jimpop has proposed merging lp:~jimpop/mailman/forwarded_for into
lp:mailman/2.1.
Commit message:
Support for HTTP_X_FORWARDED_FOR and HTTP_FORWARDED_FOR (RFC 7239)
Requested reviews:
Mailman Coders (mailman-coders)
For more details, see:
https://code.launchpad.net/~jimpop/mailman/forwarded_for/+merge/262717
This branch adds support for HTTP_X_FORWARDED_FOR and HTTP_FORWARDED_FOR, it
also removes REMOTE_HOST as that is never reliable (i.e. the data for
REMOTE_HOST is defined elsewhere and subject to change). This branch also
identifies the remote IP in "Possible malformed path attack" errors.
--
Your team Mailman Coders is requested to review the proposed merge of
lp:~jimpop/mailman/forwarded_for into lp:mailman/2.1.
=== modified file 'Mailman/Cgi/listinfo.py'
--- Mailman/Cgi/listinfo.py 2015-04-24 00:42:33 +0000
+++ Mailman/Cgi/listinfo.py 2015-06-23 14:12:33 +0000
@@ -187,9 +187,10 @@
'subscribe')
if mm_cfg.SUBSCRIBE_FORM_SECRET:
now = str(int(time.time()))
- remote = os.environ.get('REMOTE_HOST',
- os.environ.get('REMOTE_ADDR',
- 'w.x.y.z'))
+ remote = os.environ.get('HTTP_FORWARDED_FOR',
+ os.environ.get('HTTP_X_FORWARDED_FOR',
+ os.environ.get('REMOTE_ADDR',
+ 'w.x.y.z'))
# Try to accept a range in case of load balancers, etc. (LP: #1447445)
if remote.find('.') >= 0:
# ipv4 - drop last octet
=== modified file 'Mailman/Cgi/options.py'
--- Mailman/Cgi/options.py 2015-01-23 00:09:03 +0000
+++ Mailman/Cgi/options.py 2015-06-23 14:12:33 +0000
@@ -193,7 +193,10 @@
mlist.HoldUnsubscription(user)
doc.addError(msga, tag='')
else:
- ip = os.environ.get('REMOTE_ADDR')
+ ip = os.environ.get('HTTP_FORWARDED_FOR',
+ os.environ.get('HTTP_X_FORWARDED_FOR',
+ os.environ.get('REMOTE_ADDR',
+ 'unidentified origin')))
mlist.ConfirmUnsubscription(user, userlang, remote=ip)
doc.addError(msgc, tag='')
mlist.Save()
@@ -264,9 +267,13 @@
# So as not to allow membership leakage, prompt for the email
# address and the password here.
if mlist.private_roster <> 0:
+ remote = os.environ.get('HTTP_FORWARDED_FOR',
+ os.environ.get('HTTP_X_FORWARDED_FOR',
+ os.environ.get('REMOTE_ADDR',
+ 'unidentified origin')))
syslog('mischief',
- 'Login failure with private rosters: %s',
- user)
+ 'Login failure with private rosters: %s from %s',
+ user, remote)
user = None
# give an HTTP 401 for authentication failure
print 'Status: 401 Unauthorized'
=== modified file 'Mailman/Cgi/subscribe.py'
--- Mailman/Cgi/subscribe.py 2015-04-24 00:42:33 +0000
+++ Mailman/Cgi/subscribe.py 2015-06-23 14:12:33 +0000
@@ -118,9 +118,10 @@
# Canonicalize the full name
fullname = Utils.canonstr(fullname, lang)
# Who was doing the subscribing?
- remote = os.environ.get('REMOTE_HOST',
- os.environ.get('REMOTE_ADDR',
- 'unidentified origin'))
+ remote = os.environ.get('HTTP_FORWARDED_FOR',
+ os.environ.get('HTTP_X_FORWARDED_FOR',
+ os.environ.get('REMOTE_ADDR',
+ 'unidentified origin')))
# Are we checking the hidden data?
if mm_cfg.SUBSCRIBE_FORM_SECRET:
now = int(time.time())
=== modified file 'Mailman/Utils.py'
--- Mailman/Utils.py 2015-05-01 16:14:08 +0000
+++ Mailman/Utils.py 2015-06-23 14:12:33 +0000
@@ -262,7 +262,11 @@
if path:
if CRNLpat.search(path):
path = CRNLpat.split(path)[0]
- syslog('error', 'Warning: Possible malformed path attack.')
+ remote = os.environ.get('HTTP_FORWARDED_FOR',
+ os.environ.get('HTTP_X_FORWARDED_FOR',
+ os.environ.get('REMOTE_ADDR',
+ 'unidentified origin')))
+ syslog('error', 'Warning: Possible malformed path attack domain=%s remote=%s' % get_domain(), remote)
return [p for p in path.split('/') if p]
return None
_______________________________________________
Mailman-coders mailing list
[email protected]
https://mail.python.org/mailman/listinfo/mailman-coders
