Index: NEWS =================================================================== RCS file: /cvsroot/mailman/mailman/NEWS,v retrieving revision 1.25.2.1 retrieving revision 1.25.2.2 diff -u -r1.25.2.1 -r1.25.2.2 --- NEWS 2001/01/03 07:08:33 1.25.2.1 +++ NEWS 2001/03/03 06:51:26 1.25.2.2 @@ -4,6 +4,36 @@ Here is a history of user visible changes to Mailman. +2.0.2 (03-Mar-2001) + + Security fix: + + - A fix for a potential privacy exploit where a clever list + administrator could gain access to user passwords. This doesn't + allow them to do much more harm to the user then they normally + could, but they still shouldn't have access to the passwords. + + Bug fixes: + + - In the admindb page, don't complain when approving a + subscription of someone who's already on the list (SF bug + #222409 - Thomas Wouters). + + Also, quote for HTML the Subject: text printed for held + messages, otherwise messages with e.g. "Subject: " could + royally screw page formatting. + + - In Netscape.py bounce processor, don't bomb out on ill-formed + messages (no semi-colon separating parameters), otherwise mail + delivery could grind to a halt. Bug reported by Kambiz + Aghaiepour. + + - Docstring fix bin/newlist to remove mention of "immediate" + argument (Thomas Wouters). + + - Fix for bin/update when PREFIX != VAR_PREFIX (SF bug #229794 -- + Thomas Wouters). + 2.0.1 (03-Jan-2001) Bug fix release, namely fixes a buglet in bin/withlist affecting Index: UPGRADING =================================================================== RCS file: /cvsroot/mailman/mailman/UPGRADING,v retrieving revision 1.16.2.2 retrieving revision 1.16.2.3 diff -u -r1.16.2.2 -r1.16.2.3 --- UPGRADING 2001/01/03 06:35:43 1.16.2.2 +++ UPGRADING 2001/03/03 06:54:25 1.16.2.3 @@ -33,6 +33,11 @@ http://mail.python.org/pipermail/mailman-users/2000-September/006826.html +UPGRADING FROM 2.0.1 to 2.0.2 + + Nothing much more than running "make install" (after upgrading) + should be necessary. + UPGRADING FROM 2.0 to 2.0.1 Nothing much more than running "make install" (after upgrading) @@ -47,7 +52,7 @@ The cron jobs for Mailman 2.0 final have changed considerably, including the frequency with which they run. You should reload - misc/crontab.in for the `mailman' user to get the right settings. + cron/crontab.in for the `mailman' user to get the right settings. See the INSTALL file for details. FAILURE TO DO THIS WILL RESULT IN A LESS THAN OPTIMALLY FUNCTIONAL Index: Mailman/ListAdmin.py =================================================================== RCS file: /cvsroot/mailman/mailman/Mailman/ListAdmin.py,v retrieving revision 1.47 retrieving revision 1.47.2.1 diff -u -r1.47 -r1.47.2.1 --- Mailman/ListAdmin.py 2000/11/08 19:19:55 1.47 +++ Mailman/ListAdmin.py 2001/03/02 23:32:15 1.47.2.1 @@ -326,9 +326,13 @@ else: # subscribe assert value == mm_cfg.SUBSCRIBE - self.ApprovedAddMember(addr, password, digest) - # TBD: disgusting hack: ApprovedAddMember() can end up closing the - # request database. + try: + self.ApprovedAddMember(addr, password, digest, lang) + except Errors.MMAlreadyMember: + # User has already been subscribed, after sending the request + pass + # TBD: disgusting hack: ApprovedAddMember() can end up closing + # the request database. self.