Fixes for a minor local security hole. Some of the CGI scripts could

bomb with tracebacks if PATH_INFO environment variable wasn't defined.
Fixed this by making them all use Utils.GetPathPieces() and "doing
something sensible" when that returned a false value.

Also, edithtml is now hidden behind a login screen, so there's no need
to enter the list password to edit the html.  You can't even get to
the list of files to edit unless you've admin authenticated.  Closes
SF bug #114091, Jitterbug PR# 24.

1 files changed, 2 insertions, 8 deletions

diff --git a/Mailman/Cgi/listinfo.py b/Mailman/Cgi/listinfo.py
index 92fa038a8..8c9e78229 100644
--- a/Mailman/Cgi/listinfo.py
+++ b/Mailman/Cgi/listinfo.py
@@ -32,14 +32,8 @@ from Mailman.Logging.Syslog import syslog
 
 
 def main():
-    try:
-        path = os.environ['PATH_INFO']
-    except KeyError:
-        FormatListinfoOverview()
-        return
-
-    parts = Utils.GetPathPieces(path)
-    if len(parts) == 0:
+    parts = Utils.GetPathPieces()
+    if not parts:
         FormatListinfoOverview()
         return