[Mailman-Developers] Possible error in Mailman/Cgi/confirm.py

[Thien Vu]

I think I found a bug in mailman. If you get an email confirmation for
a pending request and you go to the web page. If you hit 'cancel' it
will to to Mailman/Cgi/confirm.py will call subscription_cancel :

def subscription_cancel(mlist, doc, cookie):
    # Discard this cookie
    userdesc = mlist.pend_confirm(cookie)[1]
    lang = userdesc.language
    i18n.set_language(lang)
    doc.set_language(lang) 
    doc.AddItem(_('You have canceled your subscription request.'))

The problem is in mlist.pend_confirm:

    def pend_confirm(self, cookie, expunge=True):
        """Return data for cookie, or None if not found.
    
        If optional expunge is True (the default), the record is also removed
        from the database.
        """
        db = self.__load()
        # If we're not expunging, the database is read-only.
        if not expunge:
            return db.get(cookie)
        # Since we're going to modify the database, we must make sure the list
        # is locked, since it's the list lock that protects pending.pck.
        assert self.Locked()
        content = db.get(cookie, _missing)
        if content is _missing:
            return None
        # Do the expunge
        del db[cookie]
        del db['evictions'][cookie]
        self.__save(db)
        return content

There is an assert self.Locked() which will always fail because we've
never locked the list. The question is what's the correct thing to do
here? It seems the safe thing to do is the wrap a lock the call to
pend_confirm in subscription_cancel, but is pending.pck even used
anymore? If not do we still need the lock? It seems like we would
because we're going to be updating whereever the db is...

Just asking because I'm not very familiar with this part of the code.

Thien