Mailman 3 December 2002 - Mailman-Developers

[ mailman-Bugs-655079 ] Major security hole.....
by noreply＠sourceforge.net Dec. 18, 2002

Dec. 18, 2002

Bugs item #655079, was opened at 2002-12-17 09:13 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=655079&group_i… Category: security/privacy Group: 2.0.x Status: Closed Resolution: Invalid Priority: 5 Submitted By: Nicolas Weeger (ryo_saeba) Assigned to: Nobody/Anonymous (nobody) Summary: Major security hole..... Initial Comment: Just found a nice security bug: on the main list page, you have 2 fields to enter admin mail & password to view list subscriptions. Well, you can just enter a valid admin password, and it'll work !!! Even if the mail address is blank / invalid !! ---------------------------------------------------------------------- >Comment By: Nicolas Weeger (ryo_saeba) Date: 2002-12-18 08:39 Message: Logged In: YES user_id=303511 Well, granted, but only if the mail is left blank ! I mean, if you put an email address, aren't you supposed to enter YOUR password, not an admin's ? Currently, put an admin password & ANY MAIL and it works... ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2002-12-17 23:52 Message: Logged In: YES user_id=12800 Dan's right, the admin can always read the archives and by design doesn't need to enter an email address. ---------------------------------------------------------------------- Comment By: Dan Mick (dmick) Date: 2002-12-17 23:35 Message: Logged In: YES user_id=10725 It's assumed that if you have the admin password, you're allowed to view the archives. Why is this a security hole? Seems perfectly appropriate to me. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=655079&group_i…

1 0

Search order for obtaining envelope sender address
by Mark Martinec Dec. 18, 2002

Dec. 18, 2002

Hi, I'm new to the developers list, but not new to Mailman, being happy with it since pre-v1 version. Just installed 2.1b6, and I have a Christmas wish that I kept unexpressed ever since v2 came out and broke the old behaviour that I liked, and is the only one that realiably works here - namely: Setting the mm_cfg.USE_ENVELOPE_SENDER gives us only two options: namely the search order Sender:, From:, unixfrom, or From:, Sender:, unixfrom. I have to patch Mesage.py/get_sender for every new version that I install, to make unixfrom override the other two header fields. Please consider either giving USE_ENVELOPE_SENDER a multivalued choice, or to provide some other variable or mechanism to specify search order for obtaining sender address. I hope I didn't miss something that already makes this possible. Best regards Mark -- !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! Mark Martinec (system manager) tel +386 1 4773-575 !! !! J. Stefan Institute, Jamova 39 fax +386 1 2519-385 !! !! SI-1000 Ljubljana, Slovenia mark.martinec(a)ijs.si !! !!!!!!!!!!!!!!!!!!!!!!!!!! http://www.ijs.si/people/mark/ !!!!

1 0

[ mailman-Bugs-655079 ] Major security hole.....
by noreply＠sourceforge.net Dec. 17, 2002

Dec. 17, 2002

Bugs item #655079, was opened at 2002-12-17 03:13 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=655079&group_i… Category: security/privacy Group: 2.0.x >Status: Closed >Resolution: Invalid Priority: 5 Submitted By: Nicolas Weeger (ryo_saeba) Assigned to: Nobody/Anonymous (nobody) Summary: Major security hole..... Initial Comment: Just found a nice security bug: on the main list page, you have 2 fields to enter admin mail & password to view list subscriptions. Well, you can just enter a valid admin password, and it'll work !!! Even if the mail address is blank / invalid !! ---------------------------------------------------------------------- >Comment By: Barry A. Warsaw (bwarsaw) Date: 2002-12-17 17:52 Message: Logged In: YES user_id=12800 Dan's right, the admin can always read the archives and by design doesn't need to enter an email address. ---------------------------------------------------------------------- Comment By: Dan Mick (dmick) Date: 2002-12-17 17:35 Message: Logged In: YES user_id=10725 It's assumed that if you have the admin password, you're allowed to view the archives. Why is this a security hole? Seems perfectly appropriate to me. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=655079&group_i…

1 0

[ mailman-Bugs-655079 ] Major security hole.....
by noreply＠sourceforge.net Dec. 17, 2002

Dec. 17, 2002

Bugs item #655079, was opened at 2002-12-17 08:13 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=655079&group_i… Category: security/privacy Group: 2.0.x Status: Open Resolution: None Priority: 5 Submitted By: Nicolas Weeger (ryo_saeba) Assigned to: Nobody/Anonymous (nobody) Summary: Major security hole..... Initial Comment: Just found a nice security bug: on the main list page, you have 2 fields to enter admin mail & password to view list subscriptions. Well, you can just enter a valid admin password, and it'll work !!! Even if the mail address is blank / invalid !! ---------------------------------------------------------------------- Comment By: Dan Mick (dmick) Date: 2002-12-17 22:35 Message: Logged In: YES user_id=10725 It's assumed that if you have the admin password, you're allowed to view the archives. Why is this a security hole? Seems perfectly appropriate to me. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=655079&group_i…

1 0

[ mailman-Patches-655214 ] Fix archiving
by noreply＠sourceforge.net Dec. 17, 2002

