[Mailman-Users] Complaints about MM 2.1.6b4

Mark Sapiro msapiro at value.net
Sat Sep 10 00:38:14 CEST 2005


Darren G Pifer 
>I believe she is
>saying is that if she is a member of her own list, she still has to
>approve the message before it goes out. If she was not a member of list
>and was in the non-member list of addresses for her list, then the mail
>would go out without approval. I don't know this affects MM processing,
>if the member address member name has the mod flag set, and she sends
>to her list, will it still be held for approval?


Yes, and that appears to be the issue here. If she is a moderated
member, her posts are supposed to be held for approval (or otherwise
disposed of according to member_moderation_action). That's what
moderated means. It makes no difference whether she is a list owner or
moderator herself.

If she is moderated, the only way she can post without the post being
held is to include an

Approved: <list_administrator_password>

line in her post either as a header or as an initial body line. If
included in the body, it is best to make it the first line and follow
it with a blank line as at least some Mailman versions will remove the
line following when removing the Approved: line from the post.

Also, she is correct that in Mailman 2.1.x there is no list per se of
members who are allowed to post without moderation. You have to turn
off moderation individually for those members who you want to post
without moderation.

It would be simple for someone who knows Mailman and Python to create a
withlist script that would turn off moderation for a list of members,
but as far as I know there isn't one currently available.

In another post in this thread Darren wrote:

>On Tue, 2005-09-06 at 10:29, Brad Knowles wrote:
>
>> >  The newest problem is:  Because Classroom is a shared email account, it
>> >  shows the "real sender" - who is a member of the list with a check-mark
>> >  in the MOD box, so it holds the email and waits for administrator
>> >  approval.
>> 
>> 	Make sure that your MUA properly uses the desired sender address 
>> as both the envelope sender and in the header "From:" and "Sender:" 
>> fields.
>> 
>> 	Or, go into your mm_cfg.py file and change what fields you look 
>> at for determining list membership.  If you don't have explicit 
>> settings for this, see the examples from Defaults.py, then copy them 
>> over to mm_cfg.py and change as necessary for your installation.
>
>These are settings for envelope sender from Defaults.py which is looking
>like it is doing the right thing.


The setting in Defaults.py is 'USE_ENVELOPE_SENDER = No' which says use
the headers as specified in SENDER_HEADERS.


>
>How can we confirm that the MUA is doing the right thing? Would this be
>one of the mailers sendmail would be using, like mlocal?

The MUA is the 'user agent' (also called e-mail client) that the user
uses to compose and send the mail. This is normally what sets fields
such as From: and envelope sender in a mail message. If users want to
post using the "classroom" address, they may need to set up a separate
'account' in their MUA to post from. You can verify what is being done
by having them send to you and examining the full headers of the
message you receive. Note that there should be a Return-Path: header
indicating the envelope sender.

But note, It will be only a very short time before students figure out
how to post from 'classroom'. That's why this method is not
recommended as a secure posting method on a one-way or few-to-many
type of list. The secure way to do this is by moderating everyone and
giving authorized posters the list password so they can post with an
Approved: header. See
http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq03.034.htp

--
Mark Sapiro <msapiro at value.net>       The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan




More information about the Mailman-Users mailing list