Hi all,

This is a little embarrassing, but I thought y'all might deserve a heads-up. Note, this is not a bug, except in my brain. And maybe yours but probably not ;-).

A couple years ago I converted my Mailman 2 site from HTTP to HTTPS. The site is visible externally to my university, thus HTTPS, but almost entirely used for announcements, which partly explains how I missed this (more on that later). I tried to release a held message from the moderation page, and this failed repeatedly. Eventually I realized that I wasn't getting a response page at all. I'm guessing that what happened is this:

1. I added a virtual host on :443 in my Apache server config to accept Mailman requests via HTTPS (the rest of the URLs are the same).
2. I added a global redirect rule that returns a redirect of every HTTP request as an https: URL.
3. The request for moderation action gets redirected, invalidating the CSRF cookie.
4. The redirected request has an invalid cookie, which gets ignored, and it is discarded.

The fix is obvious: run bin/fix_url.py on all my lists.

You're allowed to laugh now, but try to not scare the fish. :-)

How I missed this, and you might too: because these are announcement list configured to my normal usage, there's very little in the way of web interaction on the moderation side, but list configuration works, so I didn't notice it there. (I caught it this time because I got moderated due to a very large post.) I don't understand why moderation fails but list configuration works in my configuration (the list configuration pages also have CSRF cookies).

If you care, ask and I'll figure it out. I probably should figure it out since it suggests that some CSRF cookies may persist for more than one request, or Mailman may somehow reissue the CSRF cookie in some circumstances. Explanations that save me the effort appreciated! ;-)

Steve