[Mailman-Users] Non-members allowed to post!

[Mark Sapiro]

David Gibbs wrote:

>I did a bit more digging ... it seems that mail coming in from the GMane
>system is not being parsed correctly by Mailman.

Maybe, but maybe not.

>As a somewhat knee-jerk reaction, I turned on the moderation flag for
>all subscribers to stop the unauthorized posting.
>
>A few minutes ago I got a moderation notification that indicated that a
>message was being posted from 'rpg400 at m.gmane.org'.
>
>> As list administrator, your authorization is requested for the
>> following mailing list posting:
>>
>>     List:    RPG400-L at midrange.com
>>     From:    rpg400 at m.gmane.org
>>     Subject: Re: Making Triggers Resilient
>>     Reason:  Post to moderated list
>
>
>
>The message, however, had not been submitted BY rpg400 at m.gmane.org, it
>was submitted from a normal subscriber.
>
>Here's the headers from the message (somewhat scrubbed to protect
>privacy)...
>
>> To: rpg400-l at midrange.com
>> From: "Buck Calabro" <buck.calabro at xxxxxx>
>> Subject: Re: Making Triggers Resilient
>> Date: Wed, 2 Mar 2005 14:43:43 -0500
>> Lines: 16
>> Message-ID: <d054ob$ehk$1 at sea.gmane.org>
>> X-Complaints-To: usenet at sea.gmane.org
>> X-Gmane-NNTP-Posting-Host: 209-23-60-152.tvc-ip.com
>> X-MSMail-Priority: Normal
>> X-Newsreader: Microsoft Outlook Express 5.50.4922.1500
>> X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4925.2800
>> Sender: news <news at sea.gmane.org>
>> X-Gmane-MailScanner: Found to be clean
>> X-Gmane-MailScanner: Found to be clean
>> X-MailScanner-From: rpg400 at m.gmane.org
>> X-MailScanner-To: rpg400-l at midrange.com
>
>
>The only place that rpg400 at m.gmane.org shows up is in the
>'X-MailScanner-From:' header.
>
>It appears that Mailman is picking up the 'From:' information from the
>wrong header.


How about the envelope sender? You can't tell from those headers what
that was, but I'm guessing that it too is rpg400 at m.gmane.org

>Is this a problem with Gmane or Mailman?

I'd say it's probably Gmane doing this. I guess the first question is
"is rpg400 at m.gmane.org a list member and if so, why?"

You might also check for USE_ENVELOPE_SENDER settings in mm_cfg.py. The
default in Defaults.py should be "USE_ENVELOPE_SENDER = No". Also in
Defaults.py, you should have "SENDER_HEADERS = ('from', None,
'reply-to', 'sender')".

If you remove any "USE_ENVELOPE_SENDER = Yes" from mm_cfg.py and put

SENDER_HEADERS = ('from', 'reply-to', 'sender')

into mm_cfg.py, then envelope sender won't be used at all. That might
help.

--
Mark Sapiro <msapiro at value.net>       The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan