Forward port security patch from Mailman 2.0.8:

    Fixes to prevent cross-site scripting exploits.  See
    http://www.cert.org/advisories/CA-2000-02.html

    Reported by zeno@cgisecurity.com

    Fix is to cgi.escape() any strings regurgitated from the url back to
    the browser in the html response.

10 files changed, 44 insertions, 29 deletions

diff --git a/Mailman/Cgi/admin.py b/Mailman/Cgi/admin.py
index fcff2d755..3d7a80be4 100644
--- a/Mailman/Cgi/admin.py
+++ b/Mailman/Cgi/admin.py
@@ -61,7 +61,9 @@ def main():
     try:
         mlist = MailList.MailList(listname, lock=0)
     except Errors.MMListError, e:
-        admin_overview(_('No such list <em>%(listname)s</em>'))
+        # Avoid cross-site scripting attacks
+        safelistname = cgi.escape(listname)
+        admin_overview(_('No such list <em>%(safelistname)s</em>'))
         syslog('error', 'admin.py access for non-existent list: %s',
                listname)
         return
diff --git a/Mailman/Cgi/admindb.py b/Mailman/Cgi/admindb.py
index 26b3f77df..5541d415f 100644
--- a/Mailman/Cgi/admindb.py
+++ b/Mailman/Cgi/admindb.py
@@ -56,7 +56,9 @@ def main():
     try:
         mlist = MailList.MailList(listname, lock=0)
     except Errors.MMListError, e:
-        handle_no_list(_('No such list <em>%(listname)s</em>'))
+        # Avoid cross-site scripting attacks
+        safelistname = cgi.escape(listname)
+        handle_no_list(_('No such list <em>%(safelistname)s</em>'))
         syslog('error', 'No such list "%s": %s\n', listname, e)
         return
 
diff --git a/Mailman/Cgi/confirm.py b/Mailman/Cgi/confirm.py
index 50fb59b62..869100db0 100644
--- a/Mailman/Cgi/confirm.py
+++ b/Mailman/Cgi/confirm.py
@@ -49,7 +49,9 @@ def main():
     try:
         mlist = MailList.MailList(listname, lock=0)
     except Errors.MMListError, e:
-        bad_confirmation(doc, _('No such list <em>%(listname)s</em>'))
+        # Avoid cross-site scripting attacks
+        safelistname = cgi.escape(listname)
+        bad_confirmation(doc, _('No such list <em>%(safelistname)s</em>'))
         doc.AddItem(MailmanLogo())
         print doc.Format()
         syslog('error', 'No such list "%s": %s', listname, e)
@@ -81,8 +83,10 @@ def main():
 
     days = int(mm_cfg.PENDING_REQUEST_LIFE / mm_cfg.days(1) + 0.5)
     confirmurl = mlist.GetScriptURL('confirm', absolute=1)
+    # Avoid cross-site scripting attacks
+    safecookie = cgi.escape(cookie)
     badconfirmstr = _('''<b>Invalid confirmation string:</b>
-    %(cookie)s.
+    %(safecookie)s.
 
     <p>Note that confirmation strings expire approximately
     %(days)s days after the initial subscription request.  If your
diff --git a/Mailman/Cgi/edithtml.py b/Mailman/Cgi/edithtml.py
index ae0b13d46..3b8ac21ad 100644
--- a/Mailman/Cgi/edithtml.py
+++ b/Mailman/Cgi/edithtml.py
@@ -62,7 +62,9 @@ def main():
     try:
         mlist = MailList.MailList(listname, lock=0)
     except Errors.MMListError, e:
-        doc.AddItem(Header(2, _('No such list <em>%(listname)s</em>')))
+        # Avoid cross-site scripting attacks
+        safelistname = cgi.escape(listname)
+        doc.AddItem(Header(2, _('No such list <em>%(safelistname)s</em>')))
         print doc.Format()
         syslog('error', 'No such list "%s": %s', listname, e)
         return
@@ -96,8 +98,10 @@ def main():
                     '%(realname)s -- Edit html for %(template_info)s'))
                 break
         else:
+            # Avoid cross-site scripting attacks
+            safetemplatename = cgi.escape(template_name)
             doc.SetTitle(_('Edit HTML : Error'))
-            doc.AddItem(Header(2, _("%(template_name)s: Invalid template")))
+            doc.AddItem(Header(2, _("%(safetemplatename)s: Invalid template")))
             doc.AddItem(mlist.GetMailmanFooter())
             print doc.Format()
             return
diff --git a/Mailman/Cgi/listinfo.py b/Mailman/Cgi/listinfo.py
index 297c33fe4..c72d14125 100644
--- a/Mailman/Cgi/listinfo.py
+++ b/Mailman/Cgi/listinfo.py
@@ -46,7 +46,9 @@ def main():
     try:
         mlist = MailList.MailList(listname, lock=0)
     except Errors.MMListError, e:
-        listinfo_overview(_('No such list <em>%(listname)s</em>'))
+        # Avoid cross-site scripting attacks
+        safelistname = cgi.escape(listname)
+        listinfo_overview(_('No such list <em>%(safelistname)s</em>'))
         syslog('error', 'No such list "%s": %s', listname, e)
         return
 
diff --git a/Mailman/Cgi/options.py b/Mailman/Cgi/options.py
index 8df521a34..be54f0daf 100644
--- a/Mailman/Cgi/options.py
+++ b/Mailman/Cgi/options.py
@@ -61,10 +61,12 @@ def main():
     try:
         mlist = MailList.MailList(listname, lock=0)
     except Errors.MMListError, e:
+        # Avoid cross-site scripting attacks
+        safelistname = cgi.escape(listname)
         title = _('CGI script error')
         doc.SetTitle(title)
         doc.AddItem(Header(2, title))
-        add_error_message(doc, _('No such list <em>%(listname)s</em>'))
+        add_error_message(doc, _('No such list <em>%(safelistname)s</em>'))
         doc.AddItem('<hr>')
         doc.AddItem(MailmanLogo())
         print doc.Format()
@@ -91,7 +93,9 @@ def main():
     # Sanity check the user, but be careful about leaking membership
     # information when we're using private rosters.
     if not mlist.isMember(user) and mlist.private_roster == 0:
-        add_error_message(doc, _('No such member: %(user)s.'))
+        # Avoid cross-site scripting attacks
+        safeuser = cgi.escape(user)
+        add_error_message(doc, _('No such member: %(safeuser)s.'))
         loginpage(mlist, doc, None, cgidata)
         print doc.Format()
         return
diff --git a/Mailman/Cgi/private.py b/Mailman/Cgi/private.py
index 9b1a3e05d..e881d638b 100644
--- a/Mailman/Cgi/private.py
+++ b/Mailman/Cgi/private.py
@@ -92,7 +92,9 @@ def main():
     try:
         mlist = MailList.MailList(listname, lock=0)
     except Errors.MMListError, e:
-        msg = _('No such list <em>%(listname)s</em>')
+        # Avoid cross-site scripting attacks
+        safelistname = cgi.escape(listname)
+        msg = _('No such list <em>%(safelistname)s</em>')
         doc.SetTitle(_("Private Archive Error - %(msg)s"))
         doc.AddItem(Header(2, msg))
         print doc.Format()
@@ -148,11 +150,11 @@ def main():
         else:
             f = open(true_filename, 'r')
     except IOError:
-        charset = Utils.GetCharSet(lang)
-        print 'Content-type: text/html; charset=' + charset + '\n\n'
-
-        print "<H3>" + _("Archive File Not Found") + "</H3>"
-        print _("No file"), path, '(%s)' % true_filename
+        msg = _('Private archive file not found')
+        doc.SetTitle(msg)
+        doc.AddItem(Header(2, msg))
+        print doc.Format()
+        syslog('error', 'Private archive file not found: %s', true_filename)
     else:
         print 'Content-type: %s\n' % ctype
         sys.stdout.write(f.read())
diff --git a/Mailman/Cgi/rmlist.py b/Mailman/Cgi/rmlist.py
index 87e725585..77c0b2ffe 100644
--- a/Mailman/Cgi/rmlist.py
+++ b/Mailman/Cgi/rmlist.py
@@ -57,7 +57,9 @@ def main():
     try:
         mlist = MailList.MailList(listname, lock=0)
     except Errors.MMListError, e:
-        title = _('No such list <em>%(listname)s</em>')
+        # Avoid cross-site scripting attacks
+        safelistname = cgi.escape(listname)
+        title = _('No such list <em>%(safelistname)s</em>')
         doc.SetTitle(title)
         doc.AddItem(
             Header(3,
@@ -72,17 +74,6 @@ def main():
     i18n.set_language(mlist.preferred_language)
     doc.set_language(mlist.preferred_language)
 
-    if len(parts) <> 1:
-        # Bad URL specification
-        title = _('Bad URL specification')
-        doc.SetTitle(title)
-        doc.AddItem(
-            Header(3, Bold(FontAttr(title, color='#ff0000', size='+2'))))
-        doc.AddItem(mlist.GetMailmanFooter())
-        print doc.Format()
-        syslog('error', 'Bad URL specification: %s', parts)
-        return
-
     # Be sure the list owners are not sneaking around!
     if not mm_cfg.OWNERS_CAN_DELETE_THEIR_OWN_LISTS:
         title = _("You're being a sneaky list owner!")
diff --git a/Mailman/Cgi/roster.py b/Mailman/Cgi/roster.py
index 1d72ab470..445c4dcf1 100644
--- a/Mailman/Cgi/roster.py
+++ b/Mailman/Cgi/roster.py
@@ -52,7 +52,9 @@ def main():
     try:
         mlist = MailList.MailList(listname, lock=0)
     except Errors.MMListError, e:
-        error_page(_('No such list <em>%(listname)s</em>'))
+        # Avoid cross-site scripting attacks
+        safelistname = cgi.escape(listname)
+        error_page(_('No such list <em>%(safelistname)s</em>'))
         syslog('error', 'roster: no such list "%s": %s', listname, e)
         return
 
diff --git a/Mailman/Cgi/subscribe.py b/Mailman/Cgi/subscribe.py
index 7f6783e9d..188dec2b6 100644
--- a/Mailman/Cgi/subscribe.py
+++ b/Mailman/Cgi/subscribe.py
@@ -55,8 +55,10 @@ def main():
     try:
         mlist = MailList.MailList(listname, lock=0)
     except Errors.MMListError, e:
+        # Avoid cross-site scripting attacks
+        safelistname = cgi.escape(listname)
         doc.AddItem(Header(2, _("Error")))
-        doc.AddItem(Bold(_('No such list <em>%(listname)s</em>')))
+        doc.AddItem(Bold(_('No such list <em>%(safelistname)s</em>')))
         print doc.Format()
         syslog('error', 'No such list "%s": %s\n', listname, e)
         return