summaryrefslogtreecommitdiff
path: root/Mailman
Commit message (Collapse)AuthorAgeFilesLines
...
* WEB_BGCOLOR => WEB_BG_COLORbwarsaw2001-06-071-14/+15
| | | | | | | | WEB_HEADERCOLOR => WEB_HEADER_COLOR Added WEB_SUBHEADER_COLOR, WEB_ERROR_COLOR, WEB_LINK_COLOR, WEB_ALINK_COLOR, WEB_VLINK_COLOR (the latter three after David Champion's SF patch #401372).
* Globally, WEB_HEADERCOLOR => WEB_HEADER_COLORbwarsaw2001-06-073-5/+5
|
* main(): Better, more consistent error pages, after a suggestion bybwarsaw2001-06-071-12/+25
| | | | | | | | | David Champion (SF patch #401372). add_error_message(): Default tag is now 'Error: ' which was the more commonly used tag. Globally, WEB_HEADERCOLOR => WEB_HEADER_COLOR
* Globally, WEB_HEADERCOLOR => WEB_HEADER_COLORbwarsaw2001-06-071-9/+9
| | | | add_error_message(): Use WEB_ERROR_COLOR instead of hardcoded #ff0000
* Module global article_template removed. Instead, this html is movedbwarsaw2001-06-071-56/+4
| | | | | | into templates/en/article.html and as_html() is modified to use the standard maketext() call to retrieve the template and interpolate in a dictionary of values.
* De-string-module-ification, and other import sanitizing.bwarsaw2001-06-071-13/+25
| | | | | | | Document(): WEB_BGCOLOR => WEB_BG_COLOR. Also, if WEB_VLINK_COLOR, WEB_ALINK_COLOR, or WEB_LINK_COLOR are defined in mm_cfg.py (as not false), use them in the document's BODY tag. This is an adaptation of David Champion's SF patch #401372.
* Add missing import of the 'errno' module.twouters2001-06-061-0/+1
|
* Untabification.bwarsaw2001-06-021-26/+27
|
* close(): When the file object is closed, set __fp to None so it getsbwarsaw2001-06-021-1/+2
| | | | re-opened at the next attempted write.
* options_page(): Missed an i18n marking. Found by Ousmane Wilane.bwarsaw2001-06-021-1/+1
|
* Updates for the new authentication scheme. Note that there are otherbwarsaw2001-06-011-46/+40
| | | | | | | | | | | | | | | cleanups we could do to this file, but there are other priorities at the moment. Cleaned up the imports. Removed login_attemped and _list unused module globals. i18n setup. main(): Set the i18n language, first to the server default, then to the list preferred, once we have a valid list, and to the user's preferred language once we know that. Updates for new string methods. Removed a call to IsListInitialized() and use return instead of sys.exit(0). Better cgidata style. Use new WebAuthenticate() mechanisms to authenticate the user.
* CheckCookie(): If the authcontext is AuthUser and the `user' argumentbwarsaw2001-06-011-1/+27
| | | | | | | | | | | | | is false, then scan the cookie keys for user names. This is used in private archive authentication (which doesn't have a user context in the url), so that if a user has already authenticated to edit their options, they get into the private archives with no login necessary. Note that this does /not/ open a hole for user option pages because those have a user context in the url which is passed to CheckCookie and must match explicitly. __checkone(): Does one authcontext/user authentication.
* GetBaseArchiveURL(): Make sure private archive url ends in a slash.bwarsaw2001-06-011-1/+1
|
* RestrictedListMessage(): Fixed a typo (missing open paren), andbwarsaw2001-06-011-4/+5
| | | | converted to multiline strings for ease of translation.
* Authenticate(): When sha hex digesting the response, save the resultsbwarsaw2001-05-311-2/+4
| | | | | in a temporary variable and check that variable against the secret (this is so that subsequent checks have the raw password).
* main(): Convert to the new world order for web authentication,bwarsaw2001-05-311-13/+18
| | | | | | | | allowing the list-admin, list-moderator, or site-moderator access to the admindb. Also, don't hard code the background color. handle_no_list(): Clean this up by using Utils.ScriptURL() to give us the url to the admin overview page.
* process(): Check for administrivia as the first hold test. Thisbwarsaw2001-05-311-5/+5
| | | | change is a candidate for 2.0.6.
