Mailman 3 - Mailman-Developers

GNU Mailman in Google Summer of Code 2022!
by Stephen J. Turnbull March 10, 2022

March 10, 2022

Hi all, We are participating in Google Summer of Code 2022 (GSoC) under the Python Software Foundation (PSF). We did apply as a separate organization, but didn't get in. Many thanks to the PSF's GSoC organization for picking us up at the last minute! You can find our ideas page at https://wiki.list.org/DEV/Google%20Summer%20of%20Code%202022, and item on the PSF ideas page under https://python-gsoc.org/ideas.html (which isn't so interesting about Mailman, but you can check out who else is … [View More]under the PSF banner there). Discussion and development of project ideas will take place on mailman-developers(a)python.org. If you have a developed idea not already listed that you're willing to discuss and advocate, and you're willing to grab the template (last item on our ideas page on list.org) and fill it out, please post it to mailman-developers(a)python.org. (This a deliberate hoop-jumping exercise to filter in "serious" ideas.) You can put more weight on it by expressing interest in mentoring the project, and even more by actually volunteering! ;-) If you have a half-baked idea, and/or you want to get input from other Mailman users, of course you should feel free to discuss it on mailman-users(a)mailman3.org. We *might* pick it up from there, even if it's just a drive-by post with little support from the list members. But no promises about that, most of our attention will go to mailman-developers. If you feel some idea should get more love, polish it a little and post that to mailman-developers (don't cross-post, please). Again, we'd love to have more mentors, including backup mentors. We currently only have two mentors. Although we're both core developers, and I'm on an academic schedule and can devote plenty of time to the student during the summer, not so for Abhilash. Volunteering at this stage is not a promise to do more than look at student proposals. You would only be asked to look at the proposals, and volunteer as mentor for that project if you have interest and some level of knowledge to contribute to it. Even if you're a site admin with little Python programming experience, vetting interns' brainstorms about list admin-visible features and holding their hands until the "pros from Dover" arrive is quite helpful in making the student feel at home in our community. Many students are shy about blogging and communicating about their projects to the community -- just talking to them about their project and suggesting that they blog what they told you is helpful. Coding skills and knowledge of some part of the Mailman 3 code base are most welcome, of course, but you can make your mentor role what you want it to be. Regards, Steve [View Less]

1 0

Unclear usage of `member = ISubscriptionManager(mlist).register(…)`
by Дилян Палаузов Feb. 26, 2022

Feb. 26, 2022

Hello, I am trying to understand the source code. My reading is, that interfaces/subscriptions.py:class ISubscriptionManager.register always returns a 3-tuple and the last element of the tuple is a member object, or None. This coincides with the implementation in app/subscriptions.py.SubscriptionManager.register . cli_synmembers.py:add_members() contains: member = registrar.register( subscriber, pre_verified=True, pre_approved=True, pre_confirmed=True, … [View More]

3 2

How to recreate Issue #973 in mailman-core
by Suyash Singh Feb. 6, 2022

Feb. 6, 2022

Greetings everyone, I am new to the repository of Mailman and was looking for open source projects that used Django and came across this amazing open source. I hope to learn a lot about Django and Linux. I have started a development environment and am starting to read the documentation. I picked up issue #973 because it seemed like a easy issue to fix. Link to Issue: https://gitlab.com/mailman/mailman/-/issues/973 1) I am unable to recreate the problem. As I can't find the API url and how do … [View More]

3 2

Regarding willing to contribute to the organization.
by Sanket Varpe Jan. 28, 2022

Jan. 28, 2022

Hello, This is Sanket Varpe, a final year CS student at PICT, Pune. I am looking to make contributions to open source projects. I have multiple internship experiences as a backend developer where I architected and implemented backend of cloud based applications. I am experienced in Javascript, Node.js, Python, Django etc.I went through mailman projects and found them very interesting. I went through their issues but as I am little new to this area I got confused seeing a lot of issues and how … [View More]

2 1

Mailman 2.1.39 Release
by Mark Sapiro Dec. 13, 2021

Dec. 13, 2021

I am pleased to announce the release of Mailman 2.1.39. This is a bug fix release. It fixes https://bugs.launchpad.net/mailman/+bug/1954694 This addresses two issues. The fix for CVE-2021-42097 was case sensitive and should not be. The fix for CVE-2021-44227 introduced a potential NameError in logging. This could cause a user's changes to the option's page to not be accepted and perhaps cause a `We hit a bug` response if the user visited the page with a mixed- or upper-case email address … [View More]

1 0

Mailman 2.1.38 security release
by Mark Sapiro Nov. 30, 2021

Nov. 30, 2021

A CSRF vulnerability has been reported by Riccardo Schirone of RedHat. This is assigned CVE-2021-44227. I plan to release Mailman 2.1.38 on Tuesday, 30 November to fix this. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 1

Mailman 2.1 security release
by Mark Sapiro Nov. 13, 2021

Nov. 13, 2021

I am pleased to announce the release of Mailman 2.1.36. This is a security release. It fixes https://bugs.launchpad.net/mailman/+bug/1949401 CVE-2021-43331 and https://bugs.launchpad.net/mailman/+bug/1949403 CVE-2021-43332. The former of these could allow an XSS attack against the user options page and the latter could allow a list moderator to discover the list admin password via a brute force attack against the admindb page CSRF token. For those who just want a patch for the security … [View More]

1 2

Mailman 2.1 security release
by Mark Sapiro Nov. 7, 2021

Nov. 7, 2021

Two new security issues have been reported in Mailman 2.1. These have been given the IDs CVE-2021-43331 and CVE-2021-43332. I plan to release 2.1.36 with full details this Friday, November 12. At that time the vulnerabilities will be made public and patches will also be made available. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

Mailman 2.1 security release
by Mark Sapiro Oct. 26, 2021

Oct. 26, 2021

A couple of vulnerabilities have recently been reported. Thanks to Andre Protas, Richard Cloke and Andy Nuttall of Apple for reporting these and helping with the development of a fix. CVE-2021-42096 could allow a list member to discover the list admin password. CVE-2021-42097 could allow a list member to create a successful CSRF attack against another list member enabling takeover of the members account. These attacks can't be carried out by non-members so may not be of concern for … [View More]

2 5

Hyperkitty and mailman-hyperkitty releases
by Abhilash Raj Oct. 13, 2021

Oct. 13, 2021

Hello Everyone, I have just tagged and released Hyperkitty 1.3.5 and mailman-hyperkitty plugin 1.2.0 to PyPI. This release includes some changes in the authentication between mailman-hyperkitty plugin and Hyperkitty. For that reason, it is important to upgrade both Hyperkitty and mailman-hyperkitty plugin to the latest versions, or it could result in a broken installation. This release of Hyperkitty has bugfixes, some new features and some security enhancements. A full list of changes is … [View More]

1 0