1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
|
This is a patch generated by unpacking
https://bazaar.launchpad.net/tarball/1885
https://bazaar.launchpad.net/tarball/1893
as .tgz tarballs into separate directories and diffing it
with GNU diff -NEur:
diff -NEur bin/cleanarch bin/cleanarch
--- bin/cleanarch 2018-06-18 01:47:34.744000000 +0200
+++ bin/cleanarch 2022-01-11 04:08:45.300000000 +0100
@@ -60,7 +60,7 @@
# From RFC 2822, a header field name must contain only characters from 33-126
# inclusive, excluding colon. I.e. from oct 41 to oct 176 less oct 072. Must
# use re.match() so that it's anchored at the beginning of the line.
-fre = re.compile(r'[\041-\071\073-\176]+')
+fre = re.compile(r'[\041-\071\073-\176]+:')
diff -NEur Mailman/Cgi/options.py Mailman/Cgi/options.py
--- Mailman/Cgi/options.py 2021-11-24 04:38:19.869000000 +0100
+++ Mailman/Cgi/options.py 2023-05-22 21:58:09.582000000 +0200
@@ -1,4 +1,4 @@
-# Copyright (C) 1998-2018 by the Free Software Foundation, Inc.
+# Copyright (C) 1998-2023 by the Free Software Foundation, Inc.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
@@ -164,13 +164,40 @@
loginpage(mlist, doc, None, language)
print doc.Format()
return
- # Sanity check the user, but only give the "no such member" error when
- # using public rosters, otherwise, we'll leak membership information.
+ # Sanity check the user, but we have to give the appropriate error msg
+ # to not potentially leak membership info. This is a kludge here. We
+ # have to check membership here to avoid LP: #1951769, but then we have
+ # to give the appropriate error to avoid LP: #1968443
+ msgc = _('If you are a list member, a confirmation email has been sent.')
+ msgb = _('You already have a subscription pending confirmation')
+ msga = _("""If you are a list member, your unsubscription request has been
+ forwarded to the list administrator for approval.""")
+ msgd = _("""If you are a list member,
+ your password has been emailed to you.""")
if not mlist.isMember(user):
if mlist.private_roster == 0:
doc.addError(_('No such member: %(safeuser)s.'))
- loginpage(mlist, doc, None, language)
- print doc.Format()
+ user = None
+ elif cgidata.has_key('login-unsub'):
+ syslog('mischief',
+ 'Unsub attempt of non-member w/ private rosters: %s',
+ user)
+ if mlist.unsubscribe_policy:
+ doc.addError(msga, tag='')
+ else:
+ doc.addError(msgc, tag='')
+ user = None
+ elif cgidata.has_key('login-remind'):
+ syslog('mischief',
+ 'Reminder attempt of non-member w/ private rosters: %s',
+ user)
+ doc.addError(msgd, tag='')
+ user = None
+ # We get here with a non-None user in the case of a non-member with
+ # private rosters. This creates a possible membership leak, but we
+ # fix that a different way. See LP: #2017813.
+ loginpage(mlist, doc, user, language)
+ print doc.Format()
return
# Avoid cross-site scripting attacks
@@ -204,10 +231,6 @@
i18n.set_language(userlang)
# Are we processing an unsubscription request from the login screen?
- msgc = _('If you are a list member, a confirmation email has been sent.')
- msgb = _('You already have a subscription pending confirmation')
- msga = _("""If you are a list member, your unsubscription request has been
- forwarded to the list administrator for approval.""")
if cgidata.has_key('login-unsub'):
# Because they can't supply a password for unsubscribing, we'll need
# to do the confirmation dance.
@@ -233,39 +256,20 @@
finally:
mlist.Unlock()
else:
- # Not a member
- if mlist.private_roster == 0:
- # Public rosters
- doc.addError(_('No such member: %(safeuser)s.'))
- else:
- syslog('mischief',
- 'Unsub attempt of non-member w/ private rosters: %s',
- user)
- if mlist.unsubscribe_policy:
- doc.addError(msga, tag='')
- else:
- doc.addError(msgc, tag='')
+ # Not a member handled above.
+ pass
loginpage(mlist, doc, user, language)
print doc.Format()
return
# Are we processing a password reminder from the login screen?
- msg = _("""If you are a list member,
- your password has been emailed to you.""")
if cgidata.has_key('login-remind'):
if mlist.isMember(user):
mlist.MailUserPassword(user)
- doc.addError(msg, tag='')
+ doc.addError(msgd, tag='')
else:
- # Not a member
- if mlist.private_roster == 0:
- # Public rosters
- doc.addError(_('No such member: %(safeuser)s.'))
- else:
- syslog('mischief',
- 'Reminder attempt of non-member w/ private rosters: %s',
- user)
- doc.addError(msg, tag='')
+ # Not a member handled above.
+ pass
loginpage(mlist, doc, user, language)
print doc.Format()
return
@@ -293,7 +297,9 @@
# to authenticate via cgi (instead of cookie), then print an error
# message.
if cgidata.has_key('password'):
- doc.addError(_('Authentication failed.'))
+ if mlist.private_roster == 0:
+ # Only add error with public rosters lp: #2015416
+ doc.addError(_('Authentication failed.'))
remote = os.environ.get('HTTP_FORWARDED_FOR',
os.environ.get('HTTP_X_FORWARDED_FOR',
os.environ.get('REMOTE_ADDR',
@@ -307,9 +313,11 @@
syslog('mischief',
'Login failure with private rosters: %s from %s',
user, remote)
- user = None
+ # Don't clear user here. See LP: #2017813.
# give an HTTP 401 for authentication failure
- print 'Status: 401 Unauthorized'
+ if mlist.private_roster == 0:
+ # Only add error with public rosters lp: #2015416
+ print 'Status: 401 Unauthorized'
loginpage(mlist, doc, user, language)
print doc.Format()
return
diff -NEur messages/de/LC_MESSAGES/mailman.po messages/de/LC_MESSAGES/mailman.po
--- messages/de/LC_MESSAGES/mailman.po 2020-06-27 02:12:17.548000000 +0200
+++ messages/de/LC_MESSAGES/mailman.po 2022-03-29 01:55:20.774000000 +0200
@@ -4577,7 +4577,7 @@
#: Mailman/Defaults.py:1809
msgid "Esperanto"
-msgstr "Deutsch"
+msgstr "Esperanto"
# Mailman/Defaults.py:773
#: Mailman/Defaults.py:1810
diff -NEur NEWS NEWS
--- NEWS 2021-12-13 21:36:11.555000000 +0100
+++ NEWS 2023-05-22 21:58:09.582000000 +0200
@@ -5,6 +5,26 @@
Here is a history of user visible changes to Mailman.
+2.1.40 (xx-xxx-xxxx)
+
+ i18n
+
+ - The German translation of `Esperanto` is fixed. (LP: #1966685)
+
+ Bug Fixes and other patches
+
+ - Test for a valid header following a Unix From_ line in bin/cleanarch
+ has been improved. (LP: #1957025)
+ - A 500 Internal Server Error when requesting the options page for a
+ non-member address on a list with private rosters is avoided.
+ (LP: #1961762)
+ - A possible list membership leak via the user options CGI is fixed.
+ (LP: #1968443)
+ - Another possible list membership leak via the user options CGI is fixed.
+ (LP: #2015416)
+ - Yet another possible list membership leak via the user options CGI is
+ fixed. (LP: #2017813)
+
2.1.39 (13-Dec-2021)
Bug Fixes and other patches
|
