Dear all,
I just started a new mailing list with Mailman. The welcome_msg is in German and contains üäö. Then I subscribed myself to the list and got the following:
Hallöchen, Beiträge erwünscht, aber übertreibt es nicht, ne.
Furthermore, if I know log into the admin area, it gives the same text, that is, with all non-ASCII replaced by entities!
Another bug to file?!
H.
Opgepast | Achtung | Attention adressen gewijzigd! Adressen geändert! adresses changed!
Hendrik Maryns Biesingerstraße 5 D-72070 Tübingen +491753353494 hamaryns@googlemail.com http://tcl.sfs.uni-tuebingen.de/~hendrik/
Hendrik Maryns wrote:
I just started a new mailing list with Mailman. The welcome_msg is in German and contains üäö. Then I subscribed myself to the list and got the following:
Hallöchen, Beiträge erwünscht, aber übertreibt es nicht, ne.
What is the list's preferred language? If it is English (or if it was English when you set the welcome_msg), this is expected because Mailman's character set for English is us-ascii and the page you're posting from was sent with charset=us-ascii so your browser sends the non-ascii characters as numeric html entities.
If the list's preferred language is German, whose charset is iso-8859-1, when you set the welcome_msg, this should not happen.
Furthermore, if I know log into the admin area, it gives the same text, that is, with all non-ASCII replaced by entities!
The reason you see the numeric HTML entities rather that the browser's rendering of them is over-protective escaping of the '&' in the HTML entity, but in this case, that's actually appropriate because the ultimate use of this message is in a plain text email where the HTML entities won't be rendered as characters anyway.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
Op 21-03-09 20:03 heeft Mark Sapiro als volgt van zich laten horen:
Hendrik Maryns wrote:
I just started a new mailing list with Mailman. The welcome_msg is in German and contains üäö. Then I subscribed myself to the list and got the following:
Hallöchen, Beiträge erwünscht, aber übertreibt es nicht, ne.
What is the list's preferred language? If it is English (or if it was English when you set the welcome_msg), this is expected because Mailman's character set for English is us-ascii and the page you're posting from was sent with charset=us-ascii so your browser sends the non-ascii characters as numeric html entities.
If the list's preferred language is German, whose charset is iso-8859-1, when you set the welcome_msg, this should not happen.
Indeed. The problem is that Mailman assumes a list is English by default. If I create a new list, I start editing its settings. What you see first, is the welcome message etc. Only afterwards, I click through to the language settings and change it to German. This causes the problem.
So a useful RFE would be to either not assume English, or to ask for the language at setup (or at first administrator login, since often a sysadmin will create the list and then hand it over to the list admin).
Also, I noticed it is not possible to *remove* English as a list language. I do not see why. I certainly don’t need it in my lists.
Furthermore, if I know log into the admin area, it gives the same text, that is, with all non-ASCII replaced by entities!
The reason you see the numeric HTML entities rather that the browser's rendering of them is over-protective escaping of the '&' in the HTML entity, but in this case, that's actually appropriate because the ultimate use of this message is in a plain text email where the HTML entities won't be rendered as characters anyway.
Yes. Caution is good, but isn’t this exaggerated?
H.
Opgepast | Achtung | Attention adressen gewijzigd! Adressen geändert! adresses changed!
Hendrik Maryns Biesingerstraße 5 D-72070 Tübingen +4970717783365 hamaryns@googlemail.com http://tcl.sfs.uni-tuebingen.de/~hendrik/
Hendrik Maryns writes:
Yes. Caution is good, but isn’t this exaggerated?
No. It's not just your systems that are at risk. Mine are, too. Remember, almost all of these measures are taken because someone has demonstrated a similar exploit, and most exploits are not done for their own sake, but rather to achieve a platform for cracking more systems.
Of course, if you're a security expert and know what risks are present, and are sure they don't apply to your system, Mailman is open source, you can change it. If that sounds like too much work, don't you see that probably means you don't really have enough resources to change the settings and still be secure? On the other hand, systems and their environments are infinitely variable. The Mailman developers can not know enough about your system to make those decisions, either.
Hendrik Maryns wrote:
Indeed. The problem is that Mailman assumes a list is English by default. If I create a new list, I start editing its settings. What you see first, is the welcome message etc. Only afterwards, I click through to the language settings and change it to German. This causes the problem.
So a useful RFE would be to either not assume English, or to ask for the language at setup (or at first administrator login, since often a sysadmin will create the list and then hand it over to the list admin).
It's already there - see the documentation for DEFAULT_SERVER_LANGUAGE in Defaults.py.
Set
DEFAULT_SERVER_LANGUAGE = 'de'
in mm_cfg.py and lists will be created with German as their preferred_language.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
Op 05-05-09 20:02 heeft Mark Sapiro als volgt van zich laten horen:
Hendrik Maryns wrote:
Indeed. The problem is that Mailman assumes a list is English by default. If I create a new list, I start editing its settings. What you see first, is the welcome message etc. Only afterwards, I click through to the language settings and change it to German. This causes the problem.
So a useful RFE would be to either not assume English, or to ask for the language at setup (or at first administrator login, since often a sysadmin will create the list and then hand it over to the list admin).
It's already there - see the documentation for DEFAULT_SERVER_LANGUAGE in Defaults.py.
Set
DEFAULT_SERVER_LANGUAGE = 'de'
in mm_cfg.py and lists will be created with German as their preferred_language.
I’ll mention this to the server administration, thanks!
H.
Opgepast | Achtung | Attention adressen gewijzigd! Adressen geändert! adresses changed!
Hendrik Maryns Biesingerstraße 5 D-72070 Tübingen +4970717783365 hamaryns@googlemail.com http://tcl.sfs.uni-tuebingen.de/~hendrik/
participants (3)
-
Hendrik Maryns -
Mark Sapiro -
Stephen J. Turnbull