Mailman 3 May 2002 - Mailman-Developers

MimeDel.py: after filtering, munge text/plain's back together
by Dan Mick May 21, 2002

May 21, 2002

I've been playing with MimeDel (Content filtering), and have come to the conclusion that two things need to happen: 1) there needs to be a way to set "only allow text" or "only allow text/plain" without enumerating each type you *don't* want, and 2) at the end of filtering, there needs to be a check to see if all the remaining parts can profitably be recombined into one part, at least for text/plain. Here's a hack at doing #2 (so that, for instance, messages with HTML alternatives end up being one big text/plain message, even with headers and footers turned on). #1 takes a new attribute and some GUI stuff, so I'll try to sell that back to Barry directly. Note: this diff is hand-hacked (as I have my partial #1 solution in there too) so you may have to hand-apply this if you want to play with it. Comments welcome. Index: MimeDel.py =================================================================== RCS file: /cvsroot/mailman/mailman/Mailman/Handlers/MimeDel.py,v retrieving revision 2.1 diff -u -r2.1 MimeDel.py --- MimeDel.py 18 Apr 2002 20:46:53 -0000 2.1 +++ MimeDel.py 16 May 2002 04:13:32 -0000 @@ -91,12 +92,16 @@ # Now perhaps convert all text/html to text/plain if mlist.convert_html_to_plaintext and mm_cfg.HTML_TO_PLAIN_TEXT_COMMAND: changedp += to_plaintext(msg) + # Now, scan through all parts, and if only text/plain left, fuse + # them all back together into one payload + collapse_textplain(msg) + if changedp: msg['X-Content-Filtered-By'] = 'Mailman/MimeDel %s' % VERSION @@ -138,6 +146,23 @@ newpayload.append(subpart) msg.set_payload(newpayload) +def collapse_textplain(msg): + if not msg.is_multipart(): + return + for subpart in msg.get_payload(): + if subpart.get_type() != 'text/plain': + return + # ok, all parts are text/plain; munge 'em together + newpayload = "" + for subpart in msg.get_payload(): + if len(newpayload): + newpayload += '\n' + newpayload += subpart.get_payload() + if newpayload[-1] != '\n': + newpayload += '\n' + msg.set_payload(newpayload) + msg.set_type("text/plain")

3 2

[ mailman-Patches-558515 ] sendmail.py patch for security
by noreply＠sourceforge.net May 21, 2002

May 21, 2002

Patches item #558515, was opened at 2002-05-21 02:31 You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=300103&aid=558515&group_id… Category: mail delivery Group: Mailman 2.0.x Status: Open Resolution: None Priority: 5 Submitted By: Peter D. Gray (pdg999) Assigned to: Nobody/Anonymous (nobody) Summary: sendmail.py patch for security Initial Comment: This is an updated Sendmail.py which avoids popen etc and is therefore (hopefully) secure. ---------------------------------------------------------------------- You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=300103&aid=558515&group_id…

1 0

[ mailman-Feature Requests-558419 ] List-specific external handlers for MIME
by noreply＠sourceforge.net May 20, 2002

May 20, 2002

Feature Requests item #558419, was opened at 2002-05-20 20:02 You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=350103&aid=558419&group_id… Category: None Group: None Status: Open Resolution: None Priority: 5 Submitted By: Daniel Keshet (dkesh) Assigned to: Nobody/Anonymous (nobody) Summary: List-specific external handlers for MIME Initial Comment: The MIME-handler should be able to hand off selected MIME types to an external handler, specified on a per-list basis, instead of deleting them. That way, site admins could write filters that post attachments to a website or filter them appropriately. The external handler could submit back new content to be included in the mail, e.g. a website to visit for the attachment or a warning that an attachment had been removed. ---------------------------------------------------------------------- You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=350103&aid=558419&group_id…

