[Bug 1830663] Re: admin email interface fails w/ password holding space

Mark Sapiro mark at msapiro.net
Wed May 29 00:50:04 EDT 2019


> Oh, and I'm retired, so there is free time, albeit not as much as
folks with jobs think.

I'm retired too (27 + years). You've probably heard the line "There are
two kinds of retired people - those who are bored stiff and those who
can't figure out how they ever had time to go to work." I think we're
both in the latter category.

> What I'd really like is a web interface such as I provide for the
dance weekend pages I administer: A button that offers "download as CSV"
for the Membership list.

See the script at https://www.msapiro.net/scripts/mailman-
subscribers3.py (mirrored at https://fog.ccsf.edu/~msapiro/scripts
/mailman-subscribers3.py )

If you have admin access to the list, it will screen scrape the admin
membership list and give you what you want.

As far as fixing this bug, I have this idea:

import re
# See https://www.metaltoad.com/blog/regex-quoted-string-escapable-quotes
qre = re.compile(r"""((?<![\\])['"])((?:.(?!(?<![\\])\1))*.?)\1""")

def get_args(s):
    mo = qre.search(s)
    if not mo:
        return s.split()
    else:
        args = s[:mo.start()].split()
        args.append(re.sub('\\\\([\'"])', '\\1', mo.group(2)))
        args.extend(get_args(s[mo.end():]))
        return args

The re.sub() in the args.append is because without it the \' in

'How\'s this for a password'

gets returned literally as \' rather than just '.

I still need to do more testing to be sure it won't break anything. The
main concern I have is if someone has a password that has quotes and/or
backslashes in it, this will potentially break something that currently
works. For example, an actual password of ab'cd'ef will be split into 3
tokens and fail

But since you don't have sysadmin access to the server, even if this
gets in the next release, when do you think it will get to you?

-- 
You received this bug notification because you are a member of Mailman
Coders, which is subscribed to GNU Mailman.
https://bugs.launchpad.net/bugs/1830663

Title:
  admin email interface fails w/ password holding space

To manage notifications about this bug go to:
https://bugs.launchpad.net/mailman/+bug/1830663/+subscriptions


More information about the Mailman-coders mailing list