Mailman 3 - Mailman-Developers

Re: [Mailman-developers] Re: [meta-sig] mailman problems
by Roy Smith 23 Apr '98

23 Apr '98

"Barry A. Warsaw" <bwarsaw(a)CNRI.Reston.Va.US> wrote: > TLD's probably don't change that often Didn't they just open up two more (.to and .cc) recently? I absolutely agree, taking any information in the DNS and committing it to a static file is a recipie for disaster in the long-term. Roy Smith <roy(a)popmail.med.nyu.edu> New York University School of Medicine 550 First Avenue, New York, NY 10016

1 0

membership management developments: chunkifying
by Scott 21 Apr '98

21 Apr '98

i have somehow managed to get the membership management section chunkified, with proper authentication. there is a new variable in mm_defaults called DEFAULT_CHUNK_SIZE, which as commented sets the size of the chunk of members presented at a time to admins editing their options/ unsubscribing them. this section of membership management uses cookie authentication. As Authentication is getting particulary messy in the program cgi/admin, i wouldn't suggest (m)any futher develops that involve special authentication without rewriting the script from the bottom up. anyway, here is a patch, as applied against the distribution version that i posted about the other day that does an improved job of membership management stuff. scott Index: cgi/admin =================================================================== RCS file: /usr/local/cvsroot/mailman/cgi/admin,v retrieving revision 1.1.1.1 diff -c -r1.1.1.1 admin *** admin 1998/04/21 03:27:57 1.1.1.1 --- admin 1998/04/21 15:45:15 *************** *** 9,17 **** --- 9,20 ---- import sys sys.path.append('/home/mailman/mailman/modules') + # XXX need to fix this, this directory should be configurable. + sys.path.append('/home/mailman/cgi-bin') import os, cgi, string, crypt, types import mm_utils, maillist, mm_cfg, mm_err from htmlformat import * + import Cookie try: sys.stderr = mm_utils.StampedLogger("error", label = 'admin', *************** *** 27,32 **** --- 30,38 ---- ('bounce', "Bounce Options"), ('archive', "Archival Options")] + # + # XXX this this data is also in mm_mailcmd (i think), it should become shared + # option_info = { 'digest' : 0, 'nomail' : mm_cfg.DisableDelivery, 'norcv' : mm_cfg.DontReceiveOwnPosts, *************** *** 36,42 **** } - def main(): """Process and produce list options form. --- 42,47 ---- *************** *** 80,86 **** FormatOptionHelp(doc, cgi_data['VARHELP'].value, list) print doc.Format(bgcolor="#ffffff") return ! if not cgi_data.has_key('adminpw'): AddErrorMessage(doc, 'Error: You must supply the admin password to' ' change options.') --- 85,125 ---- FormatOptionHelp(doc, cgi_data['VARHELP'].value, list) print doc.Format(bgcolor="#ffffff") return ! if cgi_data.has_key('adminpw') and cgi_data.has_key('edit_members'): ! adminpw = cgi_data["adminpw"] ! if type(adminpw) is type([]): ! adminpw = adminpw[0].value # use the first one, i guess -scott cotton ! else: ! adminpw = adminpw.value ! try: ! list.ConfirmAdminPassword(adminpw) ! FormatConfiguration(doc, list, category, category_suffix, cgi_data, 0) ! c = Cookie.Cookie() ! c[list.real_name] = hash(list.real_name) ! print c ! except mm_err.MMBadPasswordError: ! AddErrorMessage(doc, 'Error: Incorrect admin password.') ! FormatConfiguration(doc, list, category, category_suffix, cgi_data, 1) ! print doc.Format(bgcolor="#ffffff") ! return ! elif cgi_data.has_key('chunk'): ! if os.environ.has_key("HTTP_COOKIE"): ! cookie = Cookie.Cookie(os.environ["HTTP_COOKIE"]) ! if cookie.has_key(list.real_name): ! if cookie[list.real_name].value == hash(list.real_name): ! FormatConfiguration(doc, list, category, category_suffix, cgi_data, 0) ! print doc.Format(bgcolor="#ffffff") ! return ! else: ! AddErrorMessage(doc, "Error: Invalid Cookie value") ! else: ! AddErrorMessage(doc, "Error, no cookie for list!") ! else: ! AddErrorMessage(doc, "no cookie!") ! FormatConfiguration(doc, list, category, category_suffix, cgi_data) ! print doc.Format(bgcolor="#ffffff") ! return ! elif not cgi_data.has_key('adminpw') : AddErrorMessage(doc, 'Error: You must supply the admin password to' ' change options.') *************** *** 90,103 **** adminpw = adminpw[0].value # use the first one, i guess -scott cotton else: adminpw = adminpw.value ! try: list.ConfirmAdminPassword(adminpw) ! ChangeOptions(list, category, cgi_data, doc) # Yuck. This shouldn't need to be here. WTF?!? ! if not list.digestable and not list.nondigestable: list.nondigestable = 1 ! except mm_err.MMBadPasswordError: ! AddErrorMessage(doc, 'Error: Incorrect admin password.') if not list.digestable and len(list.digest_members): AddErrorMessage(doc, --- 129,142 ---- adminpw = adminpw[0].value # use the first one, i guess -scott cotton else: adminpw = adminpw.value ! try: list.ConfirmAdminPassword(adminpw) ! ChangeOptions(list, category, cgi_data, doc) # Yuck. This shouldn't need to be here. WTF?!? ! if not list.digestable and not list.nondigestable: list.nondigestable = 1 ! except mm_err.MMBadPasswordError: ! AddErrorMessage(doc, 'Error: Incorrect admin password.') if not list.digestable and len(list.digest_members): AddErrorMessage(doc, *************** *** 121,127 **** ' (does it have the colon?)<ul> %s </ul>', line) ! FormatConfiguration(doc, list, category, category_suffix, cgi_data) print doc.Format(bgcolor="#ffffff") finally: --- 160,169 ---- ' (does it have the colon?)