Mailman 3 August 2018 - Mailman-Users

Submitting the members page
by Bernie Cosell 07 Aug '18

07 Aug '18

Just for reference: I just checked and when I make a change in just one list member, includes a bit of stuff: csrf_token and findmember and setmemberopts_btn and allmodbit_val For every member on the page: _realname, user, _language, Plus, every checkbox that is "on" is also sent. I know that manyof you think I'm nuts and all this hassle I'm going through to program-submit mailman's forms is silly. But: I manage 8 lists now [it'll soon be nine or ten] and it is really very nice that I can open a windows command prompt and just type mailman LIST1 -s jim jim(a)hisdomain.com and in one stroke "jim" is "subscribed" [-u unsubscribes, etc] [not to mention how much I've learned about the wonders of the web developer addin for Firefox...:o)] /Bernie\ Bernie Cosell bernie(a)fantasyfarm.com -- Too many people; too few sheep --

2 1

scrub set to No but message says scrubbed
by Loren Engrav 07 Aug '18

07 Aug '18

Hi (newbie to this) Mailman 2.1.26 MacOS 10.13.6 I have scrub of regular delivery in non-digest set to No but when I peruse a message with attachments in Archives it says they were scrubbed and in the message the attachments appear, not a link what am I missing? thank you

2 1

Unexpected password reminder from this list
by Jayson Smith 07 Aug '18

07 Aug '18

Hi, Last night at 11:15 or so, I received a password reminder from Mailman-users, with my correct password. Only problem is, I never requested such a reminder. Did anyone else get one, was someone testing something with a random sample of subscribers, or was I targeted (not realizing that they'd have to hack my Email account to get the password)? Thanks, Jayson

5 8

Re: [Mailman-Users] Banned Addresses
by Mike Flannigan 06 Aug '18

06 Aug '18

It is Postorius. Thank you. I am in the process of subscribing. Mike On 8/6/2018 11:00 AM, mailman-users-request(a)python.org wrote: If this is Mailman 3/Postorius the appropriate list is mailman-users(a)mailman3.org <https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/>.

1 0

Banned Addresses
by Mike Flannigan 06 Aug '18

06 Aug '18

We have lists with a lot of banned addresses. Is it necessary to click on a white X in a red box for each address removed, or is there a trick with the reg expression box to remove banned addresses? In most cases we want to remove ALL of the banned addresses. Mike

3 2

Re: [Mailman-Users] POST problem fixed!
by Bernie Cosell 06 Aug '18

06 Aug '18

> I discovered, after much mucking around, that the problem > is that Mailman requires all of the form fields to be > submitted. Just a footnote to this: If you have a big list and you're trying to, say, change the 'nomail' setting via the membership page, you're going to have a *lot* of POST parameters! Every person subscribed to the list that's listed on that page will generate something like 10 form variables. That's going to be a *big* POST! Just to flip one bit..:o) /Bernie\ Bernie Cosell bernie(a)fantasyfarm.com -- Too many people; too few sheep --

2 1

POST problem fixed!
by Bernie Cosell 06 Aug '18

06 Aug '18

I discovered, after much mucking around, that the problem is that Mailman requires all of the form fields to be submitted. So unsubscribing with just @fields = ( unsubscribees => "$email", setmemberopts_btn => "Submit Your Changes", ) ; Doesn't work. What does work is: @fields = ( send_unsub_ack_to_this_batch => 0, send_unsub_notifications_to_list_owner => 1 , unsubscribees => "$email", setmemberopts_btn => "Submit Your Changes", Content => { unsubscribers_upload => "" }, ) ; YAY! /Bernie\ Bernie Cosell bernie(a)fantasyfarm.com -- Too many people; too few sheep --

2 1

Automatic web subscription format
by Jason Wandel 06 Aug '18

06 Aug '18

Hi all, I'm using mm 2.1.26 on a lamp install from a hosting company... But have downloaded the code to look through locally. I'm trying to automatically subscribe/unsubscribe members to an already restricted access list. This is because I have a separate webform that's used to select people already in our non-mm database. I've found some info including on the list history (one from back in 2001 though the link provided on that no longer exists). I think I'm most of the way there, I'm now getting a "bad/invalid email address" error from the following (obscured) url, reporting on the Firstname Lastname: http://domain/mailman/admin/list_domain/members/add?subscribe_or_invite=0&s… notification_to_list_owner=0&subscribees=Firstname%20Lastname%20<email@otherdomain>&adminpw=the password I've tried without quotes and with single or double quotes around the name and the name/address combo, all without success. It looks like I'm getting a failure due to email.Utils.parseaddr as called from admin.py (I think line 1465), which supposedly accepts double quotes around the name portion. Could I please ask for guidance on the format needed to make this work? TIA!

2 3

trouble with q.com address
by Loren Engrav 03 Aug '18

03 Aug '18

Hi Have list with ~50 members. One fails to receive messages with email ending in @q.com. And I see notice that Mailman is having trouble (bounces) from that address. Where do I start to sort this out? Thank you

2 1

Re: [Mailman-Users] Mod_Security
by tlhackque 02 Aug '18

02 Aug '18

On 08/01/2018 09:43 AM, Bernie Cosell wrote: > And I tried my program on the Bluehost version and I was greeted with > > Not Acceptable!</title></head><body><h1>Not > Acceptable!</h1><p>An appropriate representation of the requested > resource could not be found on this server. This error was generated by > Mod_Security.< mod_security is an Apache webserver module that has a complex ruleset used to examine every request and response. It attempts to detect and prevent malicious activity. Doc on https://www.modsecurity.org. It is not uncommon for form submissions to run afoul of mod_security rules. Typically, there are cases where data is encoded in ways that appear to be hiding something - e.g. %-encoding urls or POST data where it's not necessary, excessively long URLs or large POSTs - and so on. There's a pretty large list. Most are regex s applied at various stages of request processing; some are based on things like request size. Some are rules that assume a pretty dumb web service; where you know that Mailman can cope with constructs/sizes/encodings, you're expected to disable those rules on the URLs that it serves. There will be logs on the server that specify exactly what rule was tripped, it's id, and the suspect input. Then there are three courses of action possible: o The rule can be disabled by ID in the webserver config, for the specific mailman POST URL (or globally, but that's not smart). It's also possible to completely disable mod_security for a URL or vhost - but that's also not advisable. o Mailman can be changed to not require input that trips the rule. o Your client can be changed not to generate input that trips the rule. You will need help from someone with admin privs to at least share the logs, if not make adjustments to the mod_security configuration. Like any protective filter, it takes some thought and analysis to make the right changes. That is the change that allows what you want, but doesn't open an unintended attack surface. In my experience, these issues are never caused by just one rule - if an application trips one, waiving or fixing it will only get you to the next one. It can take a while to get to a workable ruleset. It is generally worth the trouble, as mod_security is effective at protecting against quite a few exploits. It does take a while to learn how it works and how to teach it how to stay out of your way. There are two things likely to be changed on the server end: The webserver config file that will include directives to disable specific rules on particular URLs. And possibly a set of customized rule overrides for Mailman. (These can go in separate files that are dropped in the rules directory.) Once that's done, sharing the result with the MM community would save others a lot of repeat effort. Good hunting.

1 0

Mailman-Users August 2018