Mailman 3 April 2020 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 7, 2022

Nov. 7, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

How to know the URLs for CURL while getting or modifying the data of mailman 3
by Shashikanth Komandoor April 28, 2020

April 28, 2020

Hi team, Somehow, I have enabled the REST API of mailman 3 accessible from another machine. I am able to see some data using the command cURL and by providing the REST API credentials. But I don't know the URLs to be used for the purpose I want to do some thing like I want to add user to list or remove a user from the list. These activities I can do it from the browser and also from the python prompt (>>>) but how to do the same activities through the curl command. As of now, if I want to see the lists or domains on Mailman 3 through cURL I am running the below commands *1. curl -GET -u <username>:<password> http://<MM3 Server IP>:8001/3.1/domains | python -mjson.tool* *2. curl -GET -u * *<username>:<password>* *http://**<MM3 Server IP>**:8001/3.1/lists | python -mjson.tool* But further to this, I don't know how to add users to the list, how to create new lists and many other activities. How can I generate the URLs as required. -- Thanks & Regards, Shashi Kanth.K 9052671936 <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

4 7

Mailman 2.1.30 archives challenges
by Thomas Coradeschi April 26, 2020

April 26, 2020

Thanks for help with my earlier problem, figured out how to get Apache straight and all is good. Now trying to get archiving to work properly. It worked fine under 2.1.20, but not now. Ubuntu 16.04, mailman 2.1.30 The raw archive file is being written ok. I have a test list (called ’test’) and can see that /var/lib/mailman/archives/private/test/2020-April.txt and /var/lib/mailman/archives/private/test.mbox/test.mbox have both been created and have messages being written to them, but the html archive pages are not being built. manually running '/var/lib/mailman/bin/arch test’ gives me #00000 <1F9F4DC9-AF84-4D49-B1EE-ABDC0A612692(a)skylands.ibmwr.org> figuring article archives 2020-April Pickling archive state into /var/lib/mailman/archives/private/test/pipermail.pck Traceback (most recent call last): File "bin/arch", line 201, in <module> main() File "bin/arch", line 189, in main archiver.processUnixMailbox(fp, start, end) File "/var/lib/mailman/Mailman/Archiver/pipermail.py", line 596, in processUnixMailbox self.add_article(a) File "/var/lib/mailman/Mailman/Archiver/pipermail.py", line 640, in add_article author = fixAuthor(article.decoded['author']) File "/var/lib/mailman/Mailman/Archiver/pipermail.py", line 63, in fixAuthor while i>0 and (L[i-1][0] in lowercase or UnicodeDecodeError: 'ascii' codec can't decode byte 0xaa in position 26: ordinal not in range(128) The following is what’s in /var/lib/mailman/archives/private/test at this time drwxrwsr-x 2 tcora list 4096 Apr 24 20:30 2020-April -rw-rw-r-- 1 tcora list 300 Apr 24 20:30 2020-April.txt -rw-rw-r-- 1 tcora list 1048 Apr 24 20:30 index.html -rw-rw---- 1 tcora list 588 Apr 24 20:30 pipermail.pck Kinda at a loss here, so any insight would be much appreciated! Regards, — Tom Coradeschi tjcora(a)icloud.com

4 4

Question about REST API for Mailman 3
by Shashikanth Komandoor April 24, 2020

April 24, 2020

Hi team, I am developing an application on which just clicking on submit with some input values loaded should invoke the REST API of Mailman 3 running on another server and do some activities like adding of user(s) to a list or removal of user(s) from a list or so. Is it possible to do so ? If so, how ? -- Thanks & Regards, Shashi Kanth.K 9052671936 <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

3 3

AppleMail and Mailman3 content filtering
by Mike Gabriel April 23, 2020

April 23, 2020

Hi all, I have a special case in a 3.3.0 Mailman3 instance. One of our users uses AppleMail and sends a mail with PDF attachment to a mailing list with the following settings in Postorius: [x] filter content [x] collapse alternatives [x] convert html to plaintext However, the PDF is not getting delivered to the mailing list recipients. It gets stripped off. The mail structure of the original mail is this: ``` [...] From: [...] Content-Type: multipart/alternative; boundary="Apple-Mail=_F2665084-9FD9-4017-B8F0-8E6ABE6D424C" Mime-Version: 1.0 (Mac OS X Mail 10.3 $3273$) Subject: Fwd: [...] Message-Id: [...] References: [...] To: Mike Gabriel <[...]> Date: Tue, 21 Apr 2020 06:35:52 +0200 X-Mailer: Apple Mail (2.3273) [... headers ...] --Apple-Mail=_F2665084-9FD9-4017-B8F0-8E6ABE6D424C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 [... quoted printable text ...] --Apple-Mail=_F2665084-9FD9-4017-B8F0-8E6ABE6D424C Content-Type: multipart/mixed; boundary="Apple-Mail=_702BD6D5-BCE8-42D9-83D4-5F316F5F607B" --Apple-Mail=_702BD6D5-BCE8-42D9-83D4-5F316F5F607B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 [... html coded text ...] --Apple-Mail=_702BD6D5-BCE8-42D9-83D4-5F316F5F607B Content-Disposition: inline; filename="<filename>.pdf" Content-Type: application/pdf; x-unix-mode=0644; name="<filename>.pdf" Content-Transfer-Encoding: base64 [ ... base64 encoded PDF ...] --Apple-Mail=_702BD6D5-BCE8-42D9-83D4-5F316F5F607B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 [... html coded text ...] --Apple-Mail=_702BD6D5-BCE8-42D9-83D4-5F316F5F607B-- --Apple-Mail=_F2665084-9FD9-4017-B8F0-8E6ABE6D424C-- ``` When such a (forwarded mail) arrives at the mailing list server, it is held back for moderation. In the moderation dialog box (Postorius) I can see the attachment and can also open it locally for review. I then accept the mail for list delivery and when delivered the PDF attachment is gone. The resulting mail structure looks like this: ``` [...] From: [...] Mime-Version: 1.0 (Mac OS X Mail 10.3 $3273$) Message-Id: [...] References: [...] To: <test-mailman3-list> Date: Mon, 20 Apr 2020 09:33:12 +0200 X-Mailer: Apple Mail (2.3273) [...] X-MailFrom: [...] X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation Message-ID-Hash: [...] X-Message-ID-Hash: [...] X-Mailman-Approved-At: Mon, 20 Apr 2020 17:09:31 +0200 X-Content-Filtered-By: Mailman/MimeDel 3.3.0 X-Mailman-Version: 3.3.0 Precedence: list Subject: =?utf-8?q?=5BTest-Klasse=5D_?= Fwd: [...] List-Id: [...] Archived-At: [...] List-Archive: [...] List-Help: [...] List-Post: NO List-Subscribe: [...] List-Unsubscribe: [...] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 [...] [... base64 encoded utf8 text ...] ``` Does this ring a bell for someone? Is it a known issue that has been fixed after 3.3.0 was released? Or is it a new phenomenon that needs to be tracked down? light+love Mike -- DAS-NETZWERKTEAM c\o Technik- und Ökologiezentrum Eckernförde Mike Gabriel, Marienthaler Str. 17, 24340 Eckernförde mobile: +49 (1520) 1976 148 landline: +49 (4351) 850 8940 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de

2 2

Changing cookie name in mailman 2.1.26
by Chris Joyce April 21, 2020

April 21, 2020

Hi, I would like to know how easy it would be to change the name of the user cookie? The reason being we have recently deployed a WAF in front of our mailman web instances and although its in detection mode (not prevention yet) it is picking up the mailman user cookie as containing SQL Injection or rather a SQL Comment. The WAF uses OWASP 3.0 rules and the rule matched is 942440. Mailman sets a cookie name in the form list+user+email--at--domain and its that “--at” that is detected as SQL Comment; I really don’t want to disable the rule and applying an ignore rule within the WAF doesn’t work. If someone could let me know, yes its possible that would be great. Actually if someone could say look at this file and that file that would be a great help too. I don’t know python, but I am a web developer (.Net). Many thanks Chris

2 1

MIME type filtering
by Mike Gabriel April 21, 2020

April 21, 2020

Hi all, a more general question... In Mailman2 one could filter MIME type based on file suffix and/or MIME type name. Is this possible already in Mailman3? How is that done? Or is it on the feature wishlist still? Or just not configurable via Postorius? Thanks for any sort of feedback, Mike -- DAS-NETZWERKTEAM c\o Technik- und Ökologiezentrum Eckernförde Mike Gabriel, Marienthaler Str. 17, 24340 Eckernförde mobile: +49 (1520) 1976 148 landline: +49 (4351) 850 8940 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de

