Mailman 3 July 2018 - Mailman-coders

[Bug 1780874] [NEW] Arbitrary text injection vulnerability in Mailman CGIs
by Mark Sapiro July 24, 2018

July 24, 2018

*** This bug is a security vulnerability *** Private security bug reported: A URL with a very long text listname such as http://www.example.com/mailman/listinfo/This_is_a_long_string_with_some_phi… will echo the text in the "No such list" error response. This can be used to make a potential victim think the phishing text comes from a trusted site. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1780874 Title: Arbitrary text injection vulnerability in Mailman CGIs To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1780874/+subscriptions

2 6

[Bug 1779774] [NEW] The BLOCK_SPAMHAUS_LISTED_DBL_SUBSCRIBE feature doesn't work.
by Mark Sapiro July 23, 2018

July 23, 2018

Public bug reported: The feature looks up domain.tld.zen.spamhaus.org. This is not correct. It should look up domain.tld.dbl.spamhaus.org. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: Fix Committed -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1779774 Title: The BLOCK_SPAMHAUS_LISTED_DBL_SUBSCRIBE feature doesn't work. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1779774/+subscriptions

3 5

[Bug 1779445] [NEW] edithtml.py saves en templates using html entity reference with raw iso-8859-1 character
by Yasuhito FUTATSUKI＠POEM July 23, 2018

July 23, 2018

Public bug reported: In Mailman's web administrative interface, edithtml page saves en language templates by using iso-8859-1 raw character if the template uses html entity reference like " ". For example, If "General list information page" (templates/en/listinfo.html), which contains  ", has been saved without modification from web UI, the lists template en/listinfo.html will contain raw '\xa0' character. If Adding " in text area and submit changes twice, it will turn into "". I'm not sure the patch attached is a good way to fix it because I don't know these entity reference characters are always ISO-8859-1 character, but for reference. ** Affects: mailman Importance: Undecided Status: New ** Patch added: "edithtml-save-as-ascii-patch.txt" https://bugs.launchpad.net/bugs/1779445/+attachment/5158043/+files/edithtml… ** Branch linked: lp:mailman/2.1 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1779445 Title: edithtml.py saves en templates using html entity reference with raw iso-8859-1 character To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1779445/+subscriptions

2 8

[Merge] lp:~futatuki/mailman/2.1-ja-translation into lp:mailman/2.1
by Yasuhito FUTATSUKI＠POEM July 19, 2018

July 19, 2018

Yasuhito FUTATSUKI at POEM has proposed merging lp:~futatuki/mailman/2.1-ja-translation into lp:mailman/2.1. Commit message: Update ja translation Requested reviews: Mailman Coders (mailman-coders) For more details, see: https://code.launchpad.net/~futatuki/mailman/2.1-ja-translation/+merge/3498… Update ja translation including * fix missed one '"' (double quote character) in HTML attribute. * revise some translation message * translate untranslated messages * unify comma and full stop character in Japanese context into U+3001 (toten as comma) and U+3002 (kuten as full stop). (cf. https://en.wikipedia.org/wiki/Japanese_punctuation#Japanese_punctuation_mar…) -- Your team Mailman Coders is requested to review the proposed merge of lp:~futatuki/mailman/2.1-ja-translation into lp:mailman/2.1.

2 1

[Merge] lp:~futatuki/mailman/python-doc-url into lp:mailman/2.1
by noreply＠launchpad.net July 17, 2018

July 17, 2018

The proposal to merge lp:~futatuki/mailman/python-doc-url into lp:mailman/2.1 has been updated. Status: Needs review => Merged For more details, see: https://code.launchpad.net/~futatuki/mailman/python-doc-url/+merge/349626 -- Your team Mailman Coders is requested to review the proposed merge of lp:~futatuki/mailman/python-doc-url into lp:mailman/2.1.

1 0

Re: [Merge] lp:~futatuki/mailman/python-doc-url into lp:mailman/2.1
by Yasuhito FUTATSUKI＠POEM July 16, 2018

July 16, 2018

> (I don't think Python 2 library docs will not be removed even if their URL will be changed) I'm sorry, I did't intend double negation, this was intended "(I don't think Python 2 library docs will be removed soon, even if their URL will be changed)" I'll stand by your choice even if it is not merging this or fixing only 404 link in ca po file by pointing http://docs.python.org/library/re.html for maintenance reasons, etc. Any way, as it have been clear where and how to modify if we will want to fix these URLs, it is also easy to fix them later. -- https://code.launchpad.net/~futatuki/mailman/python-doc-url/+merge/349626 Your team Mailman Coders is requested to review the proposed merge of lp:~futatuki/mailman/python-doc-url into lp:mailman/2.1.

1 0

Re: [Merge] lp:~futatuki/mailman/python-doc-url into lp:mailman/2.1
by Mark Sapiro July 16, 2018

July 16, 2018

I have mixed feelings about this MR. On the one hand, it is valid and represents a significant amount of work, and I hate to just ignore it. On the other, I have concerns. While it is true that the URL http://docs.python.org/library/stdtypes.html#string-formatting-operations doesn't go to the relevant Python 3 section of library/stdtypes.html which is https://docs.python.org/3/library/stdtypes.html#printf-style-string-formatt…, that Python 3 section is not so different from Python 2 as to be misleading. Likewise, the reference to http://docs.python.org/library/re.html goes to the Python 3 page which is not so different from Python 2 as to be misleading, and the reference to http://www.python.org/doc/current/lib/module-re.html which gives a 404 is only in the 'ca' mailman.po. None of this is really a reason to not fix these things, but my concern is what will happen on 1 January 2020 (see https://pythonclock.org/ ). Are we changing these wrong but not so bad URLs to ones that will 404 in less than 18 months? -- https://code.launchpad.net/~futatuki/mailman/python-doc-url/+merge/349626 Your team Mailman Coders is requested to review the proposed merge of lp:~futatuki/mailman/python-doc-url into lp:mailman/2.1.

2 1

[Merge] lp:~futatuki/mailman/fix-Defaults.py into lp:mailman/2.1
by Yasuhito FUTATSUKI＠POEM July 12, 2018

July 12, 2018

Yasuhito FUTATSUKI at POEM has proposed merging lp:~futatuki/mailman/fix-Defaults.py into lp:mailman/2.1. Commit message: add description about IPv6 support of subscribe blocking to Defaults.py.in fix a typo in comment of BLOCK_SPAMHAUS_LISTED_DBL_SUBSCRIBE Requested reviews: Mailman Coders (mailman-coders) For more details, see: https://code.launchpad.net/~futatuki/mailman/fix-Defaults.py/+merge/349388 -- Your team Mailman Coders is requested to review the proposed merge of lp:~futatuki/mailman/fix-Defaults.py into lp:mailman/2.1.

2 1

[Merge] lp:~futatuki/mailman/edithtml-lang-select into lp:mailman/2.1
by Yasuhito FUTATSUKI＠POEM July 9, 2018

July 9, 2018

Yasuhito FUTATSUKI at POEM has proposed merging lp:~futatuki/mailman/edithtml-lang-select into lp:mailman/2.1. Commit message: fix layout problem of previous merge Requested reviews: Mailman Coders (mailman-coders) For more details, see: https://code.launchpad.net/~futatuki/mailman/edithtml-lang-select/+merge/34… I'm very sorry, previous merge proposal has a problem about page layout, two link "View or edit the list configuration information." and "Edit the public HTML pages and textfiles" are connected without separator. This is a fix of it, inserting '<br>' tag between them. -- Your team Mailman Coders is requested to review the proposed merge of lp:~futatuki/mailman/edithtml-lang-select into lp:mailman/2.1.

2 2

[Merge] lp:~futatuki/mailman/edithtml-lang-select into lp:mailman/2.1
by Yasuhito FUTATSUKI＠POEM July 9, 2018

July 9, 2018

Yasuhito FUTATSUKI at POEM has proposed merging lp:~futatuki/mailman/edithtml-lang-select into lp:mailman/2.1. Commit message: Allow to edit templates other than lists preferred language Requested reviews: Mailman Coders (mailman-coders) For more details, see: https://code.launchpad.net/~futatuki/mailman/edithtml-lang-select/+merge/34… This enables to edit templates for available languages without changing preferred_language temporary. * Add language selecter to template editing page (if the list has multiple available language) * Add link from editing page to template selection page -- Your team Mailman Coders is requested to review the proposed merge of lp:~futatuki/mailman/edithtml-lang-select into lp:mailman/2.1.

2 1