Mailman 3 July 1998 - Mailman-Developers

Reposting Form Data
by Barry A. Warsaw 31 Jul '98

31 Jul '98

Maybe someone out there with more HTTP experience than me can answer this question. If I have a CGI script that issues a redirect using the `Location:' header, I can get the Web browser to go to the relocated page with no problem. It even still shows the original URL in browser. Cool so far. However, if what I'm doing is posting some form data, the browser gets redirected, but the form data doesn't get reposted to the new URL. Verified under NS4/Unix and IE3. This is a real pain for something I'm trying to add to Mailman. I'm sure there's some haughty security justification for the non-reposting of form data, so the natural question is: can I get around this? :-) Thanks, -Barry

2 1

Potential gotcha
by Barry A. Warsaw 31 Jul '98

31 Jul '98

Corbett has been very kind in allowing me access to his machine to debug his problems. Since others have reported similar problems, I want to give you a heads up. Please double check that the programs in /home/mailman/cgi-bin are group owned by `mailman' and have the group sticky bit set. This is imperative; Mailman just won't work without this. I know need to figure out why the install procedure is broken on some systems, and how the driver script can better report and recover from these problems. Thanks Corbett! -Barry

1 1

/tmp/mailman.log
by Corbett J. Klempay 31 Jul '98

31 Jul '98

Barry and the crew: I just put in the new driver a bit ago...and went to www2.acm.jhu.edu/mailman/listinfo /tmp/mailman.log showed up then...this is what it contained: [cklempay@chimera /tmp]$ cat mailman.log ===== import sys run_main() import os sys.path.insert() import StampedLogger import MultiLogger instantiating logger instantiating multi should now get normal error reporting [cklempay@chimera /tmp]$ Corbett

2 1

Anyone else seeing this?
by Corbett J. Klempay 30 Jul '98

30 Jul '98

Ok, this is really 2 messages chained together...it seems John is soon to be a dad (or maybe a dad again, not sure actually :), so he's a little busy :) Any assistance is _greatly_ appreciated...the other ACM guys kept whining because the list is down, so I just set up a temp alias to quiet them until I get this sorted out :) --- Is it supposed to be the case where you have to be root to create a new list? I thought that in my 1.0b4 install, I had created new lists as cklempay...but if I do it as anything other than root now (with b5), I get this: [mailman@chimera bin]$ newlist test Enter the email of the person running the list: cklempay(a)acm.jhu.edu Enter the initial list password: snoop Traceback (innermost last): File "/home/mailman/bin/newlist", line 133, in ? raise SystemExit(main(sys.argv)) File "/home/mailman/bin/newlist", line 83, in main newlist.Create(list_name, owner_mail, pw) File "/home/mailman/Mailman/MailList.py", line 518, in Create Utils.MakeDirTree(os.path.join(mm_cfg.LIST_DATA_DIR, name)) File "/home/mailman/Mailman/Utils.py", line 276, in MakeDirTree os.mkdir(made_part, perms) os.error: (13, 'Permission denied') [mailman@chimera bin]$ I don't know if this is the way it is supposed to be and maybe I had it working before only because maybe I had messed up some permissions... I had been having a LOT of problems getting it to let me access any of the pages (all of the logs turned up 'Premature end of script headers' or in some configurations I'd get a Internal Server Error). In my current state, I can view www2.acm.jhu.edu/mailman/listinfo but if I su to root and do a newlist to create a test list, I get this if I try to access www2.acm.jhu.edu/mailman/admin/test : We're sorry, we hit a bug! If you would like to help us identify the problem, please email a copy of this page to the webmaster for this site with a description of what happened. Thanks! Traceback: Content-type: text/html We're sorry, we hit a bug! Mailman experienced a very low level failure and could not even generate a useful traceback. Please report this to the Mailman administrator at this site. I'm not sure, but I thought I remembered someone mentioning something like this earlier today too. One other quick (and sort of unrelated question)...I just recursively zipped up my /home/mailman/lists subtree before killing b4...since my aliases are still in place (didn't touch those), can I just extract them to their original places and have it work? Or does Mailman keep other administrative data about that it won't have for these lists if I create them that way? ---next msg----

2 4

Cron <mailman@chimera> /usr/bin/python /home/mailman/cron/senddigests (fwd)
by Corbett J. Klempay 30 Jul '98

30 Jul '98

I am getting this as well...I followed the permissions stuff to the letter...? ---------- Forwarded message ---------- Date: Thu, 30 Jul 1998 12:00:00 -0400 From: Cron Daemon <root(a)chimera.acm.jhu.edu> To: mailman(a)chimera.acm.jhu.edu Subject: Cron <mailman@chimera> /usr/bin/python /home/mailman/cron/senddigests Traceback (innermost last): File "/home/mailman/cron/senddigests", line 37, in ? main() File "/home/mailman/cron/senddigests", line 31, in main list = MailList.MailList(name, lock=0) File "/home/mailman/Mailman/MailList.py", line 60, in __init__ self.Load() File "/home/mailman/Mailman/MailList.py", line 587, in Load self.CheckVersion(dict) File "/home/mailman/Mailman/MailList.py", line 611, in CheckVersion self.Save() File "/home/mailman/Mailman/MailList.py", line 558, in Save os.link(fname, fname_last) os.error: (13, 'Permission denied') ---end #2 ------------------------------------------------------------------------------- Corbett J. Klempay Quote of the Week: http://www2.acm.jhu.edu/~cklempay "Talent develops in quiet places, character in the full current of human life." PGP Fingerprint: 7DA2 DB6E 7F5E 8973 A8E7 347B 2429 7728 76C2 BEA1 -------------------------------------------------------------------------------

1 0

Cron <mailman@chimera> /usr/bin/python /home/mailman/cron/senddigests (fwd)
by Corbett J. Klempay 30 Jul '98