2 2

Mailman 2.1.30 released
by Mark Sapiro April 21, 2020

April 21, 2020

I am pleased to announce the release of Mailman 2.1.30 Python 2.6 is the minimum supported, but Python 2.7, preferably 2.7.17 - the final Python 2 release, is strongly recommended. This is a routine bug fix release with a few new features. See the attached README.txt for details. Mailman 2.1.30 will be the last release of the Mailman 2.1 branch from the GNU Mailman project. There has been some discussion as to what this means. It means there will be no more releases from the GNU Mailman project containing any new features. There may be future patch releases to address the following: - i18n updates. - security issues. - bugs affecting operation for which no satisfactory workaround exists. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, please see our web site at one of: http://www.list.org https://www.gnu.org/software/mailman http://mailman.sourceforge.net/ Mailman 2.1.30 can be downloaded from https://launchpad.net/mailman/2.1/ https://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/ -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

2 3

Mailman Core 3.3.1 release
by Abhilash Raj April 19, 2020

April 19, 2020

Hey Everyone, I am pleased to announce Mailman Core 3.3.1 is now out. This release includes support for bounce processing, which had been lacking in Mailman 3 until now. So, after upgrading to this release, you will notice bounce related notifications from Mailman 3 being sent out to list owners if the list has bounce processing enabled (which, most list do by default). Postorius changes for new bounce processing options are coming out soon, I would like the current head to bake in a little longer since it went through bootstrap 4 upgrade recently. Expect it to be out in about a month. If your users would really care about bounce processing being enabled and not being able to tune threshold and notification parameters in the web interface, you might want to wait for Postorius's next release before upgrading. It also exposes all the remaining attributes of MailingList via REST API, so Postorius can expose them in the Web Interface. This should finally make all attributes of a MailingList manageable via Web Interface, without having to access command line interface. There has also been a whole lot of bug fixes. A full list of changes can be found at: https://mailman.readthedocs.io/en/latest/src/mailman/docs/NEWS.html#id1 The release is available via PyPI: https://pypi.org/project/mailman/3.3.1/ To install this release via pip, you can run: $ pip install --upgrade mailman -- thanks, Abhilash Raj (maxking)

1 0

Re: italian translations
by Abhilash Raj April 13, 2020

April 13, 2020

On Mon, Apr 13, 2020, at 10:49 AM, Daniele Pizzolli wrote: > > Daniele Pizzolli writes: > > > Done, it seems that not everything (95% overall) was imported, but on my > > side I have 100% (at least from 3 days ago). > > > > I will check it later why or tomorrow and report any issue! > > Hello! > > I do not know the details but the gnu gettext tools and weblate do > something differently. Maybe there is a option to force the same > behavior? To get the initial po for mailman I used the instruction in: > > src/mailman/docs/internationalization.rst I just updated it yesterday to use update-pot.sh > > And translated everything. And now, after the import, I see additional > lines like: > > msgid "list:admin:notice:subscribe.txt" > msgstr "" > > I guess that those lines are related to the messages in > src/mailman/templates/en/*txt. Right. > > It seems that the weblate interface resolve in some way the reference > and display the file content instead of the file name. Maybe there is > something magic happening? Yes, there is ;-) So the issue I had was that these template files are .txt files and it is hard to signal GNU xgettext to add them to the po files. So, I read a bit more about translation guides and it turns out that msgid in .po files don't really have to be the source string, but only an identifier and by default the identifier is the english version. So, I changed the identifier for only template files to be called the name of the text file. This worked well for the code. They are called "monolingual" po files and Weblate supports them. For helping translators, it will display original source string from a reference .po file, which in our case is the English version. https://docs.weblate.org/en/latest/formats.html#bimono This also remind me of a bug in update-pot.sh script, it doesn't add the right source strings in the English .po file. I'll file a bug for it. > > I see that there are other languages templates... so what the > translation should be? The translated string or the template file name > containing the translation? Why not use the {% trans %} in templates? Translation should be the translated string, but the msgid would be the file name not the value. You can look at the English po file for reference. > Ah, now I saw the update-pot.sh! But something is still not clear to > me. > > Is there a way to get the file content as msgid or as comment to ease > the offline translation? Or can I simply add my translation in place in > src/mailman/templates/it/ and make a pull request? You can look at the English translation as a reference, same as Weblate. But I can also add the English text as comments in the po file if you feel that is easier for you. It just needs updating the simple update-pot.sh script that you saw already. > Maybe just adding the template string to the po will streamline the > interaction both with weblate and any offline tool while waiting for a > long term solution. I may work on little patch if you agree. > > Let me know your suggestion and then I will complete the translations! > > Best, > Daniele > -- thanks, Abhilash Raj (maxking)

1 0