summaryrefslogtreecommitdiff
path: root/Mailman/Cgi/private.py
Commit message (Collapse)AuthorAgeFilesLines
* Bite the bullet: rename the Mailman package to mailman.Barry Warsaw2008-02-271-190/+0
|
* Tweak copyright years.Barry Warsaw2008-02-071-1/+1
|
* Update copyright years.bwarsaw2007-01-191-1/+1
|
* MailList.py ... GetScriptURL() absolute again because we need it for emailtkikuchi2006-11-091-1/+1
| | | | | | | | notifications. wsgi_app.py ... URI normalization by stripping trailing slash. We need Special care for 'private'. Strip dot only components in the PATH_INFO for sanitization.
* More work on the WSGI support. So far, I've tested most of the admin.py linksbwarsaw2006-10-151-10/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and some of the admindb.py links. There may still be breakage in other parts of the interface and I haven't gone back to verify that traditional CGI still works. Changes: - Add wsgiref-0.1.2-py2.4.egg so that we can still do WSGI in Python 2.4, which doesn't come with wsgiref. Of course this means we /also/ have to add setuptools-0.5c3 because eggs require setuptools. - Style cleanups in HTTPRunner.py and wsgi_app.py. Also, use cStringIO instead of StringIO. - All internal links within the listinfo and admin pages are (or at least should be ;) relative now. This should make other things better, such as running Mailman over https or alternative ports. It does kind of mean that web_page_url is obsolete, but I haven't looked at whether we can completely eradicate it. - ValidateEmail(): Use ' ' in s instead of s.count(' ') > 0. - GetPathPieces(): When path is false, return the empty list instead of None, so we can still len() it. - ScriptURL(): Much simpler. To support relative urls as the default, we change the API so that it only takes a 'target' argument (i.e. the script we want to link to). It no longer takes 'absolute' or 'web_page_url', and it constructs its link from GetPathPieces(), the target, and the cgi extension. - GetRequestURI(): code style updates. - Mailman/bin/show_config.py: De-DOS-line-ending-ification. - export.py: A few modifications, although this is likely still not final (I'm still working on the import script). First, for <option> elements, don't put the value in an attribute, put it in the text body of the element. Second, put the list <option> tags in a <configuration> element. Third, put the preferred language on an <option> tag with a 'preferred_language' name attribute value. - SecurityManager: Make sure that MakeCookie() and ZapCookie() use the same 'path' cookie value by refactoring that into a separate method. That method now returns just the SCRIPT_NAME and the full listname. web_page_url doesn't enter into it. - loginit.py: Add a 'debug' logger since it's just too useful to have :) - admin.py: Remove the extra / right before the query string in ?VARHELP urls. That extra / turns out to be problematic with the relative url scheme we're using now. - Auth.py: whitespace normalization and copyright years update. Also, remove a couple of unnecessary imports. Also, make sure that the actionurl is relative. - create.py: Typo. - private.py: mm_cfg -> config object - In MailList.py: GetScriptURL() can be written in terms of Utils.ScriptURL() now.
* WSGI HTTP Server for Mailman Web interface.tkikuchi2006-10-091-1/+2
| | | | | | | | Add: HTTPRunner.py ... Start/Restart/Stop HTTP Server under Runner framework. wsgi_app.py ... WSGI to CGI wrapper. Mostly taken from scripts/driver. loginit.py ... Add http log. Time stamp is duplicated :-( Defaults.py ... HTTP_HOST and HTTP_PORT. Note that WSGI server should be used under reverse proxy environment.
* - Convert all logging to Python's standard logging module. Get rid of allbwarsaw2006-04-171-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | traces of our crufty old Syslog. Most of this work was purely mechanical, except for: 1) Initializing the loggers. For this, there's a new module Mailman/loginit.py (yes all modules from now on will use PEP 8 names). We can't call this 'logging.py' because that will interfere with importing the stdlib module of the same name (can you say Python 2.5 and absolute imports?). If you want to write log messages both to the log file and to stderr, pass True to loginit.initialize(). This will turn on propagation of log messages to the parent 'mailman' logger, which is set up to print to stderr. This is how bin/qrunner works when not running as a subprocess of mailmanctl. 2) The driver script. I had to untwist the StampedLogger stuff and implement differently printing exceptions and such to log/error because standard logging objects don't have a write() method. So we write to a cStringIO and then pass that to the logger. 3) SMTPDirect.py because of the configurability of the log messages. This required changing SafeDict into a dict subclass (which is better than using UserDicts anyway -- yay Python 2.3!). It's probably still possible to flummox things up if you change the name of the loggers in the SMTP_LOG_* variables in mm_cfg.py. However, the worst you can do is cause output to go to stderr and not go to a log file. Note too that all entry points into the Mailman system must call Mailman.loginit.initialize() or the log output will go to stderr (which may occasionally be what you want). Currently all CGIs and qrunners should be working properly. I wish I could have tested all code paths that touch the logger, but that's infeasible. I have tested this, but it's possible that there were some mistakes in the translation. - Mailman.Bouncers.BounceAPI.Stop is a singleton, but not a class instance any more. - True/False code cleanup, PEP 8 import restructuring, whitespace normalization, and copyright year updates, as appropriate.
* Fix XSS bug: Thanks Moritz Naumann. (CVE-2006-1512)tkikuchi2006-04-041-2/+3
|
* Port cleaning changes forward from 2.1-maint branch.bwarsaw2005-12-301-12/+10
|
* Fixes for bug 1080943.msapiro2005-12-121-6/+27
| | | | Add error response for ./ and ../ in URL
* back porting from 2.1.6tkikuchi2005-08-281-4/+7
|
* FSF office has moved. chdcking in for MAIN branch.tkikuchi2005-08-271-1/+1
|
* guess_type(): Compatibility function for Python 2.1/2.2, the formerbwarsaw2003-02-031-1/+10
| | | | | | | which does not accept the strict flag to mimetypes.guess_type(). main(): If guess_type() returns None, use text/html so that the private archive summary page displays correctly.
* main(), content_type(): Removed the latter; mimetyes.guess_type() doesbwarsaw2003-01-201-15/+8
| | | | | | this better. Whitespace normalization.
* QuoteHyperChars() -> websafe()bwarsaw2002-05-221-1/+1
| | | | | Also, use Utils.websafe() consistently throughout, instead of the inconsistent calls to cgi.escape().
* Add BAW comments so we know that these modules still need to bebwarsaw2002-03-051-1/+2
| | | | converted to the Site module abstractions.
* Forward port security patch from Mailman 2.0.8:bwarsaw2001-11-301-6/+8
| | | | | | | | | | Fixes to prevent cross-site scripting exploits. See http://www.cert.org/advisories/CA-2000-02.html Reported by zeno@cgisecurity.com Fix is to cgi.escape() any strings regurgitated from the url back to the browser in the html response.
* Get rid of useless import (reported by Dan Mick).bwarsaw2001-10-251-1/+0
|
* Another step towards conversion to MemberAdaptor API.bwarsaw2001-07-291-1/+1
| | | | GetPreferredLanguage() -> getMemberLanguage()
* main(): Use archive_dir() instead of the archive_directory attribute.bwarsaw2001-07-261-1/+1
|
* Better syslog() calling conventions. Also, don't mark syslog messagesbwarsaw2001-06-271-1/+1
| | | | as translatable.
* Updates for the new authentication scheme. Note that there are otherbwarsaw2001-06-011-46/+40
| | | | | | | | | | | | | | | cleanups we could do to this file, but there are other priorities at the moment. Cleaned up the imports. Removed login_attemped and _list unused module globals. i18n setup. main(): Set the i18n language, first to the server default, then to the list preferred, once we have a valid list, and to the user's preferred language once we know that. Updates for new string methods. Removed a call to IsListInitialized() and use return instead of sys.exit(0). Better cgidata style. Use new WebAuthenticate() mechanisms to authenticate the user.
