Fixed a bug in CommandRunner that could process the second word of a

body line as a command word and a case sensitivity in commands in
Subject: with an Re: prefix.

2 files changed, 13 insertions, 6 deletions

diff --git a/Mailman/Queue/CommandRunner.py b/Mailman/Queue/CommandRunner.py
index 6fbcac2a..c5cc3d94 100644
--- a/Mailman/Queue/CommandRunner.py
+++ b/Mailman/Queue/CommandRunner.py
@@ -146,18 +146,21 @@ class Results:
             #
             # If that still didn't work it isn't enough to stop processing.
             # BAW: should we include a message that the Subject: was ignored?
+            #
+            # But first, be sure we're looking at the Subject: and not past
+            # it already.
+            if self.lineno != 0:
+                return BADCMD
             if self.subjcmdretried < 1:
                 self.subjcmdretried += 1
                 if re.search('^.*:.+', cmd):
-                    return self.do_command(re.sub('.*:', '', cmd), args)
+                    cmd = re.sub('.*:', '', cmd).lower()
+                    return self.do_command(cmd, args)
             if self.subjcmdretried < 2 and args:
                 self.subjcmdretried += 1
-                cmd = args.pop(0)
+                cmd = args.pop(0).lower()
                 return self.do_command(cmd, args)
-            if self.lineno <> 0:
-                return BADCMD
-            else:
-                return BADSUBJ
+            return BADSUBJ
         if handler.process(self, args):
             return STOP
         else:
diff --git a/NEWS b/NEWS
index 259d62d8..c2f25ac5 100755
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,10 @@ Here is a history of user visible changes to Mailman.
 
   Bug fixes and other patches
 
+    - Fixed a bug in CommandRunner that could process the second word of a
+      body line as a command word and a case sensitivity in commands in
+      Subject: with an Re: prefix.  (LP: #1426829)
+
     - Fixed a bug in CommandRunner that threw an uncaught KeyError if
       the input to the list-request address contained a command word
       terminated by a period.  (LP: #1426825)