<ul> %s </ul>', line) ! if cgi_data.has_key('edit_member_options'): # passwd already checked ! FormatConfiguration(doc, list, category, category_suffix, cgi_data, 0) ! else: ! FormatConfiguration(doc, list, category, category_suffix, cgi_data) print doc.Format(bgcolor="#ffffff") finally: *************** *** 204,210 **** print doc.Format(bgcolor="#ffffff") ! def FormatConfiguration(doc, list, category, category_suffix, cgi_data): """Produce the overall doc, *except* any processing error messages.""" for k, v in CATEGORIES: if k == category: label = v --- 246,252 ---- print doc.Format(bgcolor="#ffffff") ! def FormatConfiguration(doc, list, category, category_suffix, cgi_data, front_page=1): """Produce the overall doc, *except* any processing error messages.""" for k, v in CATEGORIES: if k == category: label = v *************** *** 253,269 **** " bottom. (You can also change your password there," " as well.)<p>") ! form.AddItem(FormatOptionsSection(category, list, cgi_data)) form.AddItem(Center(FormatPasswordStuff())) form.AddItem(list.GetMailmanFooter()) ! def FormatOptionsSection(category, list, cgi_data): """Produce the category-specific options table.""" if category == 'members': # Special case for members section. ! return FormatMembershipOptions(list, cgi_data) options = GetConfigOptions(list, category) big_table = Table(cellspacing=3, cellpadding=4) --- 295,311 ---- " bottom. (You can also change your password there," " as well.)<p>") ! form.AddItem(FormatOptionsSection(category, list, cgi_data, front_page)) form.AddItem(Center(FormatPasswordStuff())) form.AddItem(list.GetMailmanFooter()) ! def FormatOptionsSection(category, list, cgi_data, front_page): """Produce the category-specific options table.""" if category == 'members': # Special case for members section. ! return FormatMembershipOptions(list, cgi_data, front_page) options = GetConfigOptions(list, category) big_table = Table(cellspacing=3, cellpadding=4) *************** *** 398,404 **** descr = descr + "</div>" return [descr, gui_part] ! def FormatMembershipOptions(list, cgi_data, option_info=option_info): container = Container() header = Table(width="100%") header.AddRow([Center(Header(2, "Membership Management"))]) --- 440,446 ---- descr = descr + "</div>" return [descr, gui_part] ! def FormatMembershipOptions(list, cgi_data, front_page=1, option_info=option_info): container = Container() header = Table(width="100%") header.AddRow([Center(Header(2, "Membership Management"))]) *************** *** 408,428 **** header.AddCellInfo(max(header.GetCurrentRowIndex(), 0), 0, colspan=2, bgcolor ="#FFF0D0") container.AddItem(header) ! if cgi_data.has_key("adminpw"): ! adminpw = cgi_data["adminpw"] ! if type(adminpw) is type([]): # admin password specified more than once ! adminpw = adminpw[0].value # use the first one, i guess ! else: ! adminpw = adminpw.value ! try: ! list.ConfirmAdminPassword(adminpw) ! confirmed = 1 ! except (mm_err.MMBadPasswordError): ! confirmed = 0 ! else: ! confirmed = 0 ! if not cgi_data.has_key('edit_members') or (cgi_data.has_key('edit_members') and ! not confirmed): container.AddItem(Center('\n<h3>To Unsubscribe Members or Edit their Options...</h3>')) container.AddItem(Center(""" Enter the adminitrative password: <input type=password name=adminpw size=10> --- 450,456 ---- header.AddCellInfo(max(header.GetCurrentRowIndex(), 0), 0, colspan=2, bgcolor ="#FFF0D0") container.AddItem(header) ! if front_page: container.AddItem(Center('\n<h3>To Unsubscribe Members or Edit their Options...</h3>')) container.AddItem(Center(""" Enter the adminitrative password: <input type=password name=adminpw size=10> *************** *** 435,465 **** else: user_table = Table(width="90%") digest_user_table = Table(width="90%") ! user_table.AddRow([Center(Header(4, "Members"))]) user_table.AddCellInfo(user_table.GetCurrentRowIndex(), user_table.GetCurrentCellIndex(), bgcolor="#cccccc", colspan=8) for member in list.members: ! cells = [member, ! "subscribed " +CheckBox(member + "_subscribed", "on", 1).Format(), ! "digest " + CheckBox(member+"_digest", "off").Format(), ! ] ! for opt in ("hide", "nomail", "ack", "norcv", "plain"): ! if list.GetUserOption(member, option_info[opt]): ! value = "on" ! checked = 1 ! else: ! value = "off" ! checked = 0 ! box = CheckBox("%s_%s" % (member, opt), value, checked) ! cells.append("%s %s" % (opt, box.Format())) ! user_table.AddRow(cells) for member in list.digest_members: ! cells = [member, "subscribed " +CheckBox(member + "_subscribed", "on", 1).Format(), - "digest " + CheckBox(member+"_digest", "on", 1).Format(), ] for opt in ("hide", "nomail", "ack", "norcv", "plain"): if list.GetUserOption(member, option_info[opt]): value = "on" --- 463,508 ---- else: user_table = Table(width="90%") digest_user_table = Table(width="90%") ! user_table.AddRow([Center(Header(4, "Membership List"))]) user_table.AddCellInfo(user_table.GetCurrentRowIndex(), user_table.GetCurrentCellIndex(), bgcolor="#cccccc", colspan=8) + members = {} + digests = {} for member in list.members: ! members[member] = 1 for member in list.digest_members: ! digests[member] = 1 ! all = list.members + list.digest_members ! if len(all) > mm_cfg.DEFAULT_CHUNK_SIZE: ! chunks = mm_utils.chunkify(all) ! if not cgi_data.has_key("chunk"): ! chunk = 0 ! else: ! chunk = string.atoi(cgi_data["chunk"].value) ! all = chunks[chunk] ! footer = ("<p><em>To View other sections, click on the appropriate range listed below</em>") ! chunk_indices = range(len(chunks)) ! chunk_indices.remove(chunk) ! buttons = [] ! pi = os.environ["PATH_INFO"] ! for ci in chunk_indices: ! start, end = chunks[ci][0], chunks[ci][-1] ! buttons.append("<a href=/mailman/admin%s?chunk=%d> from %s to %s </a>" % ( pi, ci, start, end)) ! buttons = apply(UnorderedList, tuple(buttons)) ! footer = footer + buttons.Format() + "<p>" ! else: ! all.sort() ! footer = "<p>" ! for member in all: ! cells = [member + "<input type=hidden name=user value=%s>" % (member), "subscribed " +CheckBox(member + "_subscribed", "on", 1).Format(), ] + if members.get(member): + cells.append("digest " + CheckBox(member + "_digest", "off", 0).Format()) + else: + cells.append("digest " + CheckBox(member + "_digest", "on", 1).Format()) for opt in ("hide", "nomail", "ack", "norcv", "plain"): if list.GetUserOption(member, option_info[opt]): value = "on" *************** *** 471,483 **** cells.append("%s %s" % (opt, box.Format())) user_table.AddRow(cells) container.AddItem(Center(user_table)) # trigger member list viewing again and change_options with hidden tags... # password authentication is still done, so this should be safe ! container.AddItem("<input type=hidden name=edit_member_options value=on>" ! "<input type=hidden name=edit_members value=on><p>") ! container.AddItem("Back to <a href=/mailman/admin/%s/members>Mass Subscribing</a><p>" % \ ! (list.real_name)) ! return container def FormatPasswordStuff(): --- 514,529 ---- cells.append("%s %s" % (opt, box.Format())) user_table.AddRow(cells) container.AddItem(Center(user_table)) + t = Table(width="90%") + t.AddRow([Center(Header(4, "<a href=/mailman/admin/%s/members>Back to Mass Subscriptions</a>" % list.real_name))]) + t.AddCellInfo(t.GetCurrentRowIndex(), + t.GetCurrentCellIndex(), + bgcolor="#cccccc", colspan=8) + container.AddItem(Center(t)) + container.AddItem(footer) # trigger member list viewing again and change_options with hidden tags... # password authentication is still done, so this should be safe ! container.AddItem("<input type=hidden name=edit_member_options value=on>") return container def FormatPasswordStuff(): *************** *** 590,620 **** if getattr(list, property) != value: setattr(list, property, value) dirty = 1 - elif cgi_info.has_key('edit_member_options'): - members = [] - digest_members = [] - org_user_opts = list.user_options.copy() - for member in (list.members + list.digest_members)[:]: - if not cgi_info.has_key(member + "_subscribed"): - list.DeleteMember(member, "cgi: admin/members") - continue - if not cgi_info.has_key(member + "_digest"): # no digest - members.append(member) - else: - digest_members.append(member) - for opt in ("hide", "nomail", "ack", "norcv", "plain"): - if cgi_info.has_key("%s_%s" % (member, opt)): - list.SetUserOption(member, option_info[opt], 1) - else: - list.SetUserOption(member, option_info[opt], 0) - if (list.user_options != org_user_opts): - dirty = 1 - if list.members != members: - list.members = members - dirty = 1 - if list.digest_members != digest_members: - list.digest_members = digest_members - dirty = 1 elif cgi_info.has_key('subscribees'): name_text = cgi_info['subscribees'].value name_text = string.replace(name_text, '\r', '') --- 636,641 ---- *************** *** 644,649 **** --- 665,705 ---- items = map(lambda x: "%s -- %s" % (x[0], x[1]), subscribe_errors) document.AddItem(apply(UnorderedList, tuple((items)))) document.AddItem("<p>") + elif cgi_info.has_key("user"): + user = cgi_info["user"] + if type(user) is type([]): + users = [] + for ui in range(len(user)): + users.append(user[ui].value) + else: + users = [user.value] + for user in users: + if not cgi_info.has_key('%s_subscribed' % (user)): + list.DeleteMember(user) + dirty = 1 + continue + if not cgi_info.has_key("%s_digest" % (user)): + if user in list.digest_members: + list.digest_members.remove(user) + dirty = 1 + if user not in list.members: + list.members.append(user) + dirty = 1 + else: + if user not in list.digest_members: + list.digest_members.append(user) + dirty = 1 + if user in list.members: + list.members.remove(user) + dirty = 1 + + for opt in ("hide", "nomail", "ack", "norcv", "plain"): + if cgi_info.has_key("%s_%s" % (user, opt)): + list.SetUserOption(user, option_info[opt], 1) + dirty = 1 + else: + list.SetUserOption(user, option_info[opt], 0) + dirty = 1 if cgi_info.has_key('newpw'): if cgi_info.has_key('confirmpw'): new = cgi_info['newpw'].value *************** *** 661,667 **** m = 'Error: You must type in your new password twice.' document.AddItem( Header(3, Italic(FontAttr(m, color="ff5060")))) ! if dirty: list.Save() --- 717,723 ---- m = 'Error: You must type in your new password twice.' document.AddItem( Header(3, Italic(FontAttr(m, color="ff5060")))) ! if dirty: list.Save() Index: modules/mm_defaults.py =================================================================== RCS file: /usr/local/cvsroot/mailman/modules/mm_defaults.py,v retrieving revision 1.1.1.1 diff -c -r1.1.1.1 mm_defaults.py *** mm_defaults.py 1998/04/21 03:27:58 1.1.1.1 --- mm_defaults.py 1998/04/21 15:52:05 *************** *** 37,42 **** --- 37,48 ---- HOME_PAGE = 'index.html' MAILMAN_OWNER = 'mailman-owner@%s' % DEFAULT_HOST_NAME + # + # break up presentation of editing member options under admin/listname/members + # into chunks of this size. + # + DEFAULT_CHUNK_SIZE=20 + # System ceiling on number of batches into which deliveries are divided: MAX_SPAWNS = 40 Index: modules/mm_utils.py =================================================================== RCS file: /usr/local/cvsroot/mailman/modules/mm_utils.py,v retrieving revision 1.1.1.1 diff -c -r1.1.1.1 mm_utils.py *** mm_utils.py 1998/04/21 03:27:58 1.1.1.1 --- mm_utils.py 1998/04/21 08:27:54 *************** *** 394,400 **** --- 394,418 ---- Logger.write(self, l) + def chunkify(members, chunksize=mm_cfg.DEFAULT_CHUNK_SIZE): + """ + return a list of lists of members + """ + members.sort() + res = [] + while 1: + if not members: + break + chunk = members[:chunksize] + res.append(chunk) + members = members[chunksize:] + return res + + + + +

1 0

Mailer daemons on the list
by Janne Sinkkonen 21 Apr '98

21 Apr '98

I found two mailer daemons from my mailing list. Not good. :) Here's a theory of how they ended up there: somebody has sent a 'help' to the list-request address. Mailman has replied, but for some reason the reply address has been dysfunctional. The mailer daemon then sends a bounce to the list-request address with the help message in an attachment. mailman processes the message, finds 'subscribe' in there, and subscribes. Would it be possible to include some kind of tag or cookie (maybe an X header) in the outgoing messages? We could then search every incoming request message for the tag, and if we find one, we would then know the history of the message. -- Janne

1 0

Re: [Mailman-developers] membership management developments
by Scott 20 Apr '98

20 Apr '98

On Mon, Apr 20, 1998 at 06:53:50PM +0300, Janne Sinkkonen wrote: | Scott <scott(a)chronis.icgroup.com> writes: | | > to see what these changes look like, please feel free to see | > http://chronis.icgroup.com/mailman/admin/postal/members (password | > postal). i think a little more explanation of the member options is | > in order on the page, but appreciate any and all feedback. | | Seems great. | | A couple of problems though. I get this when trying to get to the 'privacy | options' page: woops. thanks. lets see, each mailling needs to have an attribute defined (confirm_subscribe). (1= on, 0=off). try this: import mm_utils, maillist for listname in mm_utils.list_names(): list = maillist.MailList(listname) list.confirm_subscribe = 0 # or 1 list.Save() | | Traceback (innermost last): | File "/home/mailman/mailman/cgi/admin", line 682, in ? | main() | File "/home/mailman/mailman/cgi/admin", line 124, in main | FormatConfiguration(doc, list, category, category_suffix, cgi_data) | File "/home/mailman/mailman/cgi/admin", line 256, in FormatConfiguration | form.AddItem(FormatOptionsSection(category, list, cgi_data)) | File "/home/mailman/mailman/cgi/admin", line 305, in FormatOptionsSection | big_table.AddRow(GetGuiItem(item, category, list)) | File "/home/mailman/mailman/cgi/admin", line 372, in GetGuiItem | gui_part = RadioButtonArray(varname, params, getattr(list, varname)) | AttributeError: confirm_subscribe | | | Another problem is that with a large mailing list, Netscape draws the | members page with all the options switch very very slowly (making the | page useless, actually). i anticipated as much, and will be working on making it separate the list mmebers table into chunks if the list is large enough over the next few days. One problem that will need to be solved in this respect is authentication. Is it too annoying to require the password for viewing each chunk? is it acceptable to use cookies for authentication of this section? what should the cutoff size of the list be for chunkifying the section? thanks for your feedback Scott

1 0

small bug with roster (and patch)
by Scott 19 Apr '98

19 Apr '98

It seems like cgi/roster was treating lists whose roster subscribers are viewable by members of the list as only viewable by the admin. looks like an indentation error. here's a patch: *** roster Sun Apr 19 19:04:17 1998 --- roster.dist Sun Apr 19 19:05:24 1998 *************** *** 56,66 **** mm_err.MMBadPasswordError): bad = ("%s subscriber authentication failed." % list.real_name) ! else: ! # Anonymous list - admin-only visible ! # - and we already tried admin password, above. ! bad = ("%s admin authentication failed." ! % list.real_name) if bad: doc = error_page_doc(bad) doc.AddItem(list.GetMailmanFooter()) --- 56,66 ---- mm_err.MMBadPasswordError): bad = ("%s subscriber authentication failed." % list.real_name) ! else: ! # Anonymous list - admin-only visible ! # - and we already tried admin password, above. ! bad = ("%s admin authentication failed." ! % list.real_name) if bad: doc = error_page_doc(bad) doc.AddItem(list.GetMailmanFooter()) scott

