Mailman 3 December 2005 - Mailman-Developers

PHP Wrappers?
by Adrian Wells 17 Mar '06

17 Mar '06

Hello. How might one configure Mailman (version 2.1.6) list settings using PHP scripts? The goal is to configure Mailman list settings such as domain name of list, non-digest footer, set welcome/goodbye messages, etc. An approach that comes to mind is to use bin/config_list. This would require writing/reading files and using bin/config_list to process them. Is there another recommended or preferred way to accomplish this? There was a post about "PHP Wrappers" which suggested, "...just use a setuid mailman wrapper script that does caller-checking to see if it's called correctly, by the right user, and with 'safe' values" <http://mail.python.org/pipermail/mailman-developers/2001-March/008421.html>. This was recommended over simply adding the www user to the mailman group. I do not completely understand how one creates a setuid mailman wrapper script. Is this a matter of creating something similar to mail-wrapper.c? If someone has written a wrapper script or has some good resources further explaining this to share and is willing to do so, I would appreciate it. Thank you, -Adrian

16 64

XMLRPC Patch
by Joshua Ginsberg 13 Feb '06

13 Feb '06

I'm developing a patch to add an XMLRPC-based management interface to Mailman. Would this be something that you would be interested in trying to incorporate in the 2.1.x branch? Thanks! -jag -- Joshua Ginsberg <jag(a)fsf.org> Free Software Foundation - Senior Systems Administrator

5 14

A better way of doing templates?
by Barry Warsaw 10 Jan '06

10 Jan '06

Jordi Mallach brings up a good point on the rosetta-users mailing list, in response to my queries there. Rosetta doesn't really work with non-po files, so the fact that we have templates that need translating will cause us some grief. Well, even more grief than it has over the years. ;) Does anybody have any good ideas for handling this in the Mailman 2 tree? For MM3, it's a top priority that any templating system we use must support po-ification for i18n. For Mailman 2.2 it's more difficult because I don't think we should adopt an entirely new template system. It's even worse for 2.1 because we're not accepting new features, although if we came up with something simple and minimally disruptive, I'd consider it for the benefit of improving the translation process. Ideas are welcome! -Barry

5 7

On allowing any list member to be an email moderator
by R. Bernstein 03 Jan '06

03 Jan '06

Note: the basic info of the below feature request has been posted here: http://sourceforge.net/tracker/index.php?func=detail&aid=1394592&group_id=1… I received an weird but interesting weird email the other day that got me thinking about moderation of GNU mailing lists. Here's a paraphrase the email: To: Moderator Slacker Subject: Bug-slacker-project post from xxx(a)gnu.org requires approval As list administrator, your authorization is requested ... [you know rest] [mail message] Dear Slacker: We've rather belatedly realized that a you've been ignoring the moderation messages of your mailing list which now has hundreds or thousands of held messages and/or a whole lot of spam in the archives. If you would like to volunteer to take out the trash for this or *any* of the 25 or so lists mentioned below, please email me. Although somehow I don't think there are going to be too many takers of this fabulous offer, the email does have I think one useful idea in it. Basically for any slacker-moderated list, it's probably okay to let just about anyone do the moderation. After all, just about any human can easily detect spam from legitimate posts. As someone who's been doing GPL projects for a long time, things have been getting tougher. In the good old days, one gave an email address for support and the email address was used for support on the project. Nowadays the email address is used to send viruses, spam and phishing requests, and to use as the return address for viruses, and spam to others. Okay. So now this moderation thing on mailing lists was then added. That then gave the person offering support the additional burden to act as a trash man for the list (in addition to his/her own personal increased spam/viruses). The thing that always struck me as wrong about moderated lists is that for the convenience of the poster --- and often this is someone who is a novice asking for help (and sometimes in a not even in a very respectful way) -- burden is usually put on the people who might be able to help. I think of this as the N to one burden problem: a little burden (by not having to register to post) is reduced on N people (often novices), at the expense of adding N times extra burden on the "moderator(s)" (someone who is often an expert and is 1 in number). It strikes me as a poor use of the expert's time. Actually, I'm probably not the only one who feels that way, hence the result cited above. So it might be nice to have a box or flag for such a mailing list that allows anyone who is registered in the mailing list have the pleasure of doing email moderation. I suppose this could be subject for abuse too (discard valid posts and accept spam), but I have a feeling that to first order approximaton this would be a big help. And doesn't mailman already have ways of watching users or moderators, and revoking moderation by the administrator or whatnot? Thanks for considering this.

