Mailman 3 May 2017 - Mailman-coders

[Bug 1602608] [NEW] mailman crash for subscription in webinterface
by Sebastian Wagner 27 Oct '17

27 Oct '17

Public bug reported: A Traceback from mailman's logs for a subscription. The bug can be triggered with the following post-data: language='' Jul 11 20:29:34 2016 admin(29209): @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ admin(29209): [----- Mailman Version: 2.1.16 -----] admin(29209): [----- Traceback ------] admin(29209): Traceback (most recent call last): admin(29209): File "/var/lib/mailman/scripts/driver", line 117, in run_main admin(29209): main() admin(29209): File "/var/lib/mailman/Mailman/Cgi/subscribe.py", line 73, in main admin(29209): language = cgidata.getvalue('language') admin(29209): File "/usr/lib/python2.7/cgi.py", line 548, in getvalue admin(29209): if key in self: admin(29209): File "/usr/lib/python2.7/cgi.py", line 594, in __contains__ admin(29209): raise TypeError, "not indexable" admin(29209): TypeError: not indexable admin(29209): [----- Python Information -----] admin(29209): sys.version = 2.7.6 (default, Jun 22 2015, 17:58:13) [GCC 4.8.2] admin(29209): sys.executable = /usr/bin/python admin(29209): sys.prefix = /usr admin(29209): sys.exec_prefix = /usr admin(29209): sys.path = ['/var/lib/mailman/pythonlib', '/var/lib/mailman', '/usr/lib/mailman/scripts', '/var/lib/mailman', '/usr/lib/python2.7/', '/usr/lib/python2.7/plat-x86_64-linux-gnu', '/usr/lib/python2.7/lib-tk', '/usr/lib/python2.7/lib-old', '/usr/lib/python2.7/lib-dynload', '/usr/lib/python2.7/site-packages'] admin(29209): sys.platform = linux2 admin(29209): [----- Environment Variables -----] admin(29209): SSL_VERSION_INTERFACE: mod_ssl/2.4.7 admin(29209): HTTP_REFERER: https://mail.example.com/cgi-bin/mailman/subscribe/news admin(29209): SSL_CIPHER_EXPORT: false admin(29209): CONTEXT_DOCUMENT_ROOT: /usr/lib/cgi-bin/ admin(29209): SERVER_SOFTWARE: Apache admin(29209): CONTEXT_PREFIX: /cgi-bin/ admin(29209): SSL_SERVER_A_KEY: rsaEncryption admin(29209): QUERY_STRING: admin(29209): SERVER_SIGNATURE: admin(29209): REQUEST_METHOD: POST admin(29209): PATH_INFO: /news admin(29209): SERVER_PROTOCOL: HTTP/1.1 admin(29209): SSL_SERVER_S_DN: CN=mail.example.com admin(29209): SSL_CIPHER: ECDHE-RSA-AES128-GCM-SHA256 admin(29209): SSL_SERVER_V_START: Apr 17 16:42:00 2016 GMT admin(29209): SSL_TLS_SNI: mail.example.com admin(29209): CONTENT_LENGTH: 106 admin(29209): SSL_CLIENT_VERIFY: NONE admin(29209): HTTP_USER_AGENT: Mozilla/5.0 (X11; Linux x86_64; rv:47.0) Gecko/20100101 Firefox/47.0 admin(29209): HTTP_CONNECTION: keep-alive admin(29209): HTTP_COOKIE: PHPSESSID=... admin(29209): SERVER_NAME: mail.example.com admin(29209): REMOTE_ADDR: 192.0.2.1 admin(29209): SSL_CIPHER_ALGKEYSIZE: 128 admin(29209): SSL_SECURE_RENEG: true admin(29209): PATH_TRANSLATED: /srv/web/mail/news admin(29209): SSL_SERVER_I_DN_C: US admin(29209): SSL_COMPRESS_METHOD: NULL admin(29209): SSL_SERVER_M_VERSION: 3 admin(29209): SSL_SERVER_I_DN_O: Let's Encrypt admin(29209): SERVER_ADDR: 192.0.2.2 admin(29209): DOCUMENT_ROOT: /srv/web/mail admin(29209): SERVER_PORT: 443 admin(29209): SSL_VERSION_LIBRARY: OpenSSL/1.0.1f admin(29209): PYTHONPATH: /var/lib/mailman admin(29209): SCRIPT_FILENAME: /usr/lib/cgi-bin/mailman/subscribe admin(29209): SERVER_ADMIN: webmaster(a)example.com admin(29209): SSL_SESSION_RESUMED: Initial admin(29209): SSL_SERVER_M_SERIAL: ... admin(29209): SSL_SERVER_A_SIG: sha256WithRSAEncryption admin(29209): HTTP_DNT: 1 admin(29209): HTTP_HOST: mail.example.com admin(29209): SCRIPT_NAME: /cgi-bin/mailman/subscribe admin(29209): HTTPS: on admin(29209): HTTP_CACHE_CONTROL: max-age=0 admin(29209): REQUEST_URI: /cgi-bin/mailman/subscribe/news admin(29209): HTTP_ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 admin(29209): SSL_SERVER_S_DN_CN: mail.example.com admin(29209): GATEWAY_INTERFACE: CGI/1.1 admin(29209): SSL_SERVER_I_DN_CN: Let's Encrypt Authority X3 admin(29209): REMOTE_PORT: 40456 admin(29209): HTTP_ACCEPT_LANGUAGE: en-US,en;q=0.5 admin(29209): REQUEST_SCHEME: https admin(29209): SSL_SERVER_V_END: Jul 16 16:42:00 2016 GMT admin(29209): CONTENT_TYPE: text/plain;charset=UTF-8 admin(29209): SSL_PROTOCOL: TLSv1.2 admin(29209): SSL_CIPHER_USEKEYSIZE: 128 admin(29209): HTTP_ACCEPT_ENCODING: gzip, deflate, br admin(29209): SSL_SERVER_I_DN: CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US ** Affects: mailman (Ubuntu) Importance: Undecided Status: New ** Project changed: mailman => mailman (Ubuntu) -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1602608 Title: mailman crash for subscription in webinterface To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/mailman/+bug/1602608/+subscriptio…