1 0

confirmation of subscriptions
by Scott 15 Apr '98

15 Apr '98

i have developed a working confirmation step in the subscription process for mailman. there are some things that should be presented for discussion and or polished up before this addition (hopefully) makes it to the distribution. below i've attached a patch to be applied to files in the mailman/modules directory, and an extra module (mm_pending.py). in addtion, i'll put a distribution of the changed modules/*.py files at ftp://chronis.icgroup.com/pub/mmconfirm.tgz all comments and feedback on the following are most welcome. CHANGE ROSTER: new mm_defaults variable DEFAULT_CONFIRM_SUBSCRIBE the admin/listname/privacy page no longer presents the web_subscribe_requires_confirmation, instead it present a new confirm_subscribe option. the subscribe command now uses the following syntax (backwards compatible): subscribe [arg [arg [arg]]] where <arg> can be one of: password, digest|nodigest or address=<subscribe address>. anytime the address= is specified, the confirmation step is triggered regardless of list preference. As an administrator of a high volume mailing site, i strongly encourage us to keep it this way. this will also allow users to subscribe with forwarding addresses. there is a new mail command: confirm <confirmation number> if the confirmation number represents an outstanding subscribe request that is pending confirmation, then the subscription will take place. TODO: make email interface to unsubscribe address= get totally rid of web_subscribe_requires_confirmation in the code because it is no longer visible check to make sure the address= address is being checked as a valid email address. clean up mm_pending.py with __version__ and stuff. NOTE: i'm getting buggy output of the mm_deliver.SUBSCRIBEACKTEXT, and am not sure if it is the result of any of my changes, though it looks like a bug unrelated to these changes at a glance. Scott ----------------------------------------------------------------------------- PATCH ----------------------------------------------------------------------------- diff -c -r /tmp/mailman/modules/maillist.py ./maillist.py *** /tmp/mailman/modules/maillist.py Sun Apr 12 00:34:01 1998 --- ./maillist.py Wed Apr 15 05:19:56 1998 *************** *** 139,144 **** --- 139,145 ---- self.welcome_msg = '' self.goodbye_msg = '' self.open_subscribe = mm_cfg.DEFAULT_OPEN_SUBSCRIBE + self.confirm_subscribe = mm_cfg.DEFAULT_CONFIRM_SUBSCRIBE self.private_roster = mm_cfg.DEFAULT_PRIVATE_ROSTER self.obscure_addresses = mm_cfg.DEFAULT_OBSCURE_ADDRESSES self.member_posting_only = mm_cfg.DEFAULT_MEMBER_POSTING_ONLY *************** *** 282,297 **** " members are admitted only at the discretion of the list" " administrator."), ! ('web_subscribe_requires_confirmation', mm_cfg.Radio, ! ('None', 'Requestor confirms via email', 'Admin approves'), 0, ! 'What confirmation is required for on-the-web subscribes?', ! ! "This option determines whether web-initiated subscribes" ! " require further confirmation, either from the subscribed" ! " address or from the list administrator. Absence of" ! " <em>any</em> confirmation makes web-based subscription a" ! " tempting opportunity for mischievous subscriptions by third" ! " parties."), "Membership exposure", --- 283,296 ---- " members are admitted only at the discretion of the list" " administrator."), ! ('confirm_subscribe', mm_cfg.Radio, ('No', 'Yes'), 1, ! 'Should subscriptions require confirmation step?', ! ! "This option forces all subscription requests to prompt a verification" ! " message to be sent to the subscribing address, and a response from that" ! " address before subscription takes place. This prevents malicious" ! " folk from (mass) subscribing unconsenting owners of email addresses to" ! " mailing lists."), "Membership exposure", diff -c -r /tmp/mailman/modules/mm_defaults.py ./mm_defaults.py *** /tmp/mailman/modules/mm_defaults.py Mon Apr 13 14:09:27 1998 --- ./mm_defaults.py Wed Apr 15 05:30:58 1998 *************** *** 81,86 **** --- 81,88 ---- DEFAULT_REPLY_GOES_TO_LIST = 0 # Admin approval unnecessary for subscribes? DEFAULT_OPEN_SUBSCRIBE = 1 + # confirm neccesary for subscribes? + DEFAULT_CONFIRM_SUBSCRIBE = 1 # Private_roster == 0: anyone can see, 1: members only, 2: admin only. DEFAULT_PRIVATE_ROSTER = 0 # When exposing members, make them unrecognizable as email addrs. To *************** *** 88,96 **** DEFAULT_OBSCURE_ADDRESSES = 1 # Make it 1 when it works. DEFAULT_MEMBER_POSTING_ONLY = 0 - # 1 for email subscription verification, 2 for admin confirmation: - DEFAULT_WEB_SUBSCRIBE_REQUIRES_CONFIRMATION = 1 - # Digestification Defaults # # Will list be available in non-digested form? --- 90,95 ---- diff -c -r /tmp/mailman/modules/mm_mailcmd.py ./mm_mailcmd.py *** /tmp/mailman/modules/mm_mailcmd.py Thu Apr 9 19:48:30 1998 --- ./mm_mailcmd.py Wed Apr 15 05:28:59 1998 *************** *** 6,12 **** # Not implemented: get / index / which. import string, os, sys ! import mm_message, mm_err, mm_cfg, mm_utils option_descs = { 'digest' : 'receive mail from the list bundled together instead of ' --- 6,12 ---- # Not implemented: get / index / which. import string, os, sys ! import mm_message, mm_err, mm_cfg, mm_utils, mm_pending option_descs = { 'digest' : 'receive mail from the list bundled together instead of ' *************** *** 47,53 **** --- 47,55 ---- 'set' : self.ProcessSetCmd, 'options' : self.ProcessOptionsCmd, 'password' : self.ProcessPasswordCmd, + 'confirm': self.ProcessConfirmCmd } + self.__noMailCmdResponse = 0 def AddToResponse(self, text): self._response_buffer = self._response_buffer + text + "\n" *************** *** 84,90 **** self.AddError("%s: Command UNKNOWN." % cmd) else: self._cmd_dispatch[cmd](args, line, mail) ! self.SendMailCmdResponse(mail) def SendMailCmdResponse(self, mail): self.SendTextToUser(subject = 'Mailman results for %s' % --- 86,93 ---- self.AddError("%s: Command UNKNOWN." % cmd) else: self._cmd_dispatch[cmd](args, line, mail) ! if not self.