30 Jul '98

I am getting this as well...I followed the permissions stuff to the letter...? ---------- Forwarded message ---------- Date: Thu, 30 Jul 1998 12:00:00 -0400 From: Cron Daemon <root(a)chimera.acm.jhu.edu> To: mailman(a)chimera.acm.jhu.edu Subject: Cron <mailman@chimera> /usr/bin/python /home/mailman/cron/senddigests Traceback (innermost last): File "/home/mailman/cron/senddigests", line 37, in ? main() File "/home/mailman/cron/senddigests", line 31, in main list = MailList.MailList(name, lock=0) File "/home/mailman/Mailman/MailList.py", line 60, in __init__ self.Load() File "/home/mailman/Mailman/MailList.py", line 587, in Load self.CheckVersion(dict) File "/home/mailman/Mailman/MailList.py", line 611, in CheckVersion self.Save() File "/home/mailman/Mailman/MailList.py", line 558, in Save os.link(fname, fname_last) os.error: (13, 'Permission denied') ---end #2 ------------------------------------------------------------------------------- Corbett J. Klempay Quote of the Week: http://www2.acm.jhu.edu/~cklempay "Talent develops in quiet places, character in the full current of human life." PGP Fingerprint: 7DA2 DB6E 7F5E 8973 A8E7 347B 2429 7728 76C2 BEA1 -------------------------------------------------------------------------------

1 0

hehe...typo
by Corbett J. Klempay 29 Jul '98

29 Jul '98

Just to clear any confusion, I of course meant mm_cfg.py in that first line of the last message... :) ------------------------------------------------------------------------------- Corbett J. Klempay Quote of the Week: http://www2.acm.jhu.edu/~cklempay "Talent develops in quiet places, character in the full current of human life." PGP Fingerprint: 7DA2 DB6E 7F5E 8973 A8E7 347B 2429 7728 76C2 BEA1 -------------------------------------------------------------------------------

1 0

Oddities
by Corbett J. Klempay 29 Jul '98

29 Jul '98

Well, I left those settings in mm_cfy.py that I copied in, and ended up also changing the import to have it import from Defaults.py (so I guess that's redundant, but it shouldn't hurt anything, eh?). Anyway, the annoying 5 minute cron messages have stopped...so I guess that part is kosher now. However two problems remain: - Test messages sent to one of the lists from my previous 1.0b4 install are just getting swallowed up and never getting sent to the list - Going to www2.acm.jhu.edu/mailman/listinfo still gives an Internal Server Error...and the /var/log/httpd/error_log file lists this at the end: [Wed Jul 29 10:43:32 1998] access to /home/mailman/cgi-bin/listinfo failed for 1 28.220.223.50, reason: Premature end of script headers Any ideas? ------------------------------------------------------------------------------- Corbett J. Klempay Quote of the Week: http://www2.acm.jhu.edu/~cklempay "Talent develops in quiet places, character in the full current of human life." PGP Fingerprint: 7DA2 DB6E 7F5E 8973 A8E7 347B 2429 7728 76C2 BEA1 -------------------------------------------------------------------------------

1 0

The diffs
by Corbett J. Klempay 29 Jul '98

29 Jul '98

Here's what diff spit out when I did: diff Defaults.py mm_defaults.py ---- 19c19 < """Distributed default settings for significant Mailman config variables. --- > """Distributed default settings for significant mailman config variables. 47,52d46 < # 1 to use crypt for passwords instead of md5. < # Crypt may not work on all python installs. < # Don't change this value once you have lists running... < # In fact, you should just let configure set this one and leave it alone. < USE_CRYPT = 1 < 86,92d79 < # This variable controlls whether monthly password reminders are sent. < DEFAULT_SEND_REMINDERS = 1 < # Send welcome messages to new users? Probably should keep this set to 1. < DEFAULT_SEND_WELCOME_MSG = 1 < # Wipe sender information, and make it look like the list-admin < # address sends all messages < DEFAULT_ANONYMOUS_LIST = 0 128,130c115,122 < DEFAULT_PLAIN_DIGEST_KEEP_HEADERS = ['message', 'date', 'from', < 'subject', 'to', 'cc', < 'reply-to', 'organization'] --- > # We're only retaining the text file, an external pipermail (andrew's > # newest version) is pointed at the retained text copies. > ## # 0 = never, 1 = daily, 2 = hourly: > ## DEFAULT_ARCHIVE_UPDATE_FREQUENCY = 2 > ## # 0 = yearly, 1 = monthly > ## DEFAULT_ARCHIVE_VOLUME_FREQUENCY = 0 > ## # Retain a flat text mailbox of postings as well as the fancy archives? > ## DEFAULT_ARCHIVE_RETAIN_TEXT_COPY = 1 152a145,165 > # Enumeration for types of configurable variables in Mailman. > Toggle = 1 > Radio = 2 > String = 3 > Text = 4 > Email = 5 > EmailList = 6 > Host = 7 > Number = 8 > > # could add Directory and URL > > > # Bitfield for user options > Digests = 0 # handled by other mechanism, doesn't need a flag. > DisableDelivery = 1 > DontReceiveOwnPosts = 2 # Non-digesters only > AcknowlegePosts = 4 > DisableMime = 8 # Digesters only > ConcealSubscription = 16 > 170c183 < PYTHON = '/usr/local/bin/python' --- > PYTHON = '/usr/bin/python' 178,202d190 < # Don't change anything from here down unless you know what you're doing... < < < # Enumeration for types of configurable variables in Mailman. < Toggle = 1 < Radio = 2 < String = 3 < Text = 4 < Email = 5 < EmailList = 6 < Host = 7 < Number = 8 < < # could add Directory and URL < < < # Bitfield for user options < Digests = 0 # handled by other mechanism, doesn't need a flag. < DisableDelivery = 1 < DontReceiveOwnPosts = 2 # Non-digesters only < AcknowlegePosts = 4 < DisableMime = 8 # Digesters only < ConcealSubscription = 16 < < 216,219c204 < VERSION = '1.0b5' < < # Data file version number < DATA_FILE_VERSION = 3 --- > VERSION = '1.0b4' --- ------------------------------------------------------------------------------- Corbett J. Klempay Quote of the Week: http://www2.acm.jhu.edu/~cklempay "Talent develops in quiet places, character in the full current of human life." PGP Fingerprint: 7DA2 DB6E 7F5E 8973 A8E7 347B 2429 7728 76C2 BEA1 -------------------------------------------------------------------------------

