USE_ENVELOPE_SENDER is not flexible enough
For members-only lists like this one, USE_ENVELOPE_SENDER currently allows the admin to determine membership by checking either the From: header, OR the envelope sender address.
I think a more flexible alternative would be to first check the envelope sender, and then the From: header for a match. In fact, this would make sense as the default setting IMHO.
Why am I interested in this? Because I like to post to public mailing lists and newsgroups with a 'dated' address that expires after a set period of time to thwart SPAM harvesters. Obviously I can't use these one-time addresses on closed lists, but I could get around this by posting with an envelope sender address that matches my subscription address, and a 'dated' address in my From: header. The closed list would be happy, and I would be happy.
-- (TMDA (http://tmda.sourceforge.net/) (UCE intrusion prevention in Python)
"JRM" == Jason R Mastaler <jason-list-mailman-developers@mastaler.com> writes:
JRM> For members-only lists like this one, USE_ENVELOPE_SENDER
JRM> currently allows the admin to determine membership by
JRM> checking either the From: header, OR the envelope sender
JRM> address.
JRM> I think a more flexible alternative would be to first check
JRM> the envelope sender, and then the From: header for a match.
JRM> In fact, this would make sense as the default setting IMHO.When USE_ENVELOPE_SENDER was the default, it was next to useless because it rarely matched the sender's membership address. So that's why it was disabled.
It probably would be best to add a method get_author() which returned a list of (From_, From:, Sender:) for comparison, and we'd have to evaluate each get_sender() call site to see if it was doing such a comparison or just trying to find an address to use (in which case, I guess you still trust From: first?). In either case, you'd have to change every affected call site to do an `in' test instead of an == test.
What do others think? This is such an integral part of the logic that I'm a bit wary to change it, but if we were to change things, now would be the time.
Jason, do you think you could whip together a patch against CVS, based on the above sketch? If so, attach it to your feature request and I'll take a look.
-Barry
barry@zope.com (Barry A. Warsaw) writes:
When USE_ENVELOPE_SENDER was the default, it was next to useless because it rarely matched the sender's membership address. So that's why it was disabled.
Understandable. By the same token, there are cases where From doesn't match, but the envelope sender does. Checking both by default will satisfy all cases.
Jason, do you think you could whip together a patch against CVS, based on the above sketch?
Sure, I'll give it a shot. Thanks.
-- (TMDA (http://tmda.sourceforge.net/) (UCE intrusion prevention in Python)
"JRM" == Jason R Mastaler <jason-list-mailman-developers@mastaler.com> writes:
>> When USE_ENVELOPE_SENDER was the default, it was next to
>> useless because it rarely matched the sender's membership
>> address. So that's why it was disabled.
JRM> Understandable. By the same token, there are cases where
JRM> From doesn't match, but the envelope sender does. Checking
JRM> both by default will satisfy all cases.True. I wonder if Reply-To: ought to be added to the mix? Note that all are easily spoofable, so that argument doesn't bother me much.
If so, the order ought to go (I think)
From:
From_
Reply-To:
Sender:
Jason, do you think you could whip together a patch against CVS, based on the above sketch?
JRM> Sure, I'll give it a shot. Thanks.
Cool.
Thanks, -Barry
barry@zope.com (Barry A. Warsaw) writes:
True. I wonder if Reply-To: ought to be added to the mix?
It wouldn't hurt. FWIW, TMDA checks Reply-To: in addition to From: and the envelope sender.
Note that all are easily spoofable, so that argument doesn't bother me much.
Exactly. Which is why I don't understand why all MLMs don't do this. It just makes things more difficult for list subscribers. Majordomo checks just From: and Reply-To:, ezmlm checks just the envelope sender, etc. Well, at least we are "fixing" this here.
If so, the order ought to go (I think)
- From:
- From_
- Reply-To:
- Sender:
Alrighty.
-- (TMDA (http://tmda.sourceforge.net/) (UCE intrusion prevention in Python)
"JRM" == Jason R Mastaler <jason-list-mailman-developers@mastaler.com> writes:
JRM> Well, at least we are "fixing" this here.<evil laugh="manical"> Mailman shall rule THE WORLD! </evil>
>> If so, the order ought to go (I think)
>> 1. From: 2. From_ 3. Reply-To: 4. Sender:
JRM> Alrighty.Cool, thanks. -Barry
"BAW" == Barry A Warsaw <barry@zope.com> writes:
BAW> <evil laugh="manical">
BAW> Mailman shall rule THE WORLD!
BAW> </evil>Take a number, man. (See .sig.)
-- University of Tsukuba Tennodai 1-1-1 Tsukuba 305-8573 JAPAN Institute of Policy and Planning Sciences Tel/fax: +81 (298) 53-5091
What are those straight lines for? "XEmacs rules."
"SJT" == Stephen J Turnbull <stephen@xemacs.org> writes:
"BAW" == Barry A Warsaw <barry@zope.com> writes:
BAW> <evil laugh="manical"> Mailman shall rule THE WORLD! </evil>
SJT> Take a number, man. (See .sig.)
| What are those straight lines for? "XEmacs rules."Hard to argue with that, seeing as how I've used XEmacs since about the Lemacs 19.0 or 19.1 (hard to remember now :) days!
-Barry
barry@zope.com (Barry A. Warsaw) writes:
It probably would be best to add a method get_author() which returned a list of (From_, From:, Sender:) for comparison
Alright, I've added a get_author() method to Mailman.Message which returns a list containing the From:, unixfrom, Reply-To:, and Sender: addresses depending on availability.
and we'd have to evaluate each get_sender() call site to see if it was doing such a comparison or just trying to find an address to use (in which case, I guess you still trust From: first?). In either case, you'd have to change every affected call site to do an `in' test instead of an == test.
I don't see any `==' tests, but rather things like:
if mlist.isMember(sender)I've started replacing them with code that looks something like this:
for author in msg.get_author():
if mlist.isMember(author):
sender = author
breakAm I on the right track, or did you have something else in mind?
-- (TMDA (http://tmda.sourceforge.net/) (UCE intrusion prevention in Python)
participants (3)
-
barry＠zope.com -
Jason R. Mastaler -
Stephen J. Turnbull