diff options
author | Mark Sapiro <mark@msapiro.net> | 2021-11-21 20:31:11 -0800 |
---|---|---|
committer | Mark Sapiro <mark@msapiro.net> | 2021-11-21 20:31:11 -0800 |
commit | 4fe8740ec232a59edd0fde6087bd7b014b17f5ef (patch) | |
tree | 3d67e68f9c8568