Your message dated Sat, 13 Jul 2013 18:08:09 +0200 with message-id <[email protected]> and subject line Re: mailman: Mailman should allow users to set the secure flag on cookies has caused the Debian Bug report #606269, regarding mailman: Mailman should allow users to set the secure flag on cookies to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 606269: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606269 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: mailman Severity: normal Tags: patch Mailman offers a web interface that relies heavily on cookies. If the web interface is used via https, those cookies should have the secure flag set. Attached is a patch which allows system administrators to indicate manually whether they would like the secure flag to be set or not. Feel free to forward upstream, if that would be useful. --dkg -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (500, 'testing'), (200, 'unstable'), (1, 'experimental') Architecture: i386 (i686) Kernel: Linux 2.6.36-trunk-686 (SMP w/1 CPU core) Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bashdiff -ru mailman-2.1.13.orig/Mailman/Defaults.py.in mailman-2.1.13/Mailman/Defaults.py.in --- mailman-2.1.13.orig/Mailman/Defaults.py.in 2010-12-07 16:54:35.000000000 -0500 +++ mailman-2.1.13/Mailman/Defaults.py.in 2010-12-07 17:22:02.000000000 -0500 @@ -362,6 +362,9 @@ # publically available? PUBLIC_MBOX = No +# set the secure flag on all cookies? Only enable this if your web +# interface is always accessed via https. +SECURE_COOKIES = No ##### diff -ru mailman-2.1.13.orig/Mailman/SecurityManager.py mailman-2.1.13/Mailman/SecurityManager.py --- mailman-2.1.13.orig/Mailman/SecurityManager.py 2009-12-22 13:00:43.000000000 -0500 +++ mailman-2.1.13/Mailman/SecurityManager.py 2010-12-07 17:24:59.000000000 -0500 @@ -250,6 +250,8 @@ # We use session cookies, so don't set `expires' or `max-age' keys. # Set the RFC 2109 required header. c[key]['version'] = 1 + if mm_cfg.SECURE_COOKIES: + c[key]['secure'] = 'yes' return c def ZapCookie(self, authcontext, user=None):
--- End Message ---
--- Begin Message ---Version: 1:2.1.15-1 > If the web interface is used via https, those cookies should have the > secure flag set. Thanks! The secure flag has been implemented in 2.1.15. Cheers, Thijs
--- End Message ---
