Detect when being visited with nonexistent member and bail immediately

with a suitable error message.  (Before this the options page would be
created, and if the lack of a password entry could be circumvented a
bogus user could be created for any list.  Access to the list admin or
site admin password would suffice.)

1 files changed, 9 insertions, 0 deletions

diff --git a/cgi/options b/cgi/options
index 2f4829d1b..a3643b4c7 100755
--- a/cgi/options
+++ b/cgi/options
@@ -38,11 +38,19 @@ if not list._ready:
     print doc.Format()
     sys.exit(0)
 
+if string.lower(user) not in list.members:
+    doc.AddItem(htmlformat.Header(2,
+                                  "%s: No such member %s."
+                                  % (list_name, `user`)))
+    print doc.Format()
+    sys.exit(0)
+
 if list.obscure_addresses:
     presentable_user = mm_utils.ObscureEmail(user, for_text=1)
 else:
     presentable_user = user
 
+
 replacements = list.GetStandardReplacements()
 replacements['<mm-digest-radio-button>'] = list.FormatOptionButton(
 	mm_cfg.Digests, 1, user)
@@ -82,5 +90,6 @@ replacements['<mm-user>'] = user
 replacements['<mm-presentable-user>'] = presentable_user
 replacements['<mm-email-my-pw>'] = list.FormatButton('emailpw', 'Email my password')
 
+
 doc.AddItem(list.ParseTags('options.html', replacements))
 print doc.Format()