- Bumped version to 2.1.11.

- Changed MailList.Create() to check that list name contains only characters
  that match the new mm_cfg.ACCEPTABLE_LISTNAME_CHARACTERS.

- Changed MTA.Utils.makealiases() to escape a few characters in the list name
  in the pipe command.

1 files changed, 8 insertions, 3 deletions

diff --git a/Mailman/MTA/Utils.py b/Mailman/MTA/Utils.py
index 14562de6..07d8bcad 100644
--- a/Mailman/MTA/Utils.py
+++ b/Mailman/MTA/Utils.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2001,2002 by the Free Software Foundation, Inc.
+# Copyright (C) 2001-2008 by the Free Software Foundation, Inc.
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
@@ -17,6 +17,7 @@
 """Utilities for list creation/deletion hooks."""
 
 import os
+import re
 import pwd
 
 from Mailman import mm_cfg
@@ -45,13 +46,17 @@ def _makealiases_mailprog(listname):
     #    backwards compatibility and may eventually go away (we really have no
     #    need for the -admin address anymore).
     #
+    # We escape a few special characters in the list name in the pipe command
+    # to avoid characters that might split the pipe into two commands.
+    safename = re.sub('([;|&`$])', r'\\\1', listname)
+    #
     # Seed this with the special cases.
-    aliases = [(listname,          '"|%s post %s"' % (wrapper, listname)),
+    aliases = [(listname,          '"|%s post %s"' % (wrapper, safename)),
                ]
     for ext in ('admin', 'bounces', 'confirm', 'join', 'leave', 'owner',
                 'request', 'subscribe', 'unsubscribe'):
         aliases.append(('%s-%s' % (listname, ext),
-                        '"|%s %s %s"' % (wrapper, ext, listname)))
+                        '"|%s %s %s"' % (wrapper, ext, safename)))
     return aliases