1 0

Usenet Gateway question...
by Steve Williams May 20, 2002

May 20, 2002

I'm currently using 2.0.1 and I'm having an interesting usenet issue. I've recently had to switch ISP's and now my stupid newsfeed requires authentication. Is there any way in Mailman to allow for that, or is there the possibility of a quick-fix? I've done a lot of customizations to it so I'm kind of trying to avoid upgrading (in case someone tells me that's the solution) unless I really have to. I apologize if this has already been asked. I checked the archives but didn't see anything, however given the amount of data I was wading through I admit the possibility that I missed it. Thanks in advance, -Steve

1 0

RELEASED Mailman 2.0.11
by barry＠zope.com May 20, 2002

May 20, 2002

I'm announcing the release of Mailman 2.0.11 which fixes two cross-site scripting exploits, one reported by "office" in the admin login page, and another reported by Tristan Roddis in the Pipermail index summaries. It is recommended that all sites upgrade their 2.0.x systems to this version. As usual, I've made both full source tarballs and patches available. See http://sourceforge.net/project/showfiles.php?group_id=103 for links to download all the patches and the source tarball. If you decide to install the patches, please do read the release notes first: http://sourceforge.net/project/shownotes.php?release_id=63042 See also: http://www.gnu.org/software/mailman http://www.list.org http://mailman.sf.net Cheers, -Barry

1 0

[ mailman-Bugs-558208 ] Unescaped HTML in subject lines
by noreply＠sourceforge.net May 20, 2002

May 20, 2002

Bugs item #558208, was opened at 2002-05-20 06:16 You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=100103&aid=558208&group_id… >Category: Pipermail >Group: 2.0.x >Status: Closed >Resolution: Fixed >Priority: 7 Submitted By: Tristan Roddis (tristan_roddis) Assigned to: Nobody/Anonymous (nobody) Summary: Unescaped HTML in subject lines Initial Comment: Currently (in 2.0.x and up to 2.1b2), then the archive index pages do not escape HTML in the subject lines of posts. This exposes the possibility of malicious or annoying list members being able to invoke cross site javascript on the index pages, or simply corrupt the archive display by adding HTML fragments (e.g. ' without a corresponding ') The fix is extremely simple, just edit the file /home/mailman/Mailman/Archiver/HyperArch.py so that the function write_index_entry() (which starts at or near line 882 in v2.06) so that its last line reads as follows: print index_entry_template % (urllib.quote (article.filename), html_quote (subject), article.sequence, author) [i.e. add the crucial html_quote() function around the subject] Hope that helps, -Tristan. ---------------------------------------------------------------------- >Comment By: Barry Warsaw (bwarsaw) Date: 2002-05-20 11:10 Message: Logged In: YES user_id=12800 Fixed in MM2.0.11 ---------------------------------------------------------------------- Comment By: Barry Warsaw (bwarsaw) Date: 2002-05-20 11:10 Message: Logged In: YES user_id=12800 I'm re-opening this but moving it to the bugs tracker. I believe MM2.0.10 is vulnerable to this attack and the fix is simple. MM2.1b2 is not vulnerable because if you look at line 859 in HyperArch.py, you'll see that the subject and author fields are always CGIescape()'d. ---------------------------------------------------------------------- Comment By: Tristan Roddis (tristan_roddis) Date: 2002-05-20 09:47 Message: Logged In: YES user_id=549463 I've just had a look, and the offending line is still there in the file HyperArch.py for both versions (line number 882 in 2.10, and line 862 from both the mailman2.1b2.tar archive and the latest CVS). Note that there was never this problem with the subject lines for each individual article - it's only the index pages that are missing the HTML quoting function. HTH, -T. ---------------------------------------------------------------------- Comment By: Barry Warsaw (bwarsaw) Date: 2002-05-20 09:26 Message: Logged In: YES user_id=12800 I believe this report is out of date. All known cross-site scripting attacks have been fixed as of MM2.0.10 and I don't believe MM2.1b2 is vulnerable. I double checked the code in each version and indeed both versions make sure to quote any html in subjects. Can you please double check the latest versions (2.0.10 and 2.1cvs). ---------------------------------------------------------------------- You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=100103&aid=558208&group_id…