3 3

more stuff, it seems...
by Corbett J. Klempay 29 Jul '98

29 Jul '98

I made the USE_CRYPT = 1 change...and now the 5 minute cron gives me: Date: Wed, 29 Jul 1998 09:55:02 -0400 From: Cron Daemon <root(a)chimera.acm.jhu.edu> To: mailman(a)chimera.acm.jhu.edu Subject: Cron <mailman@chimera> /usr/bin/python /home/mailman/cron/gate_news Traceback (innermost last): File "/home/mailman/cron/gate_news", line 45, in ? list = MailList.MailList(name, lock=0) File "/home/mailman/Mailman/MailList.py", line 60, in __init__ self.Load() File "/home/mailman/Mailman/MailList.py", line 587, in Load self.CheckVersion(dict) File "/home/mailman/Mailman/MailList.py", line 602, in CheckVersion if (self.data_version >= mm_cfg.DATA_FILE_VERSION and AttributeError: DATA_FILE_VERSION Traceback (innermost last): File "/home/mailman/cron/gate_news", line 45, in ? list = MailList.MailList(name, lock=0) File "/home/mailman/Mailman/MailList.py", line 60, in __init__ self.Load() File "/home/mailman/Mailman/MailList.py", line 587, in Load self.CheckVersion(dict) File "/home/mailman/Mailman/MailList.py", line 602, in CheckVersion if (self.data_version >= mm_cfg.DATA_FILE_VERSION and AttributeError: DATA_FILE_VERSION Traceback (innermost last): File "/home/mailman/cron/gate_news", line 45, in ? list = MailList.MailList(name, lock=0) File "/home/mailman/Mailman/MailList.py", line 60, in __init__ self.Load() File "/home/mailman/Mailman/MailList.py", line 587, in Load Traceback (innermost last): File "/home/mailman/cron/gate_news", line 45, in ? list = MailList.MailList(name, lock=0) File "/home/mailman/Mailman/MailList.py", line 60, in __init__ self.Load() File "/home/mailman/Mailman/MailList.py", line 587, in Load self.CheckVersion(dict) File "/home/mailman/Mailman/MailList.py", line 602, in CheckVersion if (self.data_version >= mm_cfg.DATA_FILE_VERSION and AttributeError: DATA_FILE_VERSION self.CheckVersion(dict) File "/home/mailman/Mailman/MailList.py", line 602, in CheckVersion if (self.data_version >= mm_cfg.DATA_FILE_VERSION and AttributeError: DATA_FILE_VERSION John: I have zero diff experience...if you gave me a command line or something, I'd run it (or whatever else) for ya if you need...I just don't want to horse around with it for a long time when a) I'm not sure if I'd be using it right and b) I'm at my new internship and am sneaking out through the corporate firewall to get here :) ------------------------------------------------------------------------------- Corbett J. Klempay Quote of the Week: http://www2.acm.jhu.edu/~cklempay "Talent develops in quiet places, character in the full current of human life." PGP Fingerprint: 7DA2 DB6E 7F5E 8973 A8E7 347B 2429 7728 76C2 BEA1 -------------------------------------------------------------------------------

2 1

mmsitepass puking
by Corbett J. Klempay 29 Jul '98

29 Jul '98

I just upgraded a 1.0b4 --> 1.0b5...when I tried to run mmsitepass (didn't know if I needed to do this again since I was upgrading, but figured it would be better to be safe than sorry...)...and I got this: [root@chimera bin]# mmsitepass snoop Traceback (innermost last): File "./mmsitepass", line 27, in ? from Mailman import MailList File "/home/mailman/Mailman/MailList.py", line 40, in ? from SecurityManager import SecurityManager File "/home/mailman/Mailman/SecurityManager.py", line 24, in ? import Crypt File "/home/mailman/Mailman/Crypt.py", line 19, in ? if mm_cfg.USE_CRYPT: AttributeError: USE_CRYPT [root@chimera bin]# Then, when I tried to look at www2.acm.jhu.edu/mailman/listinfo, I got an internal server error, with this in /var/log/httpd/error_log: [Wed Jul 29 09:27:04 1998] access to /home/mailman/cgi-bin/listinfo failed for 1 28.220.223.50, reason: Premature end of script headers ...and while I was writing this message, I postponed it to investigate something else...I'm now getting this message every 5 minutes from the Cron Daemon: Traceback (innermost last): File "/home/mailman/cron/gate_news", line 22, in ? from Mailman import MailList File "/home/mailman/Mailman/MailList.py", line 40, in ? from SecurityManager import SecurityManager File "/home/mailman/Mailman/SecurityManager.py", line 24, in ? import Crypt File "/home/mailman/Mailman/Crypt.py", line 19, in ? if mm_cfg.USE_CRYPT: AttributeError: USE_CRYPT I tried sending a test message to one of the lists I host..haven't seen it yet (10 minutes ago, so I'm assuming it's not coming). BTW - Kudos to whoever added in the permissions checking in configure! ------------------------------------------------------------------------------- Corbett J. Klempay Quote of the Week: http://www2.acm.jhu.edu/~cklempay "Talent develops in quiet places, character in the full current of human life." PGP Fingerprint: 7DA2 DB6E 7F5E 8973 A8E7 347B 2429 7728 76C2 BEA1 -------------------------------------------------------------------------------

2 1

Release stability
by John Viega 27 Jul '98

27 Jul '98

We're going to try to test stuff as we release it. However, in these betas, we're not going to garuntee there isn't a major show-stopper. If someone finds one, let us know, and we'll put out a new release as soon as we fix it, now that there's a release tool. John