* main(): We don't need to pass the document background color as anbwarsaw2001-05-311-2/+2
| | | | | argument anymore. Other colors are no longer hardcoded, but taken from mm_cfg.
* main(): Instead of passing in the list's preferred language, simplybwarsaw2001-05-181-1/+1
| | | | | pass in the MailList object; maketext() digs the preferred language out of the list object.
* main(): Change the way the private archives authentication page isbwarsaw2001-05-161-5/+7
| | | | | | | | | displayed: - use the private.html template instead of private.txt - calculate the ACTION attribute via the absolute url back to the `private' cgi script
* De-string-module-ification.bwarsaw2001-05-031-4/+7
|
* main(): Utils.GetCharSet() requires the language as an argument.bwarsaw2001-05-011-1/+2
|
* More i18n changes.bwarsaw2001-02-281-12/+15
| | | | | | | | | Untabification. Fix some _() wrappings to use local variables. Fix the Utils.maketext() calls to pass the language in as a keyword argument.
* jcrey's latest round of I18N changes.bwarsaw2000-12-261-48/+5
|
* First round integration of Juan Carlos's translatable string markings.bwarsaw2000-12-071-14/+14
|
* Added a hack to access the raw full archive when archives arebwarsaw2000-10-021-12/+24
| | | | | | | | | private. Specifically, main(): Check PATH_INFO and see if the paths is listname.mbox/listname.mbox, in which case the full archive is being retrieved. If so, make sure the Content-Type: is text/plain and feed the whole mbox out to the browser.
* Fixes for a minor local security hole. Some of the CGI scripts couldbwarsaw2000-09-291-12/+4
| | | | | | | | | | | bomb with tracebacks if PATH_INFO environment variable wasn't defined. Fixed this by making them all use Utils.GetPathPieces() and "doing something sensible" when that returned a false value. Also, edithtml is now hidden behind a login screen, so there's no need to enter the list password to edit the html. You can't even get to the list of files to edit unless you've admin authenticated. Closes SF bug #114091, Jitterbug PR# 24.
* PAGE: Include some information on cookies in the login screen. Closesbwarsaw2000-07-251-1/+8
| | | | SF Bug #110142.
* main(): syslog() call needs log file first argument.bwarsaw2000-06-281-1/+1
|
* Convert all uses of sys.stderr.write() and mlist.LogMsg() to the newbwarsaw2000-06-021-1/+2
| | | | syslog() interface.
* Some meager consistency in handling errors when trying to open thebwarsaw2000-04-041-6/+6
| | | | | | | | | | | | | | mailing list. In all cases, catch the base exception class MMListError, and output HTML indicating the specified list doesn't exist. A more detail message gets printed to logs/error (the str() of the actual exception details). Also: admin.py - Don't catch MMBadConfigError around mlist.parse_matching_header_opt() since this method doesn't ever raise that exception. Actually, that exception isn't raised anywhere in Mailman, so it's been removed.
* Update the copyright lines to include the years 1999 & 2000.bwarsaw2000-03-211-3/+1
|
* SecurityManager:hmeland1999-06-131-81/+67
| | | | | | | | | | | | | | | | | | * New method WebAuthenticate(). Takes up to three keyword arguments: user-address, password and cookie-suffix. If password is supplied (and authenticates OK), issue a cookie -- otherwise try to do authentication based on cookies. * MakeCookie(): Changed to actually return a finished Cookie object. Takes one (non-optional) argument; the created cookie's name. Fixed bug in setting of cookie's path. * CheckCookie(): Now takes cookie's name as single argument, and can raise various MMAuthenticationErrors if that cookie doesn't authenticate OK. admin.py: Do explicit re-authentication when changing list admin password. admin.py, admindb.py and private.py: Removed isAuthenticated() function -- use MailList.WebAuthenticate() instead. This removed the need to import Cookie, so now we don't.