1 0

[ mailman-Bugs-558208 ] Unescaped HTML in subject lines
by noreply＠sourceforge.net May 20, 2002

May 20, 2002

Bugs item #558208, was opened at 2002-05-20 06:16 You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=100103&aid=558208&group_id… >Category: None >Group: None >Status: Open Resolution: Out of Date Priority: 5 Submitted By: Tristan Roddis (tristan_roddis) Assigned to: Nobody/Anonymous (nobody) Summary: Unescaped HTML in subject lines Initial Comment: Currently (in 2.0.x and up to 2.1b2), then the archive index pages do not escape HTML in the subject lines of posts. This exposes the possibility of malicious or annoying list members being able to invoke cross site javascript on the index pages, or simply corrupt the archive display by adding HTML fragments (e.g. ' without a corresponding ') The fix is extremely simple, just edit the file /home/mailman/Mailman/Archiver/HyperArch.py so that the function write_index_entry() (which starts at or near line 882 in v2.06) so that its last line reads as follows: print index_entry_template % (urllib.quote (article.filename), html_quote (subject), article.sequence, author) [i.e. add the crucial html_quote() function around the subject] Hope that helps, -Tristan. ---------------------------------------------------------------------- >Comment By: Barry Warsaw (bwarsaw) Date: 2002-05-20 11:10 Message: Logged In: YES user_id=12800 I'm re-opening this but moving it to the bugs tracker. I believe MM2.0.10 is vulnerable to this attack and the fix is simple. MM2.1b2 is not vulnerable because if you look at line 859 in HyperArch.py, you'll see that the subject and author fields are always CGIescape()'d. ---------------------------------------------------------------------- Comment By: Tristan Roddis (tristan_roddis) Date: 2002-05-20 09:47 Message: Logged In: YES user_id=549463 I've just had a look, and the offending line is still there in the file HyperArch.py for both versions (line number 882 in 2.10, and line 862 from both the mailman2.1b2.tar archive and the latest CVS). Note that there was never this problem with the subject lines for each individual article - it's only the index pages that are missing the HTML quoting function. HTH, -T. ---------------------------------------------------------------------- Comment By: Barry Warsaw (bwarsaw) Date: 2002-05-20 09:26 Message: Logged In: YES user_id=12800 I believe this report is out of date. All known cross-site scripting attacks have been fixed as of MM2.0.10 and I don't believe MM2.1b2 is vulnerable. I double checked the code in each version and indeed both versions make sure to quote any html in subjects. Can you please double check the latest versions (2.0.10 and 2.1cvs). ---------------------------------------------------------------------- You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=100103&aid=558208&group_id…

1 0

[ mailman-Patches-558208 ] Unescaped HTML in subject lines
by noreply＠sourceforge.net May 20, 2002

May 20, 2002

Patches item #558208, was opened at 2002-05-20 10:16 You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=300103&aid=558208&group_id… Category: Pipermail Group: Mailman 2.0.x Status: Closed Resolution: Out of Date Priority: 5 Submitted By: Tristan Roddis (tristan_roddis) Assigned to: Nobody/Anonymous (nobody) Summary: Unescaped HTML in subject lines Initial Comment: Currently (in 2.0.x and up to 2.1b2), then the archive index pages do not escape HTML in the subject lines of posts. This exposes the possibility of malicious or annoying list members being able to invoke cross site javascript on the index pages, or simply corrupt the archive display by adding HTML fragments (e.g. ' without a corresponding ') The fix is extremely simple, just edit the file /home/mailman/Mailman/Archiver/HyperArch.py so that the function write_index_entry() (which starts at or near line 882 in v2.06) so that its last line reads as follows: print index_entry_template % (urllib.quote (article.filename), html_quote (subject), article.sequence, author) [i.e. add the crucial html_quote() function around the subject] Hope that helps, -Tristan. ---------------------------------------------------------------------- >Comment By: Tristan Roddis (tristan_roddis) Date: 2002-05-20 13:47 Message: Logged In: YES user_id=549463 I've just had a look, and the offending line is still there in the file HyperArch.py for both versions (line number 882 in 2.10, and line 862 from both the mailman2.1b2.tar archive and the latest CVS). Note that there was never this problem with the subject lines for each individual article - it's only the index pages that are missing the HTML quoting function. HTH, -T. ---------------------------------------------------------------------- Comment By: Barry Warsaw (bwarsaw) Date: 2002-05-20 13:26 Message: Logged In: YES user_id=12800 I believe this report is out of date. All known cross-site scripting attacks have been fixed as of MM2.0.10 and I don't believe MM2.1b2 is vulnerable. I double checked the code in each version and indeed both versions make sure to quote any html in subjects. Can you please double check the latest versions (2.0.10 and 2.1cvs). ---------------------------------------------------------------------- You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=300103&aid=558208&group_id…

