diff options
author | msapiro <> | 2005-12-21 02:52:37 +0000 |
---|---|---|
committer | msapiro <> | 2005-12-21 02:52:37 +0000 |
commit | 23be880d00848edd35b2886fdc44e706605547a2 (patch) | |
tree | 1f14e59d09eda01d33e62314d90353edc337aa49 /Mailman | |
parent | 549e6e6b5ae6003b8c28f9ca3397e57bf028691d (diff) | |
download | mailman2-23be880d00848edd35b2886fdc44e706605547a2.tar.gz mailman2-23be880d00848edd35b2886fdc44e706605547a2.tar.xz mailman2-23be880d00848edd35b2886fdc44e706605547a2.zip |
Scan other text/* parts for Approve(d): <password> - bug 1181161.
Diffstat (limited to '')
-rw-r--r-- | Mailman/Handlers/Approve.py | 30 |
1 files changed, 29 insertions, 1 deletions
diff --git a/Mailman/Handlers/Approve.py b/Mailman/Handlers/Approve.py index 483ac21c..53fac181 100644 --- a/Mailman/Handlers/Approve.py +++ b/Mailman/Handlers/Approve.py @@ -22,6 +22,8 @@ denied. Situations that could hold a message for approval or confirmation are not tested by this module. """ +import re + from email.Iterators import typed_subpart_iterator from Mailman import mm_cfg @@ -49,6 +51,7 @@ def process(mlist, msg, msgdata): if passwd is missing: # Find the first text/plain part in the message part = None + stripped = False for part in typed_subpart_iterator(msg, 'text', 'plain'): break # XXX I'm not entirely sure why, but it is possible for the payload of @@ -68,7 +71,32 @@ def process(mlist, msg, msgdata): # Now strip the first line from the payload so the # password doesn't leak. del lines[lineno] - part.set_payload(NL.join(lines[0:])) + part.set_payload(NL.join(lines)) + stripped = True + if stripped: + # MAS: Bug 1181161 - Now try all the text parts in case + # it's multipart/alternative with the approved line in + # HTML or other text part. We make a pattern from the + # approved line and delete it from all text/* parts in + # which we find it. It would be better to just iterate + # forward, but email compatability for pre Python 2.2 + # returns a list, not a true iterator. + # This will process all the multipart/alternative parts + # in the message as well as all other text parts. We + # shouldn't find the pattern outside the mp/a parts, but + # if we do, it is probably best to delete it anyway as it + # does contain the password. + # Make a pattern to delete. We can't just delete a line + # because line of HTML or other fancy text may include + # additional message text. This pattern works with HTML. + # It may not work with rtf or whatever else is possible. + pattern = name + ':(\s| )*' + re.escape(passwd) + for part in typed_subpart_iterator(msg, 'text'): + if part is not None and part.get_payload() is not None: + # Should we decode the payload? + lines = part.get_payload() + if re.search(pattern, lines): + part.set_payload(re.sub(pattern, '', lines)) if passwd is not missing and mlist.Authenticate((mm_cfg.AuthListModerator, mm_cfg.AuthListAdmin), passwd): |