Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-postorius for
openSUSE:Factory checked in at 2026-08-18 16:36:08
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-postorius (Old)
and /work/SRC/openSUSE:Factory/.python-postorius.new.1258 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-postorius"
Tue Aug 18 16:36:08 2026 rev:17 rq:1371597 version:1.3.13
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-postorius/python-postorius.changes
2026-03-11 20:52:01.053798194 +0100
+++
/work/SRC/openSUSE:Factory/.python-postorius.new.1258/python-postorius.changes
2026-08-18 16:36:43.223437502 +0200
@@ -1,0 +2,8 @@
+Wed Aug 5 11:44:17 UTC 2026 - Markéta Machová <[email protected]>
+
+- CVE-2026-44742: XSS due to HTML in message subject not being escaped
+ when it is rendered in the Held messages pop-up (bsc#1264638)
+ * CVE-2026-44742-escape-subject-html.patch
+- Skip tests which got broken in the meantime (skip-hanging-test.patch)
+
+-------------------------------------------------------------------
New:
----
CVE-2026-44742-escape-subject-html.patch
skip-hanging-test.patch
----------(New B)----------
New: when it is rendered in the Held messages pop-up (bsc#1264638)
* CVE-2026-44742-escape-subject-html.patch
- Skip tests which got broken in the meantime (skip-hanging-test.patch)
New: * CVE-2026-44742-escape-subject-html.patch
- Skip tests which got broken in the meantime (skip-hanging-test.patch)
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-postorius.spec ++++++
--- /var/tmp/diff_new_pack.EpAncR/_old 2026-08-18 16:36:44.478482423 +0200
+++ /var/tmp/diff_new_pack.EpAncR/_new 2026-08-18 16:36:44.480482494 +0200
@@ -1,7 +1,7 @@
#
# spec file for package python-postorius
#
-# Copyright (c) 2025 SUSE LLC and contributors
+# Copyright (c) 2026 SUSE LLC and contributors
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -71,6 +71,10 @@
Patch0: postorius-settings.patch
# PATCH-FIX-UPSTREAM
https://gitlab.com/mailman/postorius/-/commit/0468ab0329df85b89e6b5d9f7b4d1805f47450c9
feat: Add Python 3.13 and Django 5.2 (LTS) support
Patch1: django52.patch
+# PATCH-FIX-UPSTREAM CVE-2026-44742-escape-subject-html.patch bsc#1264638
+Patch2: CVE-2026-44742-escape-subject-html.patch
+# PATCH-FIX-UPSTREAM
https://gitlab.com/mailman/postorius/-/merge_requests/1034 Skip hanging test
with Python 3.13 and Django 5.2.
+Patch3: skip-hanging-test.patch
#
BuildRequires: %{python_module legacy-cgi}
BuildRequires: %{python_module pdm-backend}
@@ -103,6 +107,7 @@
BuildRequires: %{python_module readme_renderer}
BuildRequires: %{python_module six}
BuildRequires: %{python_module vcrpy}
+#!BuildConflicts: %{python_module Django >= %{django_max_version}}
# /SECTION
%python_subpackages
@@ -242,7 +247,8 @@
%check
export PYTHONPATH="$(pwd):$(pwd)/src"
export LANG=C.UTF-8
-%pytest
+# test_list_info: the failure was already reported
https://gitlab.com/mailman/postorius/-/work_items/602
+%pytest -k "not test_list_info"
# clean flavored alternatives created by test setup, because we are going to
install the example_project as docs
rm -rf build/flavorbin
rm -rf build/xdgflavorconfig
++++++ CVE-2026-44742-escape-subject-html.patch ++++++
diff --git a/src/postorius/doc/news.rst b/src/postorius/doc/news.rst
index 6789f443..2e554ca7 100644
--- a/src/postorius/doc/news.rst
+++ b/src/postorius/doc/news.rst
@@ -17,6 +17,12 @@
You should have received a copy of the GNU Lesser General Public License
along with Postorius. If not, see <http://www.gnu.org/licenses/>.
+Security
+--------
+* Escape HTML in the message subject when rendering it in the Held messages
+ pop-up. (See !972)
+
+
.. _NEWS-1.3.13:
1.3.13
diff --git a/src/postorius/static/postorius/js/held_messages.js
b/src/postorius/static/postorius/js/held_messages.js
index e5ec7acc..1ddf9e3b 100644
--- a/src/postorius/static/postorius/js/held_messages.js
+++ b/src/postorius/static/postorius/js/held_messages.js
@@ -9,7 +9,7 @@
url: rest_url + msgid,
success: function(data) {
$('#message-source-btn').attr('href', rest_url + msgid + '?raw')
- $('#message-title').html(data.subject);
+ $('#message-title').text(data.subject);
$('.modal-footer form input[name="msgid"]').attr('value', msgid);
if (data.msg.body) {
$('#held-message-content').text(data.msg.body);
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.EpAncR/_old 2026-08-18 16:36:44.537484536 +0200
+++ /var/tmp/diff_new_pack.EpAncR/_new 2026-08-18 16:36:44.541484680 +0200
@@ -1,6 +1,6 @@
-mtime: 1773153869
-commit: 15669ffff987d2ebe98e6186c5efa3ea608a48b68438eaa9b703791def386d85
-url: https://src.opensuse.org/python-mailman/python-postorius.git
-revision: 15669ffff987d2ebe98e6186c5efa3ea608a48b68438eaa9b703791def386d85
+mtime: 1786981477
+commit: 057c6a601faf600074807d602743f7e2948b99e8970056e60c0d6676344f1f63
+url: https://src.opensuse.org/python-mailman/python-postorius
+revision: 057c6a601faf600074807d602743f7e2948b99e8970056e60c0d6676344f1f63
projectscmsync: https://src.opensuse.org/python-mailman/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-08-17 17:44:37.000000000 +0200
@@ -0,0 +1 @@
+.osc
++++++ skip-hanging-test.patch ++++++
>From c6cc547afd5b564443554ac7c0b70299897a2a81 Mon Sep 17 00:00:00 2001
From: Mark Sapiro <[email protected]>
Date: Wed, 24 Sep 2025 13:52:04 -0700
Subject: [PATCH] Skip hanging test with Python 3.13 and Django 5.2.
---
src/postorius/tests/mailman_api_tests/test_nav_helpers.py | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/postorius/tests/mailman_api_tests/test_nav_helpers.py
b/src/postorius/tests/mailman_api_tests/test_nav_helpers.py
index 3bde0084..1cf75bbf 100644
--- a/src/postorius/tests/mailman_api_tests/test_nav_helpers.py
+++ b/src/postorius/tests/mailman_api_tests/test_nav_helpers.py
@@ -17,7 +17,11 @@
# Postorius. If not, see <http://www.gnu.org/licenses/>.
#
+import sys
import time
+from unittest import skipIf
+
+from django import __version__
from postorius.templatetags.nav_helpers import (
held_count,
@@ -26,6 +30,8 @@ from postorius.templatetags.nav_helpers import (
from postorius.tests.utils import ViewTestCase
+@skipIf(sys.version >= '3.13.0' and __version__ >= '5.2.0',
+ 'This test hangs with Python 3.13 and Django 5.2.')
class TestNavigationHelpers(ViewTestCase):
def setUp(self):
super().setUp()
--
GitLab