* A considerable rewrite to support many new features, and to obviatebwarsaw2001-05-311-34/+506
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the need for the handle_opts.py script. Specifically, main(): - Do all form processing in this script, and point the form's action back at this script. This is so we don't need handle_opts anymore. - Protect access to this form behind a login screen which also contains a password mail-back button, and a quick unsubscribe (with confirmation) button. - Use the new world order for web authentication, allowing AuthUser, AuthListAdmin, and AuthSiteAdmin to access a user's options page. - Add a "logout" button to the option page, and remove any need to enter passwords once we're at the options page. - Add support for a change-of-address, including the ability to change the membership address globally for all lists the user is a member of (requires confirmation from the new address). - Add support for global change of password. - Add support for global setting of enable/disable flag, and of password reminder flag. - Use IsMember() to test for address membership. Also, we don't need to pass the document background color as an argument anymore. Other colors are no longer hardcoded, but taken from mm_cfg.
* Add support for the list moderator role, and change of addressbwarsaw2001-05-311-5/+134
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | requests. Specifically, InitVars(): Add the moderator attribute, which is a list of email addresses a la the owner attribute. GetConfigInfo(): Added some details to the `owner' attribute describing the different list-related roles. Also added the `moderator' attribute and copied the description of roles to its details too. ChangeMemberAddress(): Added support for change-of-address. This method simply pends the request and sends the confirmation email to the new address (the old one is already verified by way of the web authentication). ApprovedChangeMemberAddress(): Effects the actual change-of-address by adding the member, copying over the user options and the language settings, and then removing the old address. Acknowledgements are always sent. Handle the global change-of-address by searching for all the matching lists (must match both host_name and have the old address of the user as a member), and recursively calling ApprovedChangeMemberAddress() on those lists -- with the global flag turned off of course! ProcessConfirmation(): Add support for CHANGE_OF_ADDRESS, which simply unpacks the data and calls ApprovedChangeMemberAddress(). ApprovedAddMember(): Fixed a bug in the order of arguments in the call to ApprovedAddMembers() - plural. DeleteMember(): Fixed a bug in the i18n-marked subject text, related to auto-interpolation. SetPreferredLanguage(): Assert that the language we're setting to is in the list of available languages (helped catch the ApprovedAddMember() bug above). Also, only add DEFAULT_SERVER_LANGUAGE if it isn't already an item in the list.
* This file is no longer necessary. All the functionality has beenbwarsaw2001-05-311-346/+0
| | | | moved to the options.py file.
* NewVars(): Add mod_password and moderator attributes to list schemas.bwarsaw2001-05-311-0/+2
|
* DATA_FILE_VERSION: Bump this so that list config.db schemas will bebwarsaw2001-05-311-1/+1
| | | | updated to include the mod_password and moderator attributes.
* Changes to support the new world order of authentication, usingbwarsaw2001-05-311-61/+150
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | authorization contexts and the roles of User, List Owner, List Moderator, (List) Creator/Destroyer, Site Administrator. Specifically, InitVars(): Add a mod_password attribute that can contain the sha hashed list moderator's password. ValidAdminPassword(), ConfirmAdminPassword(): Removed as obsolete. AuthContextInfo(): Given an authorization context, and optionally a user (if authcontext == AuthUser), return the context's secret and cookie key. The tuple (None, None) is returned if the authcontext is bogus. MMNotAMemberError is raised if the user isn't a member of the list, and MMBadUserError is raised if the user's secret is None. Authenticate(): The non-web way of doing authentication. Takes a list of allowed authcontexts (and optionally a user name if AuthUser is one of those contexts), and a response string (i.e. password). Returns the authcontext from the argument sequence that matches the response, or UnAuthorized if none of them did. WebAuthenticate(): The web way of doing authentication. The arguments are the same as Authenticate(), but first the cookie data is checked. If that fails, then Authenticate() is used. Returns a flag indicating whether authentication succeeded or not. MakeCookie(): Now takes an authcontext and optionally a user (required if authcontext is AuthUser). Generates a cookie item for this context. ZapCookie(): Now takes an authcontext and optionally a user (required if authcontext is AuthUser). Generates an empty cookie item for this context, effectively logging out that authcontext. CheckCookie(): Now takes an authcontext and optionally a user (required if authcontext is AuthUser). Returns a flag indicating whether the authcontext's cookie matches the expected value, i.e. whether they are cookie authenticated or not. ChangeUserPassword(): Remove the test for IsListInitialized(), and removed the Save() call, since all paths to this method should be wrapped in the standard lock-modify-save-unlock fence.
* _dispose(): When a message is destined "toowner" and the metadatabwarsaw2001-05-311-1/+12
| | | | | contains the "tomoderators" key, sent the message to both the list owners and the list moderators.
* hold_for_approval(): We want the admin notification message to appearbwarsaw2001-05-311-4/+9
| | | | | | | | | to come from the list owner to avoid any unnecessary bounce processing. Also, and more importantly, set the message's metadata "tomoderators" flag so that the admin notification message will be sent to both the list owners and the list moderators.
* Update a comment.bwarsaw2001-05-311-1/+3
|
* process(): Use the new world order for doing authentication. Sincebwarsaw2001-05-311-4/+8
| | | | | | | | | | | | | this isn't a web auth, we just use Authenticate() and pass in the appropriate authcontext. In this case, we're allowing either the list moderator or the list owner to approve messages. We're specifically /not/ allowing the site administrator in order to reduce the urge to send the site password through email in the clear. Also, accept either "Approved: password" or "Approve: password" headers.
* main(), process_form(), print_results(): We don't need to pass thebwarsaw2001-05-311-5/+5
| | | | | document background color as an argument anymore. Other colors are no longer hardcoded, but taken from mm_cfg.
* main(): Use the new world order for authentication, by usingbwarsaw2001-05-311-39/+25
| | | | | | | | mlist.WebAuthenticate() and passing in the authentication contexts. In this case when the roster is private to members, the authcontext is the AuthUser, AuthListModerator, AuthListAdmin, and AuthSiteAdmin. When the context is list-admin only, then the authcontext is AuthListModerator, AuthListAdmin, and AuthSiteAdmin.
* main(), process_request(), request_deletion(): We don't need to passbwarsaw2001-05-311-16/+21
| | | | | | | | | | the document background color as an argument anymore. Other colors are no longer hardcoded, but taken from mm_cfg. process_request(): Use the new world order for authentication, by using mlist.WebAuthenticate() and passing in the authentication contexts. In this case the AuthCreator, AuthListAdmin, and AuthSiteAdmin can all delete lists.
* main(): We don't need to pass the document background color as anbwarsaw2001-05-312-7/+7
| | | | | argument anymore. Other colors are no longer hardcoded, but taken from mm_cfg.
* listinfo_overview(): We don't need to pass the document backgroundbwarsaw2001-05-311-3/+3
| | | | | color as an argument anymore. Other colors are no longer hardcoded, but taken from mm_cfg.
* main(), process_request(), request_creation(): We don't need to passbwarsaw2001-05-311-18/+21
| | | | | the document background color as an argument anymore. Other colors are no longer hardcoded, but taken from mm_cfg.
* main(): We don't need to pass the document background color as anbwarsaw2001-05-311-6/+11
| | | | | | argument to Format() anymore. success(): Handle the the new CHANGE_OF_ADDRESS confirmable action.
* main(): Convert to the new world order for authentication. We don'tbwarsaw2001-05-311-87/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | use Auth.authentication() anymore because mlist.WebAuthenticate() now does the job nicely, with all the acceptable authentication contexts passed as an argument. Also, when logging out, ZapCookie() takes an authentication context (in this case it's AuthListAdmin). main(), admin_overview(), option_help(), show_variables(), add_options_table_item(), membership_options(), submit_button(): We don't need to pass the document background color as an argument anymore. Other colors are no longer hardcoded, but taken from mm_cfg. show_results(): Small change to admindb link text; these are called moderator requests now. password_inputs(): Change this section so that it prompts for both changes to the list owner passwords, and the list moderator passwords, the latter of which gains access only to the pending requests page. change_options(): Because we no longer require the admin password in order to change the password (because it would have had to have been supplied in order to even get here), we can simplify the password change processing. We also need to add the moderator password change processing, and this should happen before the list owner password change processing, because the latter requires that the authorization cookie be regenerated.
* Stupid change because the last checkin failed to say:bwarsaw2001-05-311-1/+2
| | | | | authenticate(): This is removed as obsolete because of the new authentication scheme.
* loginpage(): Add the standard footer to the login page. The loginbwarsaw2001-05-311-35/+8
| | | | | | | template is now in admlogin.html instead of admlogin.txt. If the scriptname is "admindb", then we're asking for the list-moderators password (although the list owner's password will still work of course).
* Document: Set the default background color of the document tobwarsaw2001-05-311-1/+5
| | | | | | | | | | | | mm_cfg.WEB_BGCOLOR. Document.set_bgcolor(): New method to set the bgcolor attribute. Document.Format(): Add self.bgcolor to the kws dictionary if it isn't already there (i.e. allow it to be overridden by the caller). This means that we don't need to pass the background color in the Format() call for most cases. Cleans up the code and parameterizes the background color for site customization.
* maketext(): When interpolating the dict into the template, catchbwarsaw2001-05-311-1/+1
| | | | | ValueError too. This can happen if there's a typo in the template such that a bogus format character appears (e.g. %(blah)y).
* Added another confirmable action: a change of address request.bwarsaw2001-05-311-2/+7
| | | | | | | | Specifically, CHANGE_OF_ADDRESS: new constant for this type of confirmable request. new(): Add CHANGE_OF_ADDRESS to the assert.
* HoldSubscription(): Removed some old language setting cruft. Also,bwarsaw2001-05-311-10/+6
| | | | | | | | | | the subscription request email should appear to come from the -owner not the -admin to avoid unnecessary bounce processing. Also, because this message is part of the pending moderation requests (i.e. a moderator can approve or disapprove a subscription request), set the message metadata key "tomoderators" so that the message will be delivered to both the list owners and the list moderators.
* FormatOptionButton(): Formatting, but also change the 'passwdremind'bwarsaw2001-05-311-22/+20
| | | | | | | | value to 'remind'. FormatDisabledNotice(): Cleaned up the text message by using multi-line strings and string interpolation. This should also improve the ability for these messages to be translated into Japanese.
* SetUserDigest(): Do not do a self.Save() at the end of this. Ibwarsaw2001-05-311-2/+0
| | | | | | | | believe all calls to SetUserDigest() should be wrapped in the standard lock-munge-save-unlock fences. If not, they should be! This should radically improve performance when many of these calls are made sequentially.
* MailUserPassword(): Include the full posting email address of the listbwarsaw2001-05-311-2/+3
| | | | | | | | | in the userpass.txt notification. Change the 'adminaddr' key to 'owneraddr' since we want them to contact the list-owner@ with questions, not the list-admin@ (which does bounce processing). Also, sent the message as if it were coming from the -admin address not the -request address.
* New user configurable variables, for control of the (non-templated)bwarsaw2001-05-311-7/+46
| | | | | | | | | | | | | | | | | | | | | | | | | web UI colors: WEB_BGCOLOR WEB_HEADERCOLOR WEB_ADMINITEM_COLOR WEB_ADMINPW_COLOR ADMIN_COOKIE_LIFE is removed. We now only support session cookies. New authentication role variables: UnAuthorized AuthUser AuthCreator AuthListAdmin AuthListModerator AuthSiteAdmin With an explanation of what each role is for. Code will glom together sequences of authentication roles when they want to do a web-authentication. This essentially specifies which passwords/cookies will be accepted for a particular task.
* Fix typo observed by nobody (aka Anonymous) in SF bug #426002: 'data' shouldtwouters2001-05-291-1/+1
| | | | | | | be 'date'. I don't usually like touching pipermail, but in this case, the pain is minimal. Closes SF bug #426002.
* main(): The options.html template now has a field for suppressing thebwarsaw2001-05-251-0/+4
| | | | | | password reminder for this list. Support is added for <mm-dont-get-password-reminder-button> and <mm-get-password-reminder-button> replacements.
* process_form(): Add support for SuppressPasswordReminder user option.bwarsaw2001-05-251-0/+4
|
* UserNotification.send(): Add optional **_kws which are passed straightbwarsaw2001-05-251-3/+4
| | | | through to the enqueue() method.
* GetAvailableLanguages(): Add a comment.bwarsaw2001-05-251-0/+4
|
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-14 09:50:39 +0000