3 8

[Bug 701558] [NEW] Content filtering leaves a single sub-part in a multipart message.
by Mark Sapiro 10 Jun '17

10 Jun '17

Public bug reported: If the original message is multipart but not multipart/alternative and content filtering removes all but one part, the message is left as a multipart message with only the one sub-part instead of being recast as just the sub-part. This can cause msg_header and/or msg_footer to be added as separate parts to a text/plain message instead of being added to the text/plain body part. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: Triaged ** Changed in: mailman Importance: Undecided => Medium ** Changed in: mailman Status: New => Triaged ** Changed in: mailman Milestone: None => 2.1.15 ** Changed in: mailman Assignee: (unassigned) => Mark Sapiro (msapiro) ** Description changed: - If the original message in multipart but not multipart/alternative and + If the original message is multipart but not multipart/alternative and content filtering removes all but one part, the message is left as a multipart message with only the one sub-part instead of being recast as just the sub-part. This can cause msg_header and/or msg_footer to be added as separate - parts to a text/plain message instead if being added to the text/plain + parts to a text/plain message instead of being added to the text/plain body part. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/701558 Title: Content filtering leaves a single sub-part in a multipart message.

3 7

[Bug 576675] [NEW] Content filtering fails to collapse alternatives.
by Mark Sapiro 10 Jun '17

10 Jun '17

Public bug reported: Collapsing multipart/alternative parts to just the first alternative only works if the message itself is multipart/alternative, or the multipart/alternative part is at the first sub-level. For example, given this structure: multipart/mixed | multipart/related | | multipart/alternative | | | text/plain | | | text/html | | image/jpeg | application/msword The multipart/alternative part will not be collapsed. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress ** Changed in: mailman Importance: Undecided => Medium ** Changed in: mailman Status: New => In Progress ** Changed in: mailman Milestone: None => 2.1.14 ** Changed in: mailman Assignee: (unassigned) => Mark Sapiro (msapiro) -- Content filtering fails to collapse alternatives. https://bugs.launchpad.net/bugs/576675 You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman.

3 7

[Bug 978351] [NEW] Content Filtering *_filename_extension matches are case sensitive.
by Mark Sapiro 10 Jun '17

10 Jun '17

Public bug reported: If the case of the filename extension in the message doesn't agree with that in *_filename_extension, they won't match. Matching should be case insensitive. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress ** Affects: mailman/2.1 Importance: Medium Assignee: Mark Sapiro (msapiro) Status: Fix Released ** Affects: mailman/3.0 Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress ** Tags: mailman3 ** Also affects: mailman/3.0 Importance: Medium Assignee: Mark Sapiro (msapiro) Status: Fix Released ** Also affects: mailman/2.1 Importance: Undecided Status: New ** Changed in: mailman/3.0 Status: Fix Released => In Progress ** Changed in: mailman/3.0 Milestone: mailman-2.1 => 3.0.0b2 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/978351 Title: Content Filtering *_filename_extension matches are case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/978351/+subscriptions

3 5

[Bug 757062] [NEW] Content filtering can remove the headers from a message/rfc822 part.
by Mark Sapiro 10 Jun '17

10 Jun '17

Public bug reported: If Content filtering accepts both message/rfc822 and multipart/alternative MIME parts, and a message/rfc822 part contains a message whose content type is multipart/alternative and collapse_alternatives is Yes, the headers of the message in the message/rfc822 part will be lost. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress ** Tags: mailman3 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/757062 Title: Content filtering can remove the headers from a message/rfc822 part.

3 12

[Bug 1673307] [NEW] msg_header and/or msg_footer can be added as a separate MIME part even if only whitespace.
by Mark Sapiro 03 Jun '17

03 Jun '17

Public bug reported: If a content filtered message is other than single part text/plain, msg_header and msg_footer are added as separate MIME parts if they are non-empty even if they consist only of white space. msg_header and msg_footer consisting of only white space should be treated as empty and not added. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1673307 Title: msg_header and/or msg_footer can be added as a separate MIME part even if only whitespace. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1673307/+subscriptions

2 4

[Bug 1670033] [NEW] Text blocks, e.g. msg_footer, might not end with linefeed
by Ralph Corderoy 03 Jun '17

03 Jun '17

Public bug reported: Mailman 2.1.18-2+deb8u1. msg_footer was edited in the web GUI so the text area limited the cursor to the last line of text; it couldn't move down to a blank line below. The emails comes from Mailman that have this text base64 encoded, and the last line doesn't end with a linefeed, e.g. LS0gCnNpZzAKc2lnMQ==. Mailman should ensure a linefeed is added if one isn't already present, but on using the text block, not editing it so the blank line appears in the GUI as then the user will wonder why they can't remove it. ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1670033 Title: Text blocks, e.g. msg_footer, might not end with linefeed To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1670033/+subscriptions

3 5

[Bug 1667215] [NEW] Uncaught TypeError in subscribe CGI with multiple digest flags in post/query data
by Mark Sapiro 03 Jun '17

03 Jun '17

Public bug reported: If a malicious user, bot or whatever POSTs or GETs with query data to the subscribe CGI and the data contains multiple 'digest=' fragments, the resultant digest data seen by the subscribe CGI is a list rather than a string. The CGI calls int() on this which throws TypeError. The int() call is already in a try: that catches ValueError. It needs to catch TypeError too. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1667215 Title: Uncaught TypeError in subscribe CGI with multiple digest flags in post/query data To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1667215/+subscriptions

2 3

[Bug 1664729] [NEW] Processing a probe bounce from a deleted member throws NotAMemberError
by Mark Sapiro 03 Jun '17

03 Jun '17

Public bug reported: In processing a probe bounce, BounceRunner attempts to get the bounce_info for the user. The situation where the probe is delayed and the bounce_info is gone was covered in https://bugs.launchpad.net/mailman/+bug/1482940 but if the user has been removed, getBounceInfo throws NotAMemberError which should be caught and handled appropriately. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1664729 Title: Processing a probe bounce from a deleted member throws NotAMemberError To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1664729/+subscriptions

2 3

[Bug 1661810] [NEW] Certain Malformed list names throw TypeError: in roster CGI
by Mark Sapiro 03 Jun '17

03 Jun '17

Public bug reported: We've seen attacks visiting URLs such as <http://example.com/mailman/roster/python- dev%2522%252dswffelqj%252d%2522>. The list name after unescaping is python-dev%22%2dswffelqj%2d%22 which websafes to the same thing. Ultimately, this calls error_page(_('No such list <em>%(safelistname)s</em>')) which in turn calls error_page_doc(doc, errmsg) with the translated error message. The problem is error_page_doc is defined as def error_page_doc(doc, errmsg, *args): even though it is never called with any additional args. It then tries to interpolate the (empty) args into the errmsg string which in this case contains a '%' an results in TypeError: not enough arguments for format string The solution, since error_page_doc is never called with extra arguments is to just drop the *args and the attempted interpolation. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1661810 Title: Certain Malformed list names throw TypeError: in roster CGI To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1661810/+subscriptions

2 3

Mailman-coders May 2017