[Mailman-Users] accept_these_nonmembers @ notation

[Mark Sapiro]

Lucio Chiappetti wrote:
>
>The help text for accept_these_nonmembers says
>
>Add member addresses one per line; start the line with a ^ character to 
>designate a regular expression match. A line consisting of the @ character 
>followed by a list name specifies another Mailman list in this 
>installation, all of whose member addresses will be accepted for this 
>list.
>[...]
>I cannot manage to have the @ notation working though.
>
>I am testing this with two lists, pseudoastro of which I'm the only 
>member, and pseudotecno (with a colleague as member, and me as non 
>member). Ideally I'd want to set up a list as template and then work for 
>all others (we will have some 6 DISJOINCT lists with categories of our 
>staff, we want to be able that members of each can post to any other [and 
>in addition to set up some umbrella lists])
>
>Notation
>
>@pseudoastro
>@pseudotecno
>
>fails at web level entry (Error: Invalid value for variable: 
>accept_these_nonmembers)
>
>Notation (with a blank between @ and list name)
>@ pseudoastro
>@ pseudotecno
>
>gives an entry in the error log
>
>  *_these_nonmembers in pseudotecno references non-existent list  pseudoastro
>  *_these_nonmembers in pseudotecno references non-existent list  pseudotecno


The first syntax without the space after the @ is the correct one. It
is being rejected because a list cannot reference itself in
*_these_nonmembers. You must put only '@pseudoastro' in
accept_these_nonmembers of the pseudotecno list and vice versa.


When you put a space following @, it is accepted with the space as part
of the list name, but then the list name is not found during
processing of a post and is logged as an error because ' pseudoastro'
and ' pseudotecno' are not lists.


[...]
>(and by the way ... are those checks to be considered effective as 
>antispam measures ? do they just use the value of the header From field 
>(which can be faked) or use info from the SMTP dialogue ?


The address used as the sender of the post for this test is determined
by the Mailman.Message.get_sender() method. This method searches three
places and returns the first address found. The default search order
is From: header, then Sender: header, then unix From_ which is the
envelope sender. All of these can be easily faked. If
USE_ENVELOPE_SENDER (not well named) is set to a true value in
mm_cfg.py, the order is changed to Sender: header, then From: header,
then unix From_.

If you want to actually prefer the envelope sender (SMTP time MAIL
FROM), you'd need to modify the definition of the method in
Mailman/Message.py, but there is little point as envelope sender can
be faked as easily as From:

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan