------------------------------------------------------------
revno: 1800
fixes bug: https://launchpad.net/bugs/1785854
committer: Mark Sapiro <m...@msapiro.net>
branch nick: 2.1
timestamp: Tue 2018-08-07 19:52:09 -0700
message:
Catch TypeError on simultaneous confirmations of the same token.
modified:
Mailman/Cgi/confirm.py
NEWS
--
lp:mailman/2.1
https://code.launchpad.net/~mailman-coders/mailman/2.1
Your team Mailman Checkins is subscribed to branch lp:mailman/2.1.
To unsubscribe from this branch go to
https://code.launchpad.net/~mailman-coders/mailman/2.1/+edit-subscription
=== modified file 'Mailman/Cgi/confirm.py'
--- Mailman/Cgi/confirm.py 2018-06-17 23:47:34 +0000
+++ Mailman/Cgi/confirm.py 2018-08-08 02:52:09 +0000
@@ -327,6 +327,12 @@
try:
# Discard this cookie
userdesc = mlist.pend_confirm(cookie)[1]
+ except TypeError:
+ # See comment about TypeError in subscription_confirm.
+ # Give a generic message. It doesn't much matter what since it's a
+ # bot anyway.
+ doc.AddItem(_('Error'))
+ return
finally:
mlist.Unlock()
lang = userdesc.language
@@ -362,6 +368,10 @@
else:
digest = None
userdesc = mlist.pend_confirm(cookie, expunge=False)[1]
+ # There is a potential race condition if two (robotic?) clients try
+ # to confirm the same token simultaneously. If they both succeed in
+ # retrieving the data above, when the second gets here, the cookie
+ # is gone and TypeError is thrown. Catch it below.
fullname = cgidata.getfirst('realname', None)
if fullname is not None:
fullname = Utils.canonstr(fullname, lang)
@@ -379,7 +389,7 @@
the list moderator before you will be subscribed. Your request
has been forwarded to the list moderator, and you will be notified
of the moderator's decision."""))
- except Errors.NotAMemberError:
+ except (Errors.NotAMemberError, TypeError):
bad_confirmation(doc, _('''Invalid confirmation string. It is
possible that you are attempting to confirm a request for an
address that has already been unsubscribed.'''))
@@ -444,7 +454,8 @@
i18n.set_language(lang)
doc.set_language(lang)
op, addr = mlist.ProcessConfirmation(cookie)
- except Errors.NotAMemberError:
+ # See comment about TypeError in subscription_confirm.
+ except (Errors.NotAMemberError, TypeError):
bad_confirmation(doc, _('''Invalid confirmation string. It is
possible that you are attempting to confirm a request for an
address that has already been unsubscribed.'''))
@@ -533,7 +544,8 @@
i18n.set_language(lang)
doc.set_language(lang)
op, oldaddr, newaddr = mlist.ProcessConfirmation(cookie)
- except Errors.NotAMemberError:
+ # See comment about TypeError in subscription_confirm.
+ except (Errors.NotAMemberError, TypeError):
bad_confirmation(doc, _('''Invalid confirmation string. It is
possible that you are attempting to confirm a request for an
address that has already been unsubscribed.'''))
@@ -657,7 +669,8 @@
# Discard the message
mlist.HandleRequest(id, mm_cfg.DISCARD,
_('Sender discarded message via web.'))
- except (Errors.LostHeldMessage, KeyError):
+ # See comment about TypeError in subscription_confirm.
+ except (Errors.LostHeldMessage, KeyError, TypeError):
bad_confirmation(doc, _('''The held message with the Subject:
header <em>%(subject)s</em> could not be found. The most likely
reason for this is that the list moderator has already approved or
@@ -770,7 +783,8 @@
i18n.set_language(lang)
doc.set_language(lang)
op, addr = mlist.ProcessConfirmation(cookie)
- except Errors.NotAMemberError:
+ # See comment about TypeError in subscription_confirm.
+ except (Errors.NotAMemberError, TypeError):
bad_confirmation(doc, _('''Invalid confirmation string. It is
possible that you are attempting to confirm a request for an
address that has already been unsubscribed.'''))
=== modified file 'NEWS'
--- NEWS 2018-07-24 21:56:35 +0000
+++ NEWS 2018-08-08 02:52:09 +0000
@@ -5,6 +5,13 @@
Here is a history of user visible changes to Mailman.
+2.1.30 (xx-xxx.xxxx)
+
+ Bug Fixes
+
+ - Fixed the confirm CGI to catch a rare TypeError on simultaneous
+ confirmations of the same token. (LP: #1785854)
+
2.1.29 (24-Jul-2018)
Bug Fixes
_______________________________________________
Mailman-checkins mailing list
Mailman-checkins@python.org
Unsubscribe:
https://mail.python.org/mailman/options/mailman-checkins/archive%40jab.org
