[Mailman-Users] List security: approved line got mailed out to listusers

[Mark Sapiro]

Jacob Sam-La Rose wrote:
>
>I've got my list configured as an announcement-only list, and the  
>first few mailings I've sent have gone through exactly as planned.  I  
>use "Approved: password" as the first line to approve mailings.  I  
>inadvertently sent email to the list from one of my other email  
>addresses, and when the message went out, the Approved: line was  
>there, intact.  There was a space above it, if that means anything  
>(the sent email doesn't have that space...)


What Mailman version is this?

Do you have a copy of the message from the list - complete with all
headers? If nothing else, if the list is archived, this copy will be
in archives/private/listname.mbox/listname.mbox.

How did the message get sent to the list? Was it held and manually
approved (a clue that something was wrong with Approved:).

Was the Approved: line that went to the list in the first text/plain
part of the message or was it in a subsequent part, e.g. an HTML
alternative part.

Approved: body lines must be the first non-blank line in the first
text/plain part of the message. If found there, they will be removed.
Beginning in Mailman 2.1.7, an attempt is made to remove the approved
line from other parts of the message, but it must first be found in
the first text/plain part, and this removal from other parts isn't
perfect.

So, based on what little I have to go on so far, I will guess that the
message you sent to the list was multipart/alternative with text/plain
and text/html alternative parts and the Approved: line was found in
and removed from the text/plain part and the message was accepted, but
either because this is Mailman prior to 2.1.7 or because of something
unusual about the way the Approved: line appeared in the html part, it
wasn't removed from that part and that's where people saw it.

-- 
Mark Sapiro <msapiro at value.net>       The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan