Bug in SUBSCRIBE_FORM_SECRET feature?
Hi, I installed Mailman 2.1.17 last night (upgrade from 2.1.15) and decided to give the SUBSCRIBE_FORM_SECRET feature a try, since we don't use static subscribe forms. All seemed well, but this morning I noticed that the listinfo page for some of the lists didn't work anymore. Here's an example from the error log: Dec 18 10:15:43 2013 admin(328): @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ admin(328): [----- Mailman Version: 2.1.17 -----] admin(328): [----- Traceback ------] admin(328): Traceback (most recent call last): admin(328): File "/usr/lib/mailman/scripts/driver", line 117, in run_main admin(328): main() admin(328): File "/usr/lib/mailman/Mailman/Cgi/listinfo.py", line 65, in main admin(328): list_listinfo(mlist, language) admin(328): File "/usr/lib/mailman/Mailman/Cgi/listinfo.py", line 194, in list_listinfo admin(328): mlist.internal_name() + admin(328): TypeError: unsupported operand type(s) for +: 'int' and 'str' admin(328): [----- Python Information -----] admin(328): sys.version = 2.7.6 (default, Nov 11 2013, 12:26:23) [GCC 4.4.7 20120313 (Red Hat 4.4.7-1)] admin(328): sys.executable = /usr/bin/python2.7 admin(328): sys.prefix = /usr admin(328): sys.exec_prefix = /usr admin(328): sys.path = ['/usr/lib/mailman/pythonlib', '/usr/lib/mailman', '/usr/lib/mailman/scripts', '/usr/lib/mailman', '/usr/lib/python27.zip', '/usr/lib/python2.7/', '/usr/lib/python2.7/plat-linux2', '/usr/lib/python2.7/lib-tk', '/usr/lib/python2.7/lib-old', '/usr/lib/python2.7/lib-dynload', '/usr/lib/python2.7/site-packages'] admin(328): sys.platform = linux2 admin(328): [----- Environment Variables -----] admin(328): SERVER_SOFTWARE: Apache/2.2.3 (Red Hat) admin(328): SCRIPT_NAME: /mailman/listinfo ... When I looked at line 194 in /usr/lib/mailman/Mailman/Cgi/listinfo.py, I noticed that it handles the SUBSCRIBE_FORM_SECRET feature. So I disabled the feature, restarted Mailman, and now the listinfo page works again. Cheers, Sebastian -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.
On 12/18/2013 01:27 AM, Sebastian Hagedorn wrote:
I installed Mailman 2.1.17 last night (upgrade from 2.1.15) and decided to give the SUBSCRIBE_FORM_SECRET feature a try, since we don't use static subscribe forms. All seemed well, but this morning I noticed that the listinfo page for some of the lists didn't work anymore. Here's an example from the error log:
...
admin(328): File "/usr/lib/mailman/Mailman/Cgi/listinfo.py", line 194, in list_listinfo admin(328): mlist.internal_name() + admin(328): TypeError: unsupported operand type(s) for +: 'int' and 'str'
It appears that you put something like
SUBSCRIBE_FORM_SECRET = Yes
in mm_cfg.py. If you set SUBSCRIBE_FORM_SECRET, it must be a string as for example:
SUBSCRIBE_FORM_SECRET= 'My little SecreT'
This is intended to be a string unique to your site so an attacker can't compute the hash needed in sub_form_token.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
--On 18. Dezember 2013 07:04:14 -0800 Mark Sapiro <mark@msapiro.net> wrote:
On 12/18/2013 01:27 AM, Sebastian Hagedorn wrote:
I installed Mailman 2.1.17 last night (upgrade from 2.1.15) and decided to give the SUBSCRIBE_FORM_SECRET feature a try, since we don't use static subscribe forms. All seemed well, but this morning I noticed that the listinfo page for some of the lists didn't work anymore. Here's an example from the error log:
...
admin(328): File "/usr/lib/mailman/Mailman/Cgi/listinfo.py", line 194, in list_listinfo admin(328): mlist.internal_name() + admin(328): TypeError: unsupported operand type(s) for +: 'int' and 'str'
It appears that you put something like
SUBSCRIBE_FORM_SECRET = Yes
in mm_cfg.py. If you set SUBSCRIBE_FORM_SECRET, it must be a string as for example:
SUBSCRIBE_FORM_SECRET= 'My little SecreT'
This is intended to be a string unique to your site so an attacker can't compute the hash needed in sub_form_token.
Thanks, that solved the problem.
Cheers Sebastian
.:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:.
.:.Regionales Rechenzentrum (RRZK).:..:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.
participants (2)
-
Mark Sapiro -
Sebastian Hagedorn