__noMailCmdResponse: ! self.SendMailCmdResponse(mail) def SendMailCmdResponse(self, mail): self.SendTextToUser(subject = 'Mailman results for %s' % *************** *** 338,386 **** self.AddError("%s %s" % (sys.exc_type, sys.exc_value)) self.AddError("%s" % sys.exc_traceback) def ProcessSubscribeCmd(self, args, cmd, mail): digest = self.digest_is_default if not len(args): password = "%s%s" % (mm_utils.GetRandomSeed(), mm_utils.GetRandomSeed()) ! elif len(args) == 1: ! if string.lower(args[0]) == 'digest': ! digest = 1 ! password = "%s%s" % (mm_utils.GetRandomSeed(), ! mm_utils.GetRandomSeed()) ! elif string.lower(args[0]) == 'nodigest': ! digest = 0 ! password = "%s%s" % (mm_utils.GetRandomSeed(), mm_utils.GetRandomSeed()) ! else: ! password = args[0] ! ! elif len(args) == 2: ! if string.lower(args[1]) == 'nodigest': ! digest = 0 ! password = args[0] ! elif string.lower(args[1]) == 'digest': ! digest = 1 ! password = args[0] ! elif string.lower(args[0]) == 'nodigest': ! digest = 0 ! password = args[1] ! elif string.lower(args[0]) == 'digest': ! digest = 1 ! password = args[1] ! else: ! self.AddError("Usage: subscribe [password] [digest|nodigest]") ! return ! elif len(args) > 2: ! self.AddError("Usage: subscribe [password] [digest|nodigest]") ! return try: ! self.AddMember(mail.GetSender(), password, digest) self.AddToResponse("Succeeded.") except mm_err.MMBadEmailError: self.AddError("Email address '%s' not accepted by Mailman." % ! mail.GetSender()) except mm_err.MMMustDigestError: self.AddError("List only accepts digest members.") except mm_err.MMCantDigestError: --- 341,410 ---- self.AddError("%s %s" % (sys.exc_type, sys.exc_value)) self.AddError("%s" % sys.exc_traceback) + + + def ProcessSubscribeCmd(self, args, cmd, mail): digest = self.digest_is_default + password = "" + address = "" + done_digest = 0 if not len(args): password = "%s%s" % (mm_utils.GetRandomSeed(), mm_utils.GetRandomSeed()) ! elif len(args) > 3: ! self.AddError("Usage: subscribe [password] [digest|nodigest]") ! return ! else: ! for arg in args: ! if string.lower(arg) == 'digest' and not done_digest: ! digest = 1 ! done_digest = 1 ! elif string.lower(arg) == 'nodigest' and not done_digest: ! digest = 0 ! done_digest = 1 ! elif string.lower(arg)[:8] == 'address=' and not address: ! address = string.lower(arg)[8:] ! elif not password: ! password = arg ! else: ! self.AddError("Usage: subscribe [arg [arg [arg]]] where <arg> can be\n" ! "\t[password]\n\t[digest|nodigest]\nor" ! "\t[address=<email address>]") ! return ! if not password: ! password = "%s%s" % (mm_utils.GetRandomSeed(), mm_utils.GetRandomSeed()) ! # we don't want people subscribing addresses other than the sender address ! # without an extra confirmation step ! if address or self.confirm_subscribe: ! if not address: ! pending_addr = mail.GetSender() ! else: ! pending_addr = address ! ! cookie = mm_pending.gencookie() ! mm_pending.add2pending(pending_addr, password, digest, cookie) ! self.SendTextToUser(subject = "%s -- confirmation of subscription req. %d" % \ ! (self.real_name, cookie), ! recipient = pending_addr, ! sender = self.GetRequestEmail(), ! text = mm_pending.VERIFY_FMT % ({"email": pending_addr, ! "listaddress": self.GetListEmail(), ! "listname": self.real_name, ! "cookie": cookie, ! "requestor": mail.GetSender()})) ! self.__noMailCmdResponse = 1 ! return ! self.FinishSubscribe(mail.GetSender(), password, digest) + def FinishSubscribe(self, addr, password, digest): try: ! self.AddMember(addr, password, digest) self.AddToResponse("Succeeded.") except mm_err.MMBadEmailError: self.AddError("Email address '%s' not accepted by Mailman." % ! addr) except mm_err.MMMustDigestError: self.AddError("List only accepts digest members.") except mm_err.MMCantDigestError: *************** *** 391,406 **** self.AddApprovalMsg(cmd) except mm_err.MMHostileAddress: self.AddError("Email address '%s' not accepted by Mailman " ! "(insecure address)" % mail.GetSender()) except mm_err.MMAlreadyAMember: ! self.AddError("%s is already a list member." % mail.GetSender()) except: # TODO: Should log the error we got if we got here. self.AddError("An unknown Mailman error occured.") self.AddError("Please forward on your request to %s" % self.GetAdminEmail()) self.AddError("%s" % sys.exc_type) ! def AddApprovalMsg(self, cmd): self.AddError('''Your request to %s: --- 415,451 ---- self.AddApprovalMsg(cmd) except mm_err.MMHostileAddress: self.AddError("Email address '%s' not accepted by Mailman " ! "(insecure address)" % addr) except mm_err.MMAlreadyAMember: ! self.AddError("%s is already a list member." % addr) except: # TODO: Should log the error we got if we got here. self.AddError("An unknown Mailman error occured.") self.AddError("Please forward on your request to %s" % self.GetAdminEmail()) self.AddError("%s" % sys.exc_type) ! ! ! def ProcessConfirmCmd(self, args, cmd, mail): ! if len(args) != 1: ! self.AddError("Usage: confirm <confirmation number>\n") ! return ! try: ! cookie = string.atoi(args[0]) ! except: ! self.AddError("Usage: confirm <confirmation number>\n") ! return ! pending = mm_pending.get_pending() ! if not pending.has_key(cookie): ! self.AddError("Invalid confirmation number!\n" ! "Please recheck the confirmation number and try again.") ! return ! (email_addr, password, digest, ts) = pending[cookie] ! self.FinishSubscribe(email_addr, password, digest) ! del pending[cookie] ! mm_pending.set_pending(pending) ! ! def AddApprovalMsg(self, cmd): self.AddError('''Your request to %s: ---------------------------------------------------------------------- mm_pending.py ---------------------------------------------------------------------- """ module for handling pending subscriptions """ import os import sys import posixfile import marshal import time import rand import mm_cfg DB_PATH = mm_cfg.MAILMAN_DIR + "/misc/pending_subscriptions.db" LOCK_PATH = mm_cfg.LOCK_DIR + "/pending_subscriptions.lock" VERIFY_FMT = """\ You or someone (%(requestor)s) has requested that your email address (%(email)s) be subscribed to the %(listname)s mailling list at %(listaddress)s. If you wish to fulfill this request, please reply to this message, with the following line, and only the following line in the message body: confirm %(cookie)s If you do not wish to subscribe to this list, please simply ignore or delete this message. """ # ' icky emacs font lock thing def get_pending(): " returns a dict containing pending information" try: fp = open(DB_PATH,"r" ) except IOError: return {} dict = marshal.load(fp) return dict def gencookie(p=None): if p is None: p = get_pending() while 1: newcookie = rand.rand() if p.has_key(newcookie): continue return newcookie def set_pending(p): ou = os.umask(0) try: lock_file = posixfile.open(LOCK_PATH,'a+') finally: os.umask(ou) lock_file.lock('w|', 1) fp = open(DB_PATH, "w") marshal.dump(p, fp) fp.close() lock_file.lock("u") lock_file.close() def add2pending(email_addr, password, digest, cookie): ts = int(time.time()) processed = 0 p = get_pending() p[cookie] = (email_addr, password, digest, ts) set_pending(p) def set_processed(cookie, value): p = get_pending() if p.has_key(cookie): (email_addr, listname, password, digest, processed, ts) = p[cookie] processed = value p[cookie] = (email_addr, listname, password, digest, processed, ts) set_pending(p) else: raise ValueError, "attempt to set processed field in pending to non existent cookie (%d)" % (cookie)

1 1

Mailman results for Thread-SIG (fwd)
by Dmitry Khrustalev 15 Apr '98

15 Apr '98

I'm getting the following error from mailman: Date: Sat, 4 Apr 1998 12:12:38 -0500 (EST) From: thread-sig-request(a)python.org To: dima(a)bog.msu.su Subject: Mailman results for Thread-SIG >>>> subscribe **** Email address 'dima(a)bog.msu.su' not accepted by Mailman. When trying to use web interface i get: Mailman won't accept the given email address as a valid address. (Does it have an @ in it???) ( address is dima(a)bog.msu.su ). Can someone look at this problem? -Dima

1 0

First patch -
by Ken Manheimer 14 Apr '98

14 Apr '98

Here's the first mailman 1.0b2 patch. For messages going to the maillist, a blank line between the message headers and the body was lacking, so if the first line of the body looked like a header (eg, 'http://www.python.org/'!), it would be included among the headers. Here's the checkin message and the patch. You need to apply the patch from the modules directory, if you use 'patch'. Ken .DeliverToList(): Was missing a newline between message headers and body, so initial body lines that looked like header would be incorporated in header. *** mm_deliver.py.1.18 Tue Apr 14 18:01:34 1998 --- mm_deliver.py Tue Apr 14 18:01:34 1998 *************** *** 122,138 **** msg.headers.append('To: %s\n' % self.GetListEmail()) else: tempfile.template = tmpfile_prefix + 'mailman.' msg.headers.append('Errors-To: %s\n' % self.GetAdminEmail()) tmp_file_name = tempfile.mktemp() tmp_file = open(tmp_file_name, 'w+') ! tmp_file.write(string.join(msg.headers,'')) ! # If replys don't go to the list, then they should go to the ! # real sender ! if self.reply_goes_to_list: ! tmp_file.write('Reply-To: %s\n\n' % self.GetListEmail()) ! if header: tmp_file.write(header + '\n') tmp_file.write(self.QuotePeriods(msg.body)) if footer: --- 122,136 ---- msg.headers.append('To: %s\n' % self.GetListEmail()) else: tempfile.template = tmpfile_prefix + 'mailman.' + if self.reply_goes_to_list: + msg.headers.append('Reply-To: %s\n' % self.GetListEmail()) msg.headers.append('Errors-To: %s\n' % self.GetAdminEmail()) tmp_file_name = tempfile.mktemp() tmp_file = open(tmp_file_name, 'w+') + tmp_file.write(string.join(msg.headers,'') + '\n') ! if header: # The *body* header: tmp_file.write(header + '\n') tmp_file.write(self.QuotePeriods(msg.body)) if footer:

1 0

Release location
by Ken Manheimer 13 Apr '98

13 Apr '98

Daggone it, neglected to say where to find it: ftp://ftp.python.org/pub/python/contrib/Network/mailman.tar.gz Ken

1 0

Mailman 1.0b2 available
by Ken Manheimer 13 Apr '98

13 Apr '98

Finally, i've got a complete package of mailman 1.0b2 ready for consumption. This has some substantial features beyond friday(?)'s prerelease, particularly support for private archives and fix of a bug handling addresses containing quotes. It also has lots of niggles polished in preparing the release, so i'd strongly suggest using getting this version even if you got the prerelease. Here's the encompassing README. I (in the grand Python tradition - didn't mean to do it, but i can see now how this happens) will be away the rest of this week, for the most part, but may be able to field some immediate problems or whatever tomorrow. Below is the encompassing README - cheers! Ken Manheimer klm(a)python.org 703 620-8990 x268 (orporation for National Research |nitiatives # If you appreciate Python, consider joining the PSA! # # <http://www.python.org/psa/>. # Distribution README for mailman 1.0b2. This is mailman v1.0b2.0 - probably the first real, full-function beta-level release of V1. In case you don't know, mailman is a maillist management system with full web-based administration and membership interfaces. It is written almost wholly in Python, and nicely extensible. See the README in the mailman directory for more details. To use it, unpack the tar file and move the mailman directory to within ~mailman on your system. See the README in the mailman directory for more details. Mailman was devised by John Viega, who developed it pretty far but lost later versions in a system crash. The current version is based on an early release (1.0b1) that john did which i (ken manheimer) picked up and stashed away, until such time that i could pay attention to it. Turns out i had one of the most recent surviving copies, so it became the basis of the current system. However, that version was in some ways still at the prototype stage, so i've spent some time polishing it up, enough at first to get it running for use with the maillists here at python.org, and perhaps a bit more to get it looking better, easier to use, and a bit more solid. I'd say this release, if not ready for prime time, is ready for general use and development. Below is a list of the major new features added since the original release (1.0b1.1), bugs stomped and still pending, and thoughts about further develpment necessary and/or desirable. For anyone interested in joining in on the development crowd, or just tracking the progress, there's a maillist for you to join (we're considering using mailman to run it - kidding!), mailman-developers(a)python.org. Visit http://www.python.org/mailman/listinfo/mailman-developers for more info. New Features Web pages much more polished - Better organized, text more finely crafted - Easier, more refined layout - List info and admin interface overviews, enumerate all public lists (via, e.g., http://www.python.org/mailman/listinfo - sans the specific list) - Admin interface broken into sections, with help elaboration for complicated configuration options Maillist Archives - Integrated with a newer, *much* improved, external pipermail - to be found at http://starship.skyport.net/crew/amk/maintained/pipermail.html - Private archives protected with maillist members passwords, cookie-fied. Spam prevention - New spam prevention measures catch most if not all spam without operator intervention or general constraints on who can post to list: require_explicit_destination option imposes hold of any postings that do not have the list name in any of the to or cc header destination addresses. This catches the vast majority of random spam. Other options (forbidden_posters, bounce_matching_headers) provide for filtering of known transgressors. - Option obscure_addresses (default on) causes maillist subscriber lists on the web to be slightly mangled so they're not directly recognizable as email address by web spiders, which might be seeking targets for spammers. Site configuration arrangement organized - in mailman/mailman/modules: - When installing, create a mailman/modules/mm_cfg.py (if there's not one already there), using mm_cfg.py.dist as a template. mm_default.py contains the distributed defaults, including descriptions of the values. mm_cfg.py does a 'from mm_defaults.py import *' to get the distributed defaults. Include settings in mm_cfg.py for any values in mm_defaults.py that need to be customized for your site, after the 'from .. import *'. See mm_cfg.py.dist for more details. Logging - Major operations (subscription, admin approval, bounce, digestification, cgi script failure tracebacks) logged in files using a reliable mechanism - Wrapper executables log authentication complaints via syslog Wrappers - All cgi-script wrapper executables combined in a single source, easier to configure. (Mail and aliases wrappers separate.) List structure version migration - Provision for automatic update of list structures when moving to a new version of the system. See modules/versions.py. Code cleaning - Many more module docstrings, __version__ settings, more function docstrings. - Most unqualified exception catches have been replaced with more finely targeted catches, to avoid concealing bugs. - Lotsa long lines wrapped (pet peeve:). Many Bugs Stomped ----------------- Many bugs stomped. Some memorable ones: - Subscriber addresses containing quotes (eg, Ken_O'Manheimer(a)python.org) were not properly escaped to survive transmission through shell to sendmail - Specifying a non-existent user for editing user options now complains immediately, rather than presenting a form. - Ad-hoc /tmp log files (which could bollix things if unwritable) gone - User changing from digest to non-digest and vice versa doesn't escape sort order. - Users are not sorted by address, internally - only on presentation - htmlformat.py no longer silently hides bugs in format operations. Instead, unexpected objects show as repr() would - easier to debug, without making htmlformat fragile. - File creation bracketed by proper umask setting to ensure specified file permissions. - Notices are sent for rejections of moderated postings (but not for discarded ones). - Web pages now all have titles. - Duplicate approvals of subscription requests do not lead to duplicate memberships. Pending bugs ------------ - Mime digests a bit feeble - postings containing mime attachments not properly handled - Bounce processing - Turning off bounce processing doesn't? - Turning on non-member-post exclusion doesn't - More generally mm_utils.AddressesMatch() needs to be really thought out. For instance, klm(a)python.org vs klm(a)acm.org should be seen as different, but klm(a)parrot.python.org and klm(a)larch.python.org and klm(a)python.org should probably be seen as the same. There may be more criteria... - Bounces of the confirmation notices sent to people attempting web-based subscriptions are, necessarily, directed (via reply-to header) to maillist-request addr, and get mishandled there as unrecognized requests. Not sure how to solve this one short of recognizing bad subscriber addrs before sending out the notice. Pending Developments and Issues ------------------------------- Some modest Pending Refinements: - Use re module everywhere instead of regexp and regsub. - Implement a reasonable administrivia filter for lists (but less likely to misfire than majordomo's) (administrivia is, eg, unsubscribe request mistakenly sent to list posting addr) - Refine any unqualified exception guards to specify target exceptions. - Turn standard mailman exceptions into class exceptions. - Implement cookies (with moderate lifetimes) for user and admin passwords. - Unravel edit-options functionality from cgi/subscribe script - give edit-options a script of its own. (Not imperative, maybe when the bigger project of implementing member profiles is done.) - Relax constraint that everything be installed in /home/mailman. (I'll probably do this for the next release. We can probably use relative paths for most things, particularly the routine sys.path setting in all the python code, and possibly for the wrappers.) - Foolproof list deletion (bin/rmlist) a bit by asking for password (and have list admin or site password work). - Should member deletion be confirmed with email? - Submission of edited user options should return to edit-options page, like admin options pages do. - People mass subscribed on admin form should not require approval, even for closed-subscribe lists. Some bigger Pending Projects - User and Admin Guides - HOWTOs - Developers guide - documentation - Implement email interface to admin commands. - Implement a 'which' mailcmd. (Probably not hard! May be good intro project for someone wading into mailman development.) - Put the admin interface and other things like private subscriber rosters *behind* passwords, like the private archives are. Eg, instead of putting the password box on the listinfo form, have it always be just a regular link to the roster, but then the roster page would be a password page if the roster is private and there's no cookie for it. - Generalize and refine admindb so that pending bounces, subscriptions, etc are stored in the filesystem, nicely catalogued, and the interfaces for handling them (eg, admindb) shows succinct summaries, with links to see the entire things. (I may work on this.) - Develop subscription mechanisms so real confirmation happens, and use that as basis for option to change existing subscription delivery address. (Scott cotton is working on this.) - Deliver by connect to SMTP 25 instead of sendmail. (I'm checking in modules/smtplib.py module john's played with some.) - Robustify aliases handling to not just append entries if they already exist, and ideally, edit existing ones if they need to change. - Implement a real admin/membership-management section, that includes includes hidden subscribers, provides easy perusal and changing of all members (including concealed members) status, including disabling or removal from list. - Implement some automated validation of installation - check for obvious problems with options settings, file access permissions, sendmail hookup, etc. ? Have an implicit list-managers list for every site, which includes all the list managers? - Make listinfo page static, regenerated every time admin options are changed. This will speed up and reduce load for listinfo page loading. More Fundamental, or just more bigger:), Pending Projects - Refine locking to only necessary sections, so there's less room for unnecessary contention. - Implement the system as a persistent server. (John's planning to do this.) - Implement member profiles, using a class. For name, organization, description, etc, and defaults options settings. The lists, themselves, could still have copies of the specific passwords and the compact bitmaps (for the sake of efficiency) for list-specific options like digest/nondigest, but the user could set their default choices - delivery address, password, delivery mode - in their profile.

1 0