7 33

RELEASED Mailman 2.1.7
by Tokio Kikuchi 01 Jan '06

01 Jan '06

I'm pleased to announce the release of GNU Mailman 2.1.7. This is a significant release, which includes security enhancement fixes, a new language (ia: Interlingua) support, a couple of new features, and many bug fixes. Mailman is free software for managing email mailing lists and e-newsletters. This release enhances the fixes for CAN-2005-0202 and CVE-2005-3573 which were fixed in mailman release 2.1.6, and reduces the chance of list admin privilege abuse. Because of these and other fixes, it is highly recommended that all sites update to 2.1.7. For more information, see: http://mailman.sourceforge.net/ For links to download the Mailman 2.1.7 source tarball, see: http://sourceforge.net/project/showfiles.php?group_id=103 Best regards and a happy new year! -- Tokio Kikuchi

2 3

OpenID login for Mailman
by Dag Arneson 30 Dec '05

30 Dec '05

Hello Mailman Developers. I'm in the process of writing a patch to allow users and site admins to log in using OpenID, a protocol using browser redirects for delegating authentication to a special site, using a URL as an identifier. (see www.openidenabled.com and/or www.openid.net for more info) I downloaded 2.1.7rc1 and I have been investigating what it will take to write this patch. I have had trouble connecting to the cvs server, "cvs [login aborted]: reading from server: Connection reset by peer" or I would be looking at the latest cvs. Anyhow... I noticed the two modules MemberAdaptor.py and OldStyleMemberships.py, the latter of which contains an implementation while the former does not. It appears that the membership system is in some sort of transition, and I wondered what the plans were, and how I could help, especially to make it easier to use OpenID or other similar systems. Dag Arneson JanRain Inc.

1 0

[Mailman-Users] Released: Mailman 2.1.7b1
by Tokio Kikuchi 23 Dec '05

23 Dec '05

Hi all, I've just released Mailman 2.1.7rc1 Release Candidate. I'm sorry for the violation of file name extension convention because I made a small mistake when tagging the release number. I will be releasing 2.1.7 final by December 31 if there is no problem. Please download it from SF or: http://mm.tkikuchi.net/mailman-2.1.7rc1.tar.gz Cheers, Tokio ------------------------------------------------------- 2.1.7rc1 (24-Dec-2005) Security - The fix for CAN-2005-0202 has been enhanced to issue an appropriate message instead of just quietly dropping ./ and ../ from URLs. - A note on CVE-2005-3573: Although the RFC2231 bug example in the CVE has been solved in mailman-2.1.6, there may be more cases where ToDigest.send_digests() can block regular delivery. We put the send_digests() calling part in try - except clause and leave a message in the error log if something happened in send_digests(). Daily call of cron/senddigests will notify more detail to the site administrator. - List administrators can no longer change the user's option/subscription globally. Site admin can change these only if mm_cfg.ALLOW_SITE_ADMIN_COOKIES is set to Yes. - Script tag is disallowd in edithtml script. - Since probe message for the disabled users may reach unexpected persons, the password was excluded from sendProbe() and probe.txt. Note that the default value of VERP_PROBE has been set to `No' from 2.1.6., thus this change doesn't change the default behavior. New Features - Always remove DomainKey (and similar) headers (1287546) from messages sent to the list. - List owners can customize content filter behavior as not to collapse multipart/alternative to its first content. This allows HTML part to pass through after other content filtering is done. Internationalization - New language: Interlingua. Bug fixes and other patches - Defaults.py.in: SCRUBBER_DONT_USE_ATTACHMENT_FILENAME is set to True for safer operation. - Fix Scrubber.py mungs quoted-printable bug with introducing 'X-Mailman-Scrubbed' header for marking that the payload is scrubber-munged. The flag is referenced in ToDigest.py, ToArchive.py, Decorate.py and Archiver. Similar problem in ToDigest.py where the plain digest is generated is also fixed. - Fix Syslog.py to write quopri encoded message when it fail to write 8-bit characters. - Fix MTA/Postfix.py to check aliases group permission in check_perms and fix mailman-install document on this matter (1378270). - Fix private.py to go to the original URL after authorization (1080943). - Fix bounce log score messages to be more consistent. - Fix bin/remove_members to accept no arguments when both --fromall and --file= options are specified. - Change cgi-bin and mail wrapper "group not found" error message to be more descriptive of the actual problem. - Apply the list's ban_list to address changes and admin mass subscribe and invite and to confirmations/approvals of address changes, subscriptions and invitations. - Decode quoted-printable and base64 encoded parts before passing to HTML_TO_PLAIN_TEXT_COMMAND (1367783). - Remove Approve: header from post - treat as Approved: (1355707). - Stop removing line following Approve(d): line in body of post (1318883). - Remove Approve(d): <password> from all text/* parts in addition the initial text/plain part. It still must be the first non-blank line in the first text/plain part or it won't be found or removed at all (1181161). - Log post in post log with true sender, not listname-bounces (1287921). - Correctly initialize and remember the list's default_member_moderation attribute in the web list creation page (1263213). - Add PEP263 charset in config_list output (1343100). - header_filter_rules get lost if accessed directly and needed authenti- cation by login page (1230865). - Obscure email when the poster doesn't set full name in 'From:' header. - Take preambles and epilogues into account when calculating message sizes for holding purposes (Mark Sapiro). - Logging/Logger.py unicode transform option (1235567). - bin/update crashes with bogus files (949117). - Bugs and patches: 1212066/1301983 (Date header in create/remove notice)