2 1

ANNOUNCE: Mailman 1.0b5 released
by John Viega 27 Jul '98

27 Jul '98

Well, for some reason the automated mail gets to me, but not to the list. But if I send mail to the list manually it goes right through. Since I don't have time to look at it, following is the announcement sent manually. Please forgive me if the autogenerated stuff eventually does show up. ANNOUNCE: Mailman 1.0b5 release Version 1.0b5 of the Mailman mailing list manager is now available from the Mailman web page: http://www.list.org/ Via ftp, the release is available at: ftp://www.list.org/pub/mailman/mailman-1.0b5.tar.gz New in this version: - New file locking that should be portable and work w/ NFS. - Better use of packages. - Better error logging and reporting. - Less startup overhead. - Various and sundry bug fixes. Please be sure to read the README file after downloading. John Viega

1 0

Hmm...
by John Viega 27 Jul '98

27 Jul '98

It seems none of those messages came through anyway. Anyway, if you do happen to see multiple messages, please disregard.

1 0

Whoops
by John Viega 27 Jul '98

27 Jul '98

Sorry if there were multiple autogened messages from me. I only meant to send the first; I forgot to change the target address before sending the rest. John

1 0

ANNOUNCE: Mailman 1.0b5 release
by John＠list.org 27 Jul '98

27 Jul '98

Version 1.0b5 of the Mailman mailing list manager is now available from the Mailman web page: http://www.list.org/ Via ftp, the release is available at: ftp://www.list.org/pub/mailman/mailman-1.0b5.tar.gz New in this version: New in 1.0b5: - New file locking that should be portable and work w/ NFS. - Better use of packages. - Better error logging and reporting. - Less startup overhead. - Various and sundry bug fixes. 1.0b4 - A configure script for easy installation (Barry Warsaw) - The ability to install Mailman to locations other than /home/mailman (Barry Warsaw) - Use cookies on the admin pages (also hides admin pages from others) (Scott Cotton) - Subscription requests send a request for confirmation, which may be done by simply replying to the message (Scott Cotton) - Facilities for gating mail to a newsgroup, and for gating a newsgroup to a mailing list (John Viega) - Contact the SMTP port instead of calling sendmail (primarily for portability) (John Viega) - Changed all links on web pages to relative links where appropriate. (John Viega) - Use MD5 if crypt is not available (John Viega) - Lots of fixing up of bounce handling (Ken Manheimer) - General UI polishing (Ken Manheimer) - mm_html: Make it prominent when the user's delivery is disabled on his option page. (Ken Manheimer) - mallist:DeleteMember() Delete the option setings if any. (Ken Manheimer) DONE for mailman 1.0b3 1.0b3 (05/03/1998) All changes by klm(a)python.org (ken manheimer) Items marked by an '*' asterisk have greater operational impact. * mm_message:Deliverer.DeliverToList() added missing newline between the headers and message body. Without it, any sequence of initial body lines that _looked_ like headers ("Sir: Please excuse my impertinence, but") got treated like headers. * Fixed typo which broke subscription acknowledgement message (thanks to janne sinkonen for pointing this out promptly after release). (Anyone who applied my intermediate patch will probably see this one trigger patch'es reversed-patch detector...) * Fixed cgi-wrapper.c so it doesn't segfault when invoked with improper uid or gid, and generally wrappers are cleaned up a bit. * Prevented delivery-failure notices for misdirected subscribe- confirmation requests from bouncing back to the -request addr, and then being treated as failing requests. Implemented two measures. Set the reply-to for the confirmation- request to the -request addr, and the sender to be the list admin. This way, bounces go to list admin instead of to -request addr. (Using the errors-to header wasn't sufficient. Thanks, barry, for pointing out the use of sender here.) Second, ignore any mailcommands coming from postmaster or non-login system type accounts (mailer-daemon, daemon, postoffice, etc.) * Reenabled admin setting of web_page_url - crucial for having lists use alternate names of a host that occupies multiple addresses. * Fixed and refined admin-options help mechanism. Top-level visit to general-category (where the "general" isn't in the URL) was broken. New help presentation shows the same row that shows on the actual options page. * cron/crontab.in crontab template had wrong name for senddigests. * Default digest format setting, as distributed, is now non-MIME, on urging of reasoned voices asserting that there are still enough bad MIME implementations in the world to be a nuisance to too many users if MIME is the default. Sigh. * MIME digests now preserve the structure of MIME postings, keeping attachments as attachments, etc. They also are more structured in general. * Added README instructions explaining how to determine the right UID and GID settings for the wrapper executables, and improved some of the explanations about exploratory interaction w/mailman. * Removed the constraint that subscribers have their domain included in a static list in the code. We might want to eventually reincorporate the check for the sake of a warning message, to give a heads up to the subscriber, but try delivery anyway... - Added missing titles to error docs. - Improved several help details, including particularly explaining better how real_name setting is used. - Strengthened admonition against setting reply_goes_to_list. - Added X-BeenThere header to postings for the sake of prevention of external mail loops. - Improved handling of bounced messages to better recognize members address, and prevent duplicate attempts to react (which could cause superfluous notices to administrator). - Added __delitem__ method to mm_message.OutgoingMessage, to fix the intermediate patch posted just before this one. - Using keyword substitution format for more message text (ie, "substituting %(such)s into text" % {'such': "something"}) to make the substitutions less fragile and, presumably, easier to debug. - Removed hardwired (and failure-prone) /tmp file logging from answer.majordomo_mail, and generally spiffed up following janne sinkkonen's lead. 1.0b2 (04/13/1998) and 1.0b1.1 (04/09/1998): klm (ken manheimer) Web pages much more polished - Better organized, text more finely crafted - Easier, more refined layout - List info and admin interface overviews, enumerate all public lists (via, e.g., http://www.python.org/mailman/listinfo - sans the specific list) - Admin interface broken into sections, with help elaboration for complicated configuration options Maillist Archives - Integrated with a newer, *much* improved, external pipermail - to be found at http://starship.skyport.net/crew/amk/maintained/pipermail.html - Private archives protected with maillist members passwords, cookie-fied. Spam prevention - New spam prevention measures catch most if not all spam without operator intervention or general constraints on who can post to list: require_explicit_destination option imposes hold of any postings that do not have the list name in any of the to or cc header destination addresses. This catches the vast majority of random spam. Other options (forbidden_posters, bounce_matching_headers) provide for filtering of known transgressors. - Option obscure_addresses (default on) causes maillist subscriber lists on the web to be slightly mangled so they're not directly recognizable as email address by web spiders, which might be seeking targets for spammers. Site configuration arrangement organized - in mailman/mailman/modules: - When installing, create a mailman/modules/mm_cfg.py (if there's not one already there), using mm_cfg.py.dist as a template. mm_default.py contains the distributed defaults, including descriptions of the values. mm_cfg.py does a 'from mm_defaults.py import *' to get the distributed defaults. Include settings in mm_cfg.py for any values in mm_defaults.py that need to be customized for your site, after the 'from .. import *'. See mm_cfg.py.dist for more details. Logging - Major operations (subscription, admin approval, bounce, digestification, cgi script failure tracebacks) logged in files using a reliable mechanism - Wrapper executables log authentication complaints via syslog Wrappers - All cgi-script wrapper executables combined in a single source, easier to configure. (Mail and aliases wrappers separate.) List structure version migration - Provision for automatic update of list structures when moving to a new version of the system. See modules/versions.py. Code cleaning - Many more module docstrings, __version__ settings, more function docstrings. - Most unqualified exception catches have been replaced with more finely targeted catches, to avoid concealing bugs. - Lotsa long lines wrapped (pet peeve:). Random details (not complete, sorry): - make archival frequency a list option - Option for daily digest dispatch, in addition to size threshhold - make sure users only get one periodic password notifcation message for all the lists they're on (repaired 1.0b1.1 varying-case mistake) - Fix rmlist sans-argument bug causing deletion of all lists! - doubled generated random passwords to four letters - Cleaned lots and lots of notices - Lots and lots of html page cleanup, including table-of-contents, etc - Admin options sections - don't do the "if so" if the ensuing list is empty - Prevent list subject-prefix cascade - Sources under CVS - Various spam filters - implicit-destination, header-field - Adjusted permissions for group access - Prevent redundant subscription from redundant vetted requests - Instituted centralize, robustish logging - Wrapper sources use syslog for logging (john viega) - Sorting of users done on presentation, not in list. - Edit options - give an error for non-existent users, not an options page. - Bounce handling - offer 'disable' option, instead of remove, and never remove without notifying admin - Moved subscribers off of listinfo (and made private lists visible modulo authentication) - Parameterize default digest headers and footers and create some - Put titles on cgi result pages that do not get titles (all?) - Option for immediate admin notifcation via email of pending requests, as well as periodic - Admin options web-page help - Enabled grouped and cascading lists despite implicit-name constraint - Changed subscribers list so it has its own script (roster) - Welcome pages: http://www.python.org/mailman/{admin,listinfo}/ 0.95: (Jan 25, 1997) - Fixed a bug in sending out digests added when adding disable mime option. - Added an option to not notify about bounced posts. - Added hook for pre-posting filters. These could be used to auto-strip signatures. I'm using the feature to auto-strip footers that are auto-generated by mail received from another mailing list. 0.94: (Jan 22, 1997) - Made admin password work ubiquitously in place of a user password. - Added an interface for getting / setting user options. - Added user option to disable mime digests (digested people only) - Added user option to not receive your own posts (nondigested people only) - Added user option to ack posts - Added user option to disable list delivery to their box. - Added web interface to user options - Config number of sendmail spawns on a per-list basis - Fixed extra space at beginning of each message in digests... - Handled comma separated emails in bounce messages... - Added a FindUser() function to MailList. Used it where appropriate. - Added mail interface to setting list options. - Added name links to the templates options page - Added an option so people can hide their names from the subscription list. - Added an answer_majordomo_mail script for people switching... 0.93: (Jan 18,20 1997) - When delivering to list, don't call sendmail directly. Write to a file, and then run the new deliver script, which forks and exits in the parent immediately to avoid hanging when delivering mail for large lists, so that large lists don't spend a lot of time locked. - GetSender() no longer assumes that you don't have an owner-xxx address. - Fixed unsubscribing via mail. - Made subscribe via mail generate a password if you don't supply one. - Added an option to clobber the date in the archives to the date the list resent the post, so that the archive doesn't get mail from people sending bad dates clumped up at the beginning or end. - Added automatic error message processing as an option. Currently logging to /tmp/bounce.log - Changed archive to take a list as an argument, (the old way was broken) - Remove (ignore) spaces in email addresses - Allow user passwords to be case insensitive. - Removed the cleanup script since it was now redundant. - Fixed archives if there were no archives. - Added a Lock() call to Load() and Create(). This fixes the problem of loading then locking. - Removed all occurances of Lock() except for the ones in maillist since creating a list now implicitly locks it. - Quote single periods in message text. - Made bounce system handle digest users fairly. 0.92: (Jan 13-16 1997) - Added Lock and Unlock methods to list to ensure each operation is atomic - Added a cmd that rms all files of a mailing list (but not the aliases) - Fixed subscribing an unknown user@localhost (confirm this) - Changed the sender to list-admin@... to ensure we avoid mail loops. - check to make sure there are msgs to archive before calling pipermail. - started using this w/ real mailing lists. - Added a cron script that scours the maillog for User/Host unknown errs - Sort membership lists - Always display digest_is_default option - Don't slam the TO list unless you're sending a digest. - When making digest summaries, if missing sender name, use their email. - Hacked in some protection against crappy dates in pipermail.py - Made it so archive/digest volumes can go up monthly for large large lists. - Number digest messages - Add headers/footers to each message in digest for braindead mailers - I removed some forgotten debug statements that caused server errors when a CGI script sent mail. - Removed loose_matches flag, since everything used it. - Fixed a problem in pipermail if there was no From line. - In upvolume_ scripts, remove INDEX files as we leave a volume. - Threw a couple of scripts in bin for generating archives from majordomo's digest-archives. I wouldn't recommend them for the layman, though, they were meant to do a job quickly, not to be usable. 0.91: (Dec 23 1996) - broke code into mixins for managability - tag parsing instead of lots of gsubs - tweaked pipermail (see comments on pipermail header) - templates are now on a per-list basis as intended. - request over web that your password be emailed to you. - option so that web subscriptions require email confirmation. - wrote a first pass at an admin interface to configurable variables. - made digests mime-compliant. - added a FakeFile class that simulates enough of a file object on a string of text to fool rfc822.Message in non-seek mode. - changed OutgoingMessage not to require its args in constructor. - added an admin request DB interface. - clearly separated the internal name from the real name. - replaced lots of ugly, redundant code w/ nice code. (added Get...Email() interfaces, GetScriptURL, etc...) - Wrote a lot of pretty html formatting functions / classes. (Dec 27 1997) - Fleshed out the newlist command a lot. It now mails the new list admin, and auto-updates the aliases file. - Made multiple owners acceptable. - Non-advertised lists, closed lists, max header length, max msg length - Allowed editing templates from list admin pages. - You can get to your info page from the web even if the list is closed. Please be sure to read the README file after downloading. John Viega