* Changes to fix the CGI cookie security flaw reported by John Morton.hmeland1999-06-111-10/+7
| | | | | | | | | SecurityManager: New functions MakeCookie() and CheckCookie(). These functions work with cookies containing cookie creation and expire time, the client's IP number, and a checksum hash of these values as well as a secret (the lists (encrypted) admin password). admin.py, admindb.py and private.py: isAuthenticated now uses these new cookie functions.
* eradicate "maillist" as a nounbwarsaw1999-05-051-1/+1
|
* Don't use getListName() from this module to get teh name of the listbwarsaw1999-05-021-6/+6
| | | | | from PATH_INFO, instead use Utils.GetPathPieces() like every other CGI script.
* isAuthenticated(): Catch MMNotAMemberError and return 0bwarsaw1999-04-041-1/+2
|
* Make sure list_name is not an empty string or None (a.k.a. "false")bwarsaw1999-03-291-2/+5
|
* AMK says:bwarsaw1998-12-191-13/+27
| | | | | | | | | | "Here's a patch to private.py which makes it 1) return text/plain as the content type if the file ends in .txt, and 2) look for <filename>.gz if <filename> doesn't exist, and uses the gzip module to read it." Minimally tested, since I've got Pipermail installed. Doesn't seem hurt.
* Handle non-existant lists by printing a (excessively minimal) errorklm1998-11-201-5/+10
| | | | | page and raising SystemExit, which the driver expects - instead of generating an error that winds up in the error log.
* Mods to work with new archiving scheme.bwarsaw1998-11-031-10/+8
| | | | | | | | | | | | | | ROOT is gone. getListName(): must extract list name differently. GetListobj(): Interface change! Allow Errors.MMUnknownListError to propagate up. Returning None is not helpful because this will generally cause an AttributeError later on, and that just masks the real error, which is that the list name was not found. main(): when file isn't found, include the true_filename in the message (for debugging - shouldn't normally happen).
* Instead of hardcoding ROOT, calculate its value using mm_cfg.PREFIX,bwarsaw1998-10-201-1/+2
| | | | which contains the installation directory as determined by autoconf.
* All these changes are for implemented integrated pipermail based archives.cotton1998-10-091-98/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Original patches are from The Dragon de Monsyne with the following changes: -added support for private archives as well as public -added support for archiving daily and weekly -made archiving happen in real time -replaced use of pipermail's BSDBDatabase with homegrown python version -took out the need for DocumentTemplate here's a listing of changed files and relevant changes: Makefile.in - added public_html/archives to installdirs Mailman/Archiver.py - changed ArchiveMail to do real time archiving Mailman/Defaults.py.in - added archive frequency and and archive url extension variables Mailman/MailList.py - changed .Save() to alter perms on public vs. private archives Mailman/htmlformat.py - changes directly from The Dragon do Monsyne's patches. I don't know what they are exactly, but all the cgi's seem to work fine, so I assume they are OK. Mailman/versions.py - changes to add archiving based variables back to the list Mailman/Cgi/private - changed to make it work with default installation and made background white on login page src/Makefile.in - changes to make all wrappers setuid mailman: since various processes may access an archive, and the archiving mechanism uses "chmod", all archives must be owned by mailman, so all wrappers need to be owned by and setuid mailman added files: Mailman/HyperArch.py - from The Dragon de Monsyne with changes made noted above Mailman/HyperDatabase.py - the replacement for pipermail.BSDBDatabase scott
* A failed confirmation of the user password was causing 1 - success -klm1998-09-041-1/+1
| | | | | | | | | to be returned, and in fact, valid *and* invalid passwords were being accepted as sufficient authorization - since before 1.0b5, probably as of 1.0b4! (At least, since v 1.2 of this file.) Thanks to greg stein for noticing that invalid passwords were accepted.
* The name_pat regex (which was alleged to have been "fixed" on the lastklm1998-07-111-9/+12
| | | | | checkin) would not compile, causing this script to completely fail - it should have been tested!
generated by cgit v1.2.3-70-g09d2 (git 2.51.2) at 2025-11-08 22:11:22 +0000