1 1

Re: [Mailman-Developers] [Mailman-Users] filename too long error - stopping list
by Tokio Kikuchi 23 Dec '05

23 Dec '05

Hi Michael, You can set Scrubber.py not to use the orginal filename in the message by adding followin line in mm_cfg.py (mailman-2.1.6 and above). SCRUBBER_DONT_USE_ATTACHMENT_FILENAME = True Developers, May be we should set this default in Defaults.py.in in the next release of 2.1.7. Thoughts? Michael Rasmussen wrote: > Resolved. The digest keeps a seperate mbox file at > {MMDIR}lists/LISTNAME/digest.mbox removing the email from that location > was the solution to my immediate problem. > > This does expose a DOS attack potential for MM lists. The too long > attachment name needs to be handled in a more graceful manner. > > Michael Rasmussen wrote: > >>Update: >> >>I've found the offending message and purged it from the list archives, >>purged it from the shunt files, and purged it from everywhere I could >>find it. >> >>Yet the problem persists. So I'm looking for the temp file/mail area >>where the file that contains this attachment may be found. >> >> >>Michael Rasmussen wrote: >> >>>I have a list that was sent a file with an attachement with too long a >>>name. (See error below) now all mail to the list is being shunted. >>> >>>the filename listed does not exist on my system. There is no file on my system with that name. >>>The directory /var/lib/mailman/archives/private/rca-l/attachments/20051207/3d04c3a4 is empty. >>> >>>What do I need to do to resolve this problem? >>> >>>========== Error message ===================== >>>Dec 22 06:08:46 2005 (2233) Uncaught runner exception: [Errno 36] File name too long: '/var/lib/mailman/archives/private/rca-l/attachments/20051207/3d04c3a4/iso-8859-1QThe_surface_of_the_SunA0_The_sun_has_a_rigid_iron_surfaceiso-8859-1Q_located_under_the_photosphere_that_is_revealed_by_satelliiso-8859-1Qte_imagery.A0_The_solar_surface_sits_beneath_the_suns_viiso-8859-1Qsible_photosphere_and_is_electrically_active..obj' >>>Dec 22 06:08:46 2005 (2233) Traceback (most recent call last): >>> File "/usr/lib/mailman/Mailman/Queue/Runner.py", line 111, in _oneloop >>> self._onefile(msg, msgdata) >>> File "/usr/lib/mailman/Mailman/Queue/Runner.py", line 167, in _onefile >>> keepqueued = self._dispose(mlist, msg, msgdata) >>> File "/usr/lib/mailman/Mailman/Queue/IncomingRunner.py", line 130, in _dispose >>> more = self._dopipeline(mlist, msg, msgdata, pipeline) >>> File "/usr/lib/mailman/Mailman/Queue/IncomingRunner.py", line 153, in _dopipeline >>> sys.modules[modname].process(mlist, msg, msgdata) >>> File "/var/lib/mailman/Mailman/Handlers/ToDigest.py", line 91, in process >>> send_digests(mlist, mboxfp) >>> File "/var/lib/mailman/Mailman/Handlers/ToDigest.py", line 132, in send_digests >>> send_i18n_digests(mlist, mboxfp) >>> File "/var/lib/mailman/Mailman/Handlers/ToDigest.py", line 306, in send_i18n_digests >>> msg = scrubber(mlist, msg) >>> File "/var/lib/mailman/Mailman/Handlers/Scrubber.py", line 265, in process >>> url = save_attachment(mlist, part, dir) >>> File "/var/lib/mailman/Mailman/Handlers/Scrubber.py", line 447, in save_attachment >>> fp = open(path, 'w') >>>IOError: [Errno 36] File name too long: '/var/lib/mailman/archives/private/rca-l/attachments/20051207/3d04c3a4/iso-8859-1QThe_surface_of_the_SunA0_The_sun_has_a_rigid_iron_surfaceiso-8859-1Q_located_under_the_photosphere_that_is_revealed_by_satelliiso-8859-1Qte_imagery.A0_The_solar_surface_sits_beneath_the_suns_viiso-8859-1Qsible_photosphere_and_is_electrically_active..obj' >>> >>>Dec 22 06:08:46 2005 (2233) SHUNTING: 1135258825.4376719+99568bcc1187c910d48aae8b9ae8f68ed3aa643b >>> >>>========== Error message ===================== >>>-- >>> Michael Rasmussen, Portland Oregon -- Tokio Kikuchi, tkikuchi@ is.kochi-u.ac.jp http://weather.is.kochi-u.ac.jp/