__opendb() return REMOVE Index: Mailman/Version.py =================================================================== RCS file: /cvsroot/mailman/mailman/Mailman/Version.py,v retrieving revision 1.20.2.1 retrieving revision 1.20.2.2 diff -u -r1.20.2.1 -r1.20.2.2 --- Mailman/Version.py 2001/01/03 06:49:34 1.20.2.1 +++ Mailman/Version.py 2001/03/03 06:19:15 1.20.2.2 @@ -1,4 +1,4 @@ -# Copyright (C) 1998,1999,2000 by the Free Software Foundation, Inc. +# Copyright (C) 1998,1999,2000,2001 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License @@ -15,7 +15,7 @@ # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. # Mailman version -VERSION = "2.0.1" +VERSION = "2.0.2" # And as a hex number in the manner of PY_VERSION_HEX ALPHA = 0xa @@ -27,7 +27,7 @@ MAJOR_REV = 2 MINOR_REV = 0 -MICRO_REV = 1 +MICRO_REV = 2 REL_LEVEL = FINAL # at most 15 beta releases! REL_SERIAL = 0 Index: Mailman/Bouncers/Netscape.py =================================================================== RCS file: /cvsroot/mailman/mailman/Mailman/Bouncers/Netscape.py,v retrieving revision 1.5 retrieving revision 1.5.2.2 diff -u -r1.5 -r1.5.2.2 --- Mailman/Bouncers/Netscape.py 2000/06/20 05:40:36 1.5 +++ Mailman/Bouncers/Netscape.py 2001/02/20 23:25:08 1.5.2.2 @@ -49,8 +49,10 @@ # multipart/mixed; # TBD: should we tighten this check? if msg.getmaintype() <> 'multipart': - return None + return boundary = msg.getparam('boundary') + if boundary is None: + return msg.fp.seek(0) mfile = multifile.MultiFile(msg.fp) mfile.push(boundary) Index: Mailman/Cgi/admindb.py =================================================================== RCS file: /cvsroot/mailman/mailman/Mailman/Cgi/admindb.py,v retrieving revision 1.36 retrieving revision 1.36.2.1 diff -u -r1.36 -r1.36.2.1 --- Mailman/Cgi/admindb.py 2000/09/29 00:05:05 1.36 +++ Mailman/Cgi/admindb.py 2001/03/03 06:02:01 1.36.2.1 @@ -1,4 +1,4 @@ -# Copyright (C) 1998,1999,2000 by the Free Software Foundation, Inc. +# Copyright (C) 1998,1999,2000,2001 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License @@ -186,7 +186,7 @@ t.AddRow([Bold('From:'), sender]) row, col = t.GetCurrentRowIndex(), t.GetCurrentCellIndex() t.AddCellInfo(row, col-1, align='right') - t.AddRow([Bold('Subject:'), subject]) + t.AddRow([Bold('Subject:'), cgi.escape(subject)]) t.AddCellInfo(row+1, col-1, align='right') t.AddRow([Bold('Reason:'), reason]) t.AddCellInfo(row+2, col-1, align='right') Index: Mailman/Handlers/Decorate.py =================================================================== RCS file: /cvsroot/mailman/mailman/Mailman/Handlers/Decorate.py,v retrieving revision 1.7 retrieving revision 1.7.2.1 diff -u -r1.7 -r1.7.2.1 --- Mailman/Handlers/Decorate.py 2000/09/15 17:19:19 1.7 +++ Mailman/Handlers/Decorate.py 2001/03/03 06:49:11 1.7.2.1 @@ -30,6 +30,9 @@ # Digests already have their own header and footers attached. return d = Utils.SafeDict(mlist.__dict__) + # Certain attributes are sensitive + del d['password'] + del d['passwords'] d['cgiext'] = mm_cfg.CGIEXT # interpolate into the header try: Index: admin/www/download.ht =================================================================== RCS file: /cvsroot/mailman/mailman/admin/www/download.ht,v retrieving revision 1.5.2.1 retrieving revision 1.5.2.2 diff -u -r1.5.2.1 -r1.5.2.2 --- admin/www/download.ht 2001/01/03 06:53:29 1.5.2.1 +++ admin/www/download.ht 2001/03/03 06:18:47 1.5.2.2 @@ -65,9 +65,9 @@

Downloading

Version -(2.0.1, +(2.0.2, released on -Jan 3 2001) +Mar 3 2001) is the current GNU release. It is available from the following mirror sites: