Update of /cvsroot/mailman/mailman/Mailman
In directory sc8-pr-cvs1:/tmp/cvs-serv11905
Modified Files:
MailList.py
Log Message:
InviteNewMember(): Set the .invitation hack to the name of the list
being invited to, in order to prevent cross-list invitation
confirmation attacks.
ProcessConfirmation(): Check that the .invitation attribute matches
the name of the list confirming to.
Closes SF bug # 703941 by Stuart Bishop, who also suggested the basic fix.
Index: MailList.py
===================================================================
RCS file: /cvsroot/mailman/mailman/Mailman/MailList.py,v
retrieving revision 2.104
retrieving revision 2.105
diff -u -d -r2.104 -r2.105
--- MailList.py 24 Feb 2003 15:37:57 -0000 2.104
+++ MailList.py 16 Mar 2003 07:02:01 -0000 2.105
@@ -73,6 +73,12 @@
EMPTYSTRING = ''
+try:
+ True, False
+except NameError:
+ True = 1
+ False = 0
+
# Use mixins here just to avoid having any one chunk be too large.
@@ -681,8 +687,9 @@
# Hack alert! Squirrel away a flag that only invitations have, so
# that we can do something slightly different when an invitation
# subscription is confirmed. In those cases, we don't need further
- # admin approval, even if the list is so configured
- userdesc.invitation = 1
+ # admin approval, even if the list is so configured. The flag is the
+ # list name to prevent invitees from cross-subscribing.
+ userdesc.invitation = self.internal_name()
cookie = Pending.new(Pending.SUBSCRIPTION, userdesc)
confirmurl = '%s/%s' % (self.GetScriptURL('confirm', absolute=1),
cookie)
@@ -1071,11 +1078,18 @@
except ValueError:
raise Errors.MMBadConfirmation, 'bad subscr data %s' % (data,)
# Hack alert! Was this a confirmation of an invitation?
- invitation = getattr(userdesc, 'invitation', 0)
+ invitation = getattr(userdesc, 'invitation', False)
# We check for both 2 (approval required) and 3 (confirm +
# approval) because the policy could have been changed in the
# middle of the confirmation dance.
- if not invitation and self.subscribe_policy in (2, 3):
+ if invitation:
+ if invitation <> self.internal_name():
+ # Not cool. The invitee was trying to subscribe to a
+ # different list than they were invited to. Alert both
+ # list administrators.
+ self.SendHostileSubscriptionNotice(invitation, addr)
+ raise Errors.HostileSubscriptionError
+ elif self.subscribe_policy in (2, 3):
self.HoldSubscription(addr, fullname, password, digest, lang)
name = self.real_name
raise Errors.MMNeedApproval, _(
_______________________________________________
Mailman-checkins mailing list
[EMAIL PROTECTED]
http://mail.python.org/mailman/listinfo/mailman-checkins