1 0

[ mailman-Patches-558208 ] Unescaped HTML in subject lines
by noreply＠sourceforge.net May 20, 2002

May 20, 2002

Patches item #558208, was opened at 2002-05-20 06:16 You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=300103&aid=558208&group_id… Category: Pipermail Group: Mailman 2.0.x >Status: Closed >Resolution: Out of Date Priority: 5 Submitted By: Tristan Roddis (tristan_roddis) Assigned to: Nobody/Anonymous (nobody) Summary: Unescaped HTML in subject lines Initial Comment: Currently (in 2.0.x and up to 2.1b2), then the archive index pages do not escape HTML in the subject lines of posts. This exposes the possibility of malicious or annoying list members being able to invoke cross site javascript on the index pages, or simply corrupt the archive display by adding HTML fragments (e.g. ' without a corresponding ') The fix is extremely simple, just edit the file /home/mailman/Mailman/Archiver/HyperArch.py so that the function write_index_entry() (which starts at or near line 882 in v2.06) so that its last line reads as follows: print index_entry_template % (urllib.quote (article.filename), html_quote (subject), article.sequence, author) [i.e. add the crucial html_quote() function around the subject] Hope that helps, -Tristan. ---------------------------------------------------------------------- >Comment By: Barry Warsaw (bwarsaw) Date: 2002-05-20 09:26 Message: Logged In: YES user_id=12800 I believe this report is out of date. All known cross-site scripting attacks have been fixed as of MM2.0.10 and I don't believe MM2.1b2 is vulnerable. I double checked the code in each version and indeed both versions make sure to quote any html in subjects. Can you please double check the latest versions (2.0.10 and 2.1cvs). ---------------------------------------------------------------------- You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=300103&aid=558208&group_id…

1 0

[ mailman-Patches-558208 ] Unescaped HTML in subject lines
by noreply＠sourceforge.net May 20, 2002

May 20, 2002

Patches item #558208, was opened at 2002-05-20 10:16 You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=300103&aid=558208&group_id… Category: Pipermail Group: Mailman 2.0.x Status: Open Resolution: None Priority: 5 Submitted By: Tristan Roddis (tristan_roddis) Assigned to: Nobody/Anonymous (nobody) Summary: Unescaped HTML in subject lines Initial Comment: Currently (in 2.0.x and up to 2.1b2), then the archive index pages do not escape HTML in the subject lines of posts. This exposes the possibility of malicious or annoying list members being able to invoke cross site javascript on the index pages, or simply corrupt the archive display by adding HTML fragments (e.g. ' without a corresponding ') The fix is extremely simple, just edit the file /home/mailman/Mailman/Archiver/HyperArch.py so that the function write_index_entry() (which starts at or near line 882 in v2.06) so that its last line reads as follows: print index_entry_template % (urllib.quote (article.filename), html_quote (subject), article.sequence, author) [i.e. add the crucial html_quote() function around the subject] Hope that helps, -Tristan. ---------------------------------------------------------------------- You can respond by visiting: http://sourceforge.net/tracker/?func=detail&atid=300103&aid=558208&group_id…

1 0