Dec. 17, 2002

Patches item #655214, was opened at 2002-12-17 15:49 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=655214&group_i… Category: Pipermail Group: Mailman 2.1 Status: Open Resolution: None Priority: 5 Submitted By: Martin v. Löwis (loewis) Assigned to: Nobody/Anonymous (nobody) Summary: Fix archiving Initial Comment: This patch restores MIME charset capabilities for article archiving in CVS mailman. It: - removes the .charset attribute from articles; all articles are encoded in the list's charset, - decodes subject and author to Unicode; if this fails, no decoding (not even MIME) is done to subject and author, - MIME-decodes the body in the constructor using get_payload, removes the hand-crafted qp decoding from _get_body, - Unicode-decodes the body in the constructor if the body's charset differs from the list's charset, - fixes processbody_URLquote to always return byte strings (by escaping the URL also); comparing the old and the new string is no longer possible since the old string is Unicode and the new string is a list-encoded byte string. - changes text archiving to have the archives in the list's encoding, with unsupported characters 'replace'd - Fixes a bug in the scrubber, where a content-transfer-encoding might have survived flattening of the message. With these changes, I can process the playground archives correctly, to get mojibake-free pages. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=655214&group_i…

1 0

[ mailman-Bugs-655144 ] Setting language through config_list
by noreply＠sourceforge.net Dec. 17, 2002

Dec. 17, 2002

Bugs item #655144, was opened at 2002-12-17 13:13 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=655144&group_i… Category: command line scripts Group: 2.1 beta Status: Open Resolution: None Priority: 5 Submitted By: Martin v. Löwis (loewis) Assigned to: Nobody/Anonymous (nobody) Summary: Setting language through config_list Initial Comment: I tried changing a list's preferred_language through config_list, and got this traceback Traceback (most recent call last): File "config_list", line 336, in ? main() File "config_list", line 331, in main do_input(listname, infile, checkonly, verbose) File "config_list", line 283, in do_input gui._setValue(mlist, k, validval, fakedoc) File "/home/mailman/Mailman/Gui/Language.py", line 121, in _setValue doc.set_language(val) ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=655144&group_i…

1 0

[ mailman-Bugs-655079 ] Major security hole.....
by noreply＠sourceforge.net Dec. 17, 2002

Dec. 17, 2002

Bugs item #655079, was opened at 2002-12-17 09:13 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=655079&group_i… Category: security/privacy Group: 2.0.x Status: Open Resolution: None Priority: 5 Submitted By: Nicolas Weeger (ryo_saeba) Assigned to: Nobody/Anonymous (nobody) Summary: Major security hole..... Initial Comment: Just found a nice security bug: on the main list page, you have 2 fields to enter admin mail & password to view list subscriptions. Well, you can just enter a valid admin password, and it'll work !!! Even if the mail address is blank / invalid !! ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=655079&group_i…

1 0

RE: [Mailman-Developers] Personalization question
by Mike Burton Dec. 17, 2002

Dec. 17, 2002

Hi Mick, I take it I didn't make myself perfectly clear. I understand that this is issued per user (thus the name personalization). At the bottom of my lists mails it reads (using user_optionsurl) http://jo.birdsense.com/mailman/options/[listname]/mburton%40jo.birdsens e.com - this is my mail systems address (jo.birdsense.com). What I would expect is http://www.birdsense.com/mailman/options/[listname]/mburton%40jo.birdsen se.com which is my web server's address. Note the www instead of jo in the address. This is what is shown at the bottom of the mailman-users list mails - http://mail.python.org/mailman/options/mailman-users/mburton%40jo.birdse nse.com. Again I would suspect that it might want to read www.python.org instead of mail.python.org, although I am not sure of this one as I am not the admin for that system and really don't know how they have it setup and configured. Am I completely missing something here? Are my expectations that it would use the web server's address unreasonable? Thanks, Mike > -----Original Message----- > From: Dan Mick [mailto:Dan.Mick@sun.com] > Sent: Monday, December 16, 2002 3:00 PM > To: Mike Burton > Subject: Re: [Mailman-Developers] Personalization question > > > Mike Burton wrote: > > > Is there a reason that user_optionsurl returns the mailers > address and > > domain instead of the web sites address and domain? Is > this intentional > > or should a bug report be generated on this? If it's > intentional, what > > is the reasoning? > > I guess I don't quite understand; the whole point of "the > user's options" > is that it's per-user, yes...what would you expect?...

2 1

Personalization question
by Mike Burton Dec. 16, 2002

Dec. 16, 2002

Is there a reason that user_optionsurl returns the mailers address and domain instead of the web sites address and domain? Is this intentional or should a bug report be generated on this? If it's intentional, what is the reasoning? Take care, Mike

1 0

Mailman/eVote collaboration
by Marilyn Davis Dec. 15, 2002

Dec. 15, 2002

Hello Mailman developers, I don't get to work on the port to Mailman as much as I'd like to because I'm preparing to teach my first Python course in January! What a brilliant language! But, I do have it all working together now, and very nicely. A complicated part was coordinating the nomail feature with eVote. eVote has a "vacation" feature that puts the ballot on hold while the name is taken off the majordomo list. While on vacation, votes are not accepted because that would break the security that eVote's vote receipt gives. To come back from vacation, when using the eVote feature, you have to send a random-keyed confirmation message. But, with mailman, I'm disabling eVote's vacation feature and telling users to set 'nomail'. And when 'nomail' is set, this info is communicated to eVote, via a hack, so that votes aren't accepted. eVote sends a message acknowledging this change in status, which is redundant with mailman's acknowledgment. eVote also sends the acknowledgment to the list's owner, so that the owner is aware of who is voting and who is not. So there's some duplication of acknowledgments there. I could stop it but I'd rather stop the mailman acknowledgment because it happens when only half the job is done, the mailman half. So, I'll just leave both acknowledgments -- unless someone talks me into another point of view. Mostly, this is just a status report, unless someone has a thought. Next, I have to fix up an installation script and release the bundle. Marilyn Davis

1 0