC lookup in the vette log entry from checking dmarc_moderation_action. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1450826 Title: DMARC entries in the vette log don't include the list name. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1450826/+subscriptions

2 3

[Bug 1482940] [NEW] A bounced probe can throw AttributeError
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: If the site has set 'VERP_PROBES = Yes', when a user's bounce score reaches threshold, that user's score is reset and a probe message with a confirmation token is sent to the user. If the probe bounces, the user's delivery is disabled by bounce. The issue is if the probe bounces, but for some reason, the bounce is not returned within bounce_info_stale_after days, the user's bounce_info can be deleted before the probe bounce is returned. Then the probe processing gets the user's bounce_info which is None and attempts to disable the member's delivery with bounce_info = None, and disableBouncingMember attempts to get the cookie attribute from None resulting in AttributeError: 'NoneType' object has no attribute 'cookie' ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1482940 Title: A bounced probe can throw AttributeError To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1482940/+subscriptions

2 3

[Bug 1459236] [NEW] Mailman/Postfix integration doesn't generate virtual maps for all site list domains.
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: An address of the form mailman(a)example.com is exposed on the web admin and listinfo overview pages where 'mailman' is the name of the site list and 'example.com' is the 'email domain' associated with the host in the URL of the page. This means that the 'mailman' address should work in all Postfix virtual domains and Mailman/MTA/Postfix.py should generate virtual mappings for that. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1459236 Title: Mailman/Postfix integration doesn't generate virtual maps for all site list domains. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1459236/+subscriptions

2 3

[Bug 1447445] [NEW] Web subscribe can fail in cases of load balancers or other devices.
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: The fix for (LP: #1082746) implemented a SUBSCRIBE_FORM_SECRET feature. If this is enabled by a site, the subscribe form on the listinfo page contains a hidden input field which includes a hash of various data including the IP address that the GET of the listinfo came from. Upon submission of the form, this hash is recomputed using the IP address that the POST of the form came from, and if the hashes don't match, the subscribe fails. This can cause legitimate subscribes to fail if the user is connected via a load balancer or other device which submits http(s) requests using a possibly different IP for each request. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1447445 Title: Web subscribe can fail in cases of load balancers or other devices. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1447445/+subscriptions

2 3

[Bug 1444673] [NEW] Anonymous lists can expose the sending domain.
by Mark Sapiro 03 Feb '16

03 Feb '16

Public bug reported: Headers DKIM-Signature:, DomainKey-Signature: and Authentication- Results: are not removed by default from mail to an anonymous list. These headers can reveal the sending domain. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1444673 Title: Anonymous lists can expose the sending domain. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1444673/+subscriptions

2 4