------------------------------------------------------------
revno: 1117
committer: Mark Sapiro <[EMAIL PROTECTED]>
branch nick: 2.1
timestamp: Mon 2008-06-30 08:32:26 -0700
message:
- Bumped version to 2.1.11.
- Changed MailList.Create() to check that list name contains only characters
that match the new mm_cfg.ACCEPTABLE_LISTNAME_CHARACTERS.
- Changed MTA.Utils.makealiases() to escape a few characters in the list name
in the pipe command.
modified:
Mailman/Defaults.py.in
Mailman/MTA/Utils.py
Mailman/MailList.py
Mailman/Version.py
NEWS
=== modified file 'Mailman/Defaults.py.in'
--- a/Mailman/Defaults.py.in 2008-06-18 18:43:31 +0000
+++ b/Mailman/Defaults.py.in 2008-06-30 15:32:26 +0000
@@ -109,6 +109,11 @@
# name of the temporary file that the program should operate on.
HTML_TO_PLAIN_TEXT_COMMAND = '/usr/bin/lynx -dump %(filename)s'
+# A Python regular expression character class which defines the characters
+# allowed in list names. Lists cannot be created with names containing any
+# character that doesn't match this class.
+ACCEPTABLE_LISTNAME_CHARACTERS = '[-+_.=a-z0-9]'
+
#####
=== modified file 'Mailman/MTA/Utils.py'
--- a/Mailman/MTA/Utils.py 2005-08-27 01:40:17 +0000
+++ b/Mailman/MTA/Utils.py 2008-06-30 15:32:26 +0000
@@ -1,4 +1,4 @@
-# Copyright (C) 2001,2002 by the Free Software Foundation, Inc.
+# Copyright (C) 2001-2008 by the Free Software Foundation, Inc.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
@@ -17,6 +17,7 @@
"""Utilities for list creation/deletion hooks."""
import os
+import re
import pwd
from Mailman import mm_cfg
@@ -45,13 +46,17 @@
# backwards compatibility and may eventually go away (we really have no
# need for the -admin address anymore).
#
+ # We escape a few special characters in the list name in the pipe command
+ # to avoid characters that might split the pipe into two commands.
+ safename = re.sub('([;|&`$])', r'\\\1', listname)
+ #
# Seed this with the special cases.
- aliases = [(listname, '"|%s post %s"' % (wrapper, listname)),
+ aliases = [(listname, '"|%s post %s"' % (wrapper, safename)),
]
for ext in ('admin', 'bounces', 'confirm', 'join', 'leave', 'owner',
'request', 'subscribe', 'unsubscribe'):
aliases.append(('%s-%s' % (listname, ext),
- '"|%s %s %s"' % (wrapper, ext, listname)))
+ '"|%s %s %s"' % (wrapper, ext, safename)))
return aliases
=== modified file 'Mailman/MailList.py'
--- a/Mailman/MailList.py 2008-02-23 23:14:01 +0000
+++ b/Mailman/MailList.py 2008-06-30 15:32:26 +0000
@@ -475,6 +475,12 @@
assert name == name.lower(), 'List name must be all lower case.'
if Utils.list_exists(name):
raise Errors.MMListAlreadyExistsError, name
+ # Problems and potential attacks can occur if the list name in the
+ # pipe to the wrapper in an MTA alias or other delivery process
+ # contains shell special characters so allow only defined characters
+ # (default = '[-+_.=a-z0-9]').
+ if len(re.sub(mm_cfg.ACCEPTABLE_LISTNAME_CHARACTERS, '', name)) > 0:
+ raise Errors.BadListNameError, name
# Validate what will be the list's posting address. If that's
# invalid, we don't want to create the mailing list. The hostname
# part doesn't really matter, since that better already be valid.
=== modified file 'Mailman/Version.py'
--- a/Mailman/Version.py 2008-06-23 18:05:48 +0000
+++ b/Mailman/Version.py 2008-06-30 15:32:26 +0000
@@ -16,7 +16,7 @@
# USA.
# Mailman version
-VERSION = '2.1.11rc2'
+VERSION = '2.1.11'
# And as a hex number in the manner of PY_VERSION_HEX
ALPHA = 0xa
@@ -29,9 +29,9 @@
MAJOR_REV = 2
MINOR_REV = 1
MICRO_REV = 11
-REL_LEVEL = GAMMA
+REL_LEVEL = FINAL
# at most 15 beta releases!
-REL_SERIAL = 2
+REL_SERIAL = 0
HEX_VERSION = ((MAJOR_REV << 24) | (MINOR_REV << 16) | (MICRO_REV << 8) |
(REL_LEVEL << 4) | (REL_SERIAL << 0))
=== modified file 'NEWS'
--- a/NEWS 2008-06-29 21:06:46 +0000
+++ b/NEWS 2008-06-30 15:32:26 +0000
@@ -4,7 +4,7 @@
Here is a history of user visible changes to Mailman.
-2.1.11rc2 (23-Jun-2008)
+2.1.11 (30-Jun-2008)
New Features
@@ -17,6 +17,14 @@
- Prepended list name to bounce log unrecognized bounce messages.
+ - Added a new Defaults.py|mm_cfg.py setting ACCEPTABLE_LISTNAME_CHARACTERS
+ with default value '[-+_.=a-z0-9]'. This Python regular expression
+ character class specifies the characters allowed in list names. The
+ motivation for this is the fact that previously, a list named, e.g.,
+ xxx&yyy could be created and MTA aliases generated that would cause
+ The MTA to execute yyy as a command. There is a possible security issue
+ here, but it is not believed to be exploitable in any meaningful way.
+
Bug fixes and other patches
- Changed the preservation of unparseable messages to be conditional on
--
Stable, maintained release series
https://code.launchpad.net/~mailman-coders/mailman/2.1
You are receiving this branch notification because you are subscribed to it.
_______________________________________________
Mailman-checkins mailing list
[email protected]
Unsubscribe:
http://mail.python.org/mailman/options/mailman-checkins/archive%40jab.org
