I think I found a bug in mailman. If you get an email confirmation for a pending request and you go to the web page. If you hit 'cancel' it will to to Mailman/Cgi/confirm.py will call subscription_cancel :

def subscription_cancel(mlist, doc, cookie): # Discard this cookie userdesc = mlist.pend_confirm(cookie)[1] lang = userdesc.language i18n.set_language(lang) doc.set_language(lang) doc.AddItem(_('You have canceled your subscription request.'))

The problem is in mlist.pend_confirm:

def pend_confirm(self, cookie, expunge=True):
    """Return data for cookie, or None if not found.

    If optional expunge is True (the default), the record is also removed
    from the database.
    """
    db = self.__load()
    # If we're not expunging, the database is read-only.
    if not expunge:
        return db.get(cookie)
    # Since we're going to modify the database, we must make sure the list
    # is locked, since it's the list lock that protects pending.pck.
    assert self.Locked()
    content = db.get(cookie, _missing)
    if content is _missing:
        return None
    # Do the expunge
    del db[cookie]
    del db['evictions'][cookie]
    self.__save(db)
    return content

There is an assert self.Locked() which will always fail because we've never locked the list. The question is what's the correct thing to do here? It seems the safe thing to do is the wrap a lock the call to pend_confirm in subscription_cancel, but is pending.pck even used anymore? If not do we still need the lock? It seems like we would because we're going to be updating whereever the db is...

Just asking because I'm not very familiar with this part of the code.

Thien