1 0

an opinion about using port 25
by Scott 27 Jul '98

27 Jul '98

Something's been bothering me about the use of connecting to port 25 to deliver mail. The goal of this endeavor, if i remember correctly, was to make mailman more portable in it's interface to MTA's. However, I think that it may well make that problem even worse, and that it lies outside what mailman should be doing. Here's the argument: mailman is a mailing list manager, not an MTA. If mailman developers decide to make delivery occur by SMTP, it has to do a LOT of the work that an MTA should be doing: queuing messages, retrying every so often, bouncing messages with appropriate messages under appropriate circumstances (like deferral messages every 4 hours, etc). All this should be the work of the MTA. I also think that it will eventually exacerbate the problems of portability. As a part of test group for a new MTA, and an administrator of a qmail and a sendmail system, I know many work-years of labor goes into making an MTA be able to successfully deliver mail to all the other MTA's out there. This happens because different MTAs act very differently. There are still problems occuring between code as mature as qmail and other MTA's like certain microsoft based products (postoffice, LSOFT for nt, etc). Do we really want to take on that burden? There are other ways we could pursue this. There are basically 2 interfaces to an MTA mailman has to consider: updating aliases and delivering messages. For each of these interfaces, we could create a class hierarchy into which mailman's communication with new MTA's could be easily dropped. Such a structure, coupled with good documentation about how to add support for a new MTA seems to me like it will go further faster than putting a lot of work into SMTP transactions. Such an approach could even include smtp transactions, as a bonus for the daring or those who want mail delivered via a separate machine than the one on which the list manager resides. As far as portability goes, and as far allowing mailman developers to focus on what a list manager should do, i really think that we would do better not depending on a universally reliable way of doing smtp transactions. scott

6 8

[gorgo@caesar.elte.hu: Re: [Mailman-Developers] URGENT!!!! security problems]
by Scott 25 Jul '98

25 Jul '98

-----Forwarded message from Gergely Madarasz <gorgo(a)caesar.elte.hu>----- Found the problem. ValidEmail is called only from AddMember, not from ApprovedAddMember. So the listowner can subscribe invalid addresses. -------------------- mmm... something must not have made it's way into the patches for 1.0b4. my working copy has ValidEmail called in ApprovedAddMember but 1.0b4 does not. don't know if that was my fault or not, but i think adding a ValidEmail call to ApprovedAddMember is the right way to go: it should be harmless when ApprovedAddMember is called from the mail_cmd interface since it's already been called in AddMember, and it does fix the security problem. scott

1 0

URGENT!!!! security problems
by Gergely Madarasz 24 Jul '98

24 Jul '98

Hello! There are BIG security problems with mailman. For example a list administrator can subscribe an "email address" like this with mass subscribe: `touch /tmp/gotcha` Then when someone sends mail to the list, the command is executed... this means any list administrator can get access to user running mailman on the list server. I could not achieve the same when trying to subscribe as a normal user, but i cannot say that it is safe. This needs a very urgent fix. Greg Ps. thanks to Endre Hirling <endre(a)dawn.elte.hu> for pointing this problem out to me -- Madarasz Gergely gorgo(a)caesar.elte.hu gorgo(a)linux.rulez.org It's practically impossible to look at a penguin and feel angry. Egy pingvinre gyakorlatilag lehetetlen haragosan nezni. HuLUG: http://www.cab.u-szeged.hu/local/linux/

3 2

loosing mail
by Gergely Madarasz 20 Jul '98

20 Jul '98

Hello! I'm still loosing digests because mailman wants to use port 25... :( This is a Bad Thing (TM). Any dates about the new release which would fix this? Or is there a patch around for 1.0b4 ? I don't want to switch back to majordomo now :((( -- Madarasz Gergely gorgo(a)caesar.elte.hu gorgo(a)linux.rulez.org It's practically impossible to look at a penguin and feel angry. Egy pingvinre gyakorlatilag lehetetlen haragosan nezni. HuLUG: http://www.cab.u-szeged.hu/local/linux/

4 3

big problems
by Gergely Madarasz 14 Jul '98

14 Jul '98

Hello! Two of my lists arent working. The error log says: Jul 12 16:22:30 1998 post: Traceback (innermost last): post: File "/var/lib/mailman/scripts/mailowner", line 40, in ? post: current_list = maillist.MailList(sys.argv[1]) post: File "/var/lib/mailman/Mailman/maillist.py", line 64, in __init__ post: self.Load() post: File "/var/lib/mailman/Mailman/maillist.py", line 554, in Load post: raise mm_cfg.MMBadListError, 'Failed to unmarshal config info' post: AttributeError : MMBadListError What could have caused this and how do I fix it ? Greg -- Madarasz Gergely gorgo(a)caesar.elte.hu gorgo(a)linux.rulez.org It's practically impossible to look at a penguin and feel angry. Egy pingvinre gyakorlatilag lehetetlen haragosan nezni. HuLUG: http://www.cab.u-szeged.hu/local/linux/