3 2

Re: [Mailman-Developers] Mailman / One-Click Unsubscribe
by André 23 Dec '05

23 Dec '05

Hi, thanks for the comments/tips upon a solution for a "One-Click Unsubscribe". For anyone interested, here is a short summary of what we did: * we decided to implement our own frontends to mailman, as we feel everything about mailman is great - everything but the frontends :-) * we integrated the MySQL MemberAdaptor from http://www.orenet.co.uk/opensource/MailmanMysql/ * we wrote frontends in php as an extension to the open source cms "papaya CMS" (www.papaya-cms.com - note: the page is only available in german until spring '06) * papaya now has a complete double-opt-in / opt-out system to manage subscriptions und unsubscriptions and keeps track of all relevant dates, due to requirements of the german laws * papaya syncs this database with the mailman maysql-database * and everything is fine ;-) Again, thanks for any comments upon our problem - and thanks to the developers for mailman and the MySQL MemberAdaptor... Best regards! André

1 0

Released: Mailman 2.1.7b1
by Tokio Kikuchi 19 Dec '05

19 Dec '05

Hi all, I've just released Mailman 2.1.7b1 for beta test and i18n translations. I'm tempted to jump into RC because the 2.1-maint branch is so stable and 2.1.7 is mainly for bug fixes, but we need more translations before the final release. Please download it from SF or: http://mm.tkikuchi.net/mailman-2.1.7b1.tgz Cheers, Tokio ------------------------------------------------------- Here is a history of user visible changes to Mailman. 2.1.7b1 (20-Dec-2005) Security - The fix for CAN-2005-0202 has been enhanced to issue an appropriate message instead of just quietly dropping ./ and ../ from URLs. - A note on CVE-2005-3573: Although the RFC2231 bug example in the CVE has been solved in mailman-2.1.6, there may be more cases where ToDigest.send_digests() can block regular delivery. We put the send_digests() calling part in try - except clause and leave a message in the error log if something happened in send_digests(). Daily call of cron/senddigests will notify more detail to the site administrator. - List administrators can no longer change the user's option/subscription globally. Site admin can change these only if mm_cfg.ALLOW_SITE_ADMIN_COOKIES is set to Yes. - Script tag is disallowd in edithtml script. - Since probe message for the disabled users may reach unexpected persons, the password was excluded from sendProbe() and probe.txt. Note that the default value of VERP_PROBE has been set to `No' from 2.1.6., thus this change doesn't change the default behavior. New Features - Always remove DomainKey (and similar) headers (1287546) from messages sent to the list. - List owners can customize content filter behavior as not to collapse multipart/alternative to its first content. This allows HTML part to pass through after other content filtering is done. Internationalization - New language: Interlingua. Bug fixes and other patches - Fix Scrubber.py mungs quoted-printable bug with introducing 'X-Mailman-Scrubbed' header for marking that the payload is scrubber-munged. The flag is referenced in ToDigest.py, ToArchive.py, Decorate.py and Archiver. Similar problem in ToDigest.py where the plain digest is generated is also fixed. - Fix Syslog.py to write quopri encoded message when it fail to write 8-bit characters. - Fix MTA/Postfix.py to check aliases group permission in check_perms and fix mailman-install document on this matter (1378270). - Fix private.py to go to the original URL after authorization (1080943). - Fix bounce log score messages to be more consistent. - Fix bin/remove_members to accept no arguments when both --fromall and --file= options are specified. - Change cgi-bin and mail wrapper "group not found" error message to be more descriptive of the actual problem. - Apply the list's ban_list to address changes and admin mass subscribe and invite and to confirmations/approvals of address changes, subscriptions and invitations. - Decode quoted-printable and base64 encoded parts before passing to HTML_TO_PLAIN_TEXT_COMMAND (1367783). - Remove Approve: header from post - treat as Approved: (1355707). - Stop removing line following Approve(d): line in body of post (1318883). - Log post in post log with true sender, not listname-bounces (1287921). - Correctly initialize and remember the list's default_member_moderation attribute in the web list creation page (1263213). - Add PEP263 charset in config_list output (1343100). - header_filter_rules get lost if accessed directly and needed authenti- cation by login page (1230865). - Obscure email when the poster doesn't set full name in 'From:' header. - Take preambles and epilogues into account when calculating message sizes for holding purposes (Mark Sapiro). - Logging/Logger.py unicode transform option (1235567). - bin/update crashes with bogus files (949117). - Bugs and patches: 1212066/1301983 (Date header in create/remove notice)

1 0