Prevent loop in hold/reject if addressed to '-owner'.

1 files changed, 10 insertions, 9 deletions

diff --git a/Mailman/Handlers/SpamDetect.py b/Mailman/Handlers/SpamDetect.py
index a9c9123b..5eeddd5b 100644
--- a/Mailman/Handlers/SpamDetect.py
+++ b/Mailman/Handlers/SpamDetect.py
@@ -102,15 +102,6 @@ def process(mlist, msg, msgdata):
             if mo:
                 # we've detected spam, so throw the message away
                 raise SpamDetected
-    # Before we go to header_filter_rules, we exclude internally generated
-    # owner notification from checking, because 1) we collect headers from
-    # all the attachments but this will cause matching the filter rule again,
-    # and 2) list owners may want to check header name / value pair like
-    # 'Precedence: bulk' which is also generated by mailman.  Both will
-    # cause loop of holding owner notification messages if the action is
-    # set to 'hold'.
-    if msgdata.get('toowner') and msg.get('x-list-administrivia') == 'yes':
-        return
     # Now do header_filter_rules
     # TK: Collect headers in sub-parts because attachment filename
     # extension may be a clue to possible virus/spam.
@@ -132,9 +123,19 @@ def process(mlist, msg, msgdata):
                 if action == mm_cfg.DISCARD:
                     raise Errors.DiscardMessage
                 if action == mm_cfg.REJECT:
+                    if msgdata.get('toowner'):
+                        # Don't send rejection notice if addressed to '-owner'
+                        # because it may trigger a loop of notices if the
+                        # sender address is forged.  We just discard it here.
+                        raise Errors.DiscardMessage
                     raise Errors.RejectMessage(
                         _('Message rejected by filter rule match'))
                 if action == mm_cfg.HOLD:
+                    if msgdata.get('toowner'):
+                        # Don't hold '-owner' addressed message.  We just
+                        # pass it here but list-owner can set this to be
+                        # discarded on the GUI if he wants.
+                        return
                     hold_for_approval(mlist, msg, msgdata, HeaderMatchHold)
                 if action == mm_cfg.ACCEPT:
                     return