3 5

Re: [Mailman-Developers] Some patch for mailman
by Janne Sinkkonen 14 Jul '98

14 Jul '98

"Dan Ohnesorg, admin on power" <Dan(a)feld.cvut.cz> writes: > I have list with 500 subscribers and 50 mesages per day, when I shall distribute > unwanted parts of this messages, I am worried. It takes many MB, winmail.dat is > many times bigger than mail itself. You can filter on the basis of headers, and reject messages which contain HTML or WINMAIL stuff. We do that and it works well. If you start doing automatically things like removing HTML, there's no end to it. It's better to educate subscribers to behave properly. -- Janne

1 0

Some patch for mailman
by Dan Ohnesorg, admin on power 14 Jul '98

14 Jul '98

Hi everybody, I am plaing with mailman some time (John probaly remebers me) and now I see, that www.list.org is back online. So what I have, I would suggest You patch to verbose funcionality of mailman. All sugestion to my solution are welcome. What it solves, first part of patch to remove irriting headers from messages. I dont like to send messages like RCPT and so. Second uses DSN to send mails. This disables (when enabled) messages like warning, message is not delivered for 4 hours and so. Then comes some removing of winmail.dat binary attachments. I am working on removing all unwanted parts (html, rtf) and translating national characters into ascii, but is not complete yet. Then comes administrativ via filter, but it not works, it worked on mailman 1.0, but I cannot bring it running on b4, You will see, it is probably only a little bug, at least the filter shields list from administrative messages. So it is all for today, I am interested how You will find this patch, please send any comments to my. cheers dan diff -ru mailman-1.0b4/modules/mm_defaults.py mailman-1.0b4.new/modules/mm_defaults.py --- mailman-1.0b4/modules/mm_defaults.py Fri Jun 26 12:41:28 1998 +++ mailman-1.0b4.new/modules/mm_defaults.py Fri Jun 26 18:43:28 1998 @@ -202,3 +202,11 @@ # The Mailman version, also set by configure VERSION = '1.0b4' + +# Remove Microsoft binary attachments +REMOVE_WINMAIL = 1 +WINMAIL_FILTER_START = 'begin 600 WINMAIL\.DAT' +WINMAIL_FILTER_STOP = 'end' + +# Headers which are not useful +FILTER_HEADERS = ['^X-Confirm-Reading-To:','^X-pmrqc:','X-PMFLAGS:','^Return-receipt-to:'] Only in mailman-1.0b4/modules: mm_defaults.py.in diff -ru mailman-1.0b4/modules/mm_deliver.py mailman-1.0b4.new/modules/mm_deliver.py --- mailman-1.0b4/modules/mm_deliver.py Wed Jun 3 15:12:53 1998 +++ mailman-1.0b4.new/modules/mm_deliver.py Fri Jun 26 18:32:35 1998 @@ -135,6 +135,12 @@ msg.headers.append('To: %s\n' % self.GetListEmail()) else: tempfile.template = tmpfile_prefix + 'mailman.' +# Now remove unwanted headers from message + for pat in mm_defaults.FILTER_HEADERS: + try: + del msg[pat] + except: + pass if self.reply_goes_to_list: del msg['reply-to'] msg.headers.append('Reply-To: %s\n' % self.GetListEmail()) diff -ru mailman-1.0b4/modules/mm_message.py mailman-1.0b4.new/modules/mm_message.py --- mailman-1.0b4/modules/mm_message.py Tue Jun 2 04:47:11 1998 +++ mailman-1.0b4.new/modules/mm_message.py Fri Jun 26 18:01:47 1998 @@ -21,7 +21,7 @@ import sys -import rfc822, string, time +import rfc822, string, time, mm_defaults, regex # Utility functions 2 of these classes use: @@ -134,6 +134,24 @@ if (string.lower(self.headers[i][:len(name)+1]) == string.lower(name) + ':'): self.headers[i] = '%s: %s' % (name, value) + + def RemoveWinmail(self): + pattern_start = regex.compile(mm_defaults.WINMAIL_FILTER_START) + pattern_stop = regex.compile(mm_defaults.WINMAIL_FILTER_STOP) + occured = 0 + mybody=[] + mybody=string.split(self.body,'\n'); + for line in mybody[:]: + if occured == 1: + if pattern_stop.match(line) > 0: + occured = 0 + mybody.remove(line) + elif pattern_start.match(line) > 0: + occured = 1 + mybody.remove(line) + self.body=string.join(mybody,'\n') + + # XXX Eventually (1.5.1?) Python rfc822.Message() will have its own # __delitem__. diff -ru mailman-1.0b4/modules/smtplib.py mailman-1.0b4.new/modules/smtplib.py --- mailman-1.0b4/modules/smtplib.py Sat May 30 05:09:21 1998 +++ mailman-1.0b4.new/modules/smtplib.py Wed Jul 1 14:27:23 1998 @@ -20,6 +20,9 @@ # A lot of functionality was borrowed directly from ftplib... # John Viega (viega(a)list.org) +# Hack to use DSN, probably not the best way, but works fine +# But I have no not DSN aware server to check it without DSN + # >>> from smtplib import * # >>> s = SmtpConnection('list.org') # >>> s.helo('adder.cs.virginia.edu') @@ -27,7 +30,7 @@ # >>> s.quit() from socket import * -import string, types +import string, types, regex SMTP_PORT = 25 @@ -38,6 +41,8 @@ error_temp = 'smtplib.error_temp' # 4xx errors error_perm = 'smtplib.error_perm' # 5xx errors error_proto = 'smtplib.error_proto' # response does not begin with [1-5] +error_no_DSN = 'There is no DSN support' +DSN_support = 1 class SmtpConnection: def __init__(self, host=''): @@ -52,8 +57,15 @@ self.getresp() def helo(self, host): - self._sock.send('HELO %s\r\n' % host) - self.getresp() + self._sock.send('EHLO %s\r\n' % host) + try: + vysl = self.getresp() + except error_perm: + self._sock.send('HELO %s\r\n' % host) + self.getresp() + self.DSN_support=0 + if regex.match('.*DSN.*',vysl) == -1: + self.DSN_support=0 def quit(self): self._sock.send('QUIT\r\n') @@ -66,12 +78,16 @@ lines = string.split(text, '\n') self._sock.send('MAIL FROM: %s\r\n' % frm) self.getresp() + if DSN_support: + format = 'RCPT TO: %s NOTIFY=failure\r\n' + else: + format = 'RCPT TO: %s\r\n' if type(to) == types.StringType: - self._sock.send('RCPT TO: %s\r\n' % to) + self._sock.send(format % to) self.getresp() else: for item in to: - self._sock.send('RCPT TO: %s\r\n' % item) + self._sock.send(format % item) self.getresp() self._sock.send('DATA\r\n') self.getresp() diff -ru mailman-1.0b4/scripts/post mailman-1.0b4.new/scripts/post --- mailman-1.0b4/scripts/post Sun May 31 06:48:09 1998 +++ mailman-1.0b4.new/scripts/post Fri Jun 26 18:06:57 1998 @@ -31,7 +31,7 @@ import sys import paths -import maillist, mm_message, mm_err, mm_cfg, mm_utils +import maillist, mm_message, mm_err, mm_cfg, mm_utils, string, mm_defaults try: sys.stderr = mm_utils.StampedLogger("error", label = 'post', @@ -42,6 +42,18 @@ # Only let one program run at once per list. # TODO: This can fail, and should send back an error message when it does. +commands = { + 'subscribe' : '', + 'unsubscribe' : '', + 'who' : '', + 'info' : '', + 'lists' : '', + 'help' : '', + 'set' : '', + 'options' : '', + 'password' : '', + } + current_list = maillist.MailList(sys.argv[1]) if len(sys.argv) > 2: current_list.tmp_prevent_gate = 1 @@ -60,10 +72,41 @@ else: text = sys.stdin.read() msg = mm_message.IncomingMessage(text) + if mm_defaults.REMOVE_WINMAIL: msg.RemoveWinmail() + bad_dest = 0 + subject = msg.getheader("subject") + if subject: + subject = string.strip(subject) + if commands.has_key(string.split(subject)[0]): + bad_dest = 1 + lines = string.split(msg.body, '\n') + if len(lines) >= 10: + hopcnt = range(10) + else: + hopcnt = range(len(lines)) + for i in hopcnt: + try: + string.strip(lines[i]) + except: + pass + if not lines[i]: + continue + args = string.split(lines[i]) + if len(args)>0: + cmd = string.lower(args[0]) + if commands.has_key(cmd): + bad_dest = 1 - try: + if bad_dest: + try: + current_list.ParseMailCommands() + finally: +# current_list.Unlock() + pass + else: + try: current_list.Post(msg) - except mm_err.MMNeedApproval, err_msg: + except mm_err.MMNeedApproval, err_msg: if (current_list.dont_respond_to_post_requests or err_msg == mm_err.MODERATED_LIST_MSG or err_msg == mm_err.IMPLICIT_DEST_MSG ________________________________________ DDDDDD DD DD Dan Ohnesorg, supervisor on POWER DD OOOO Dan(a)feld.cvut.cz DD OODDOO Dep. of Power Engineering DDDDDD OO CVUT FEL Prague, Bohemia OO OO work: +420 2 24352785;+420 2 24972109 OOOO home: +420 311 679679;+420 311 679311 ________________________________________ Pocitac se od televizniho divaka lisi tim, ze ma vlastni program.

2 2

port 25 problem
by Gergely Madarasz 13 Jul '98

13 Jul '98

Hello! I've found another problem... if the cronjob that creates the digest runs at a time when sendmail is down (dunno why but it may happen), then it is lost. It would be nicer if mailman used sendmail directly, and not thru port 25. -- Madarasz Gergely gorgo(a)caesar.elte.hu gorgo(a)linux.rulez.org It's practically impossible to look at a penguin and feel angry. Egy pingvinre gyakorlatilag lehetetlen haragosan nezni. HuLUG: http://www.cab.u-szeged.hu/local/linux/

2 1

A logging bug (and a patch)
by Janne Sinkkonen 13 Jul '98

13 Jul '98

I got these when a listadmin tried to approve/discard messages: Jul 13 12:13:23 1998 admindb: Traceback (innermost last): admindb: File "/home/mailman/scripts/admindb", line 232, in ? admindb: HandleRequests(doc) admindb: File "/home/mailman/scripts/admindb", line 125, in HandleRequests admindb: list.HandleRequest(request, v, form[comment_key].value) admindb: File "/home/mailman/Mailman/mm_admin.py", line 137, in HandleRequest admindb: self.HandlePostRequest(request_data[2:], value, comment) admindb: File "/home/mailman/Mailman/mm_admin.py", line 174, in HandlePostRequ est admindb: self.LogMsg("vette", note) admindb: File "/home/mailman/Mailman/maillist.py", line 570, in LogMsg admindb: logf.write("%s\n" % (msg % args)) admindb: TypeError : not enough arguments for format string The reasons was that one of the messages had '18% grey card' on the subject line. :) Here's patch: --- mm_admin.py~ Thu Jun 4 23:12:28 1998 +++ mm_admin.py Mon Jul 13 12:31:06 1998 @@ -171,6 +171,7 @@ note = note + "\n\tHeld: %s" % data[1] if comment: note = note + "\n\tDiscarded: %s" % comment + note = string.replace(note,'%','%%') self.LogMsg("vette", note) def HandleAddMemberRequest(self, data, value, comment): ... although I'm not sure whether this is a generic enough way to handle the problem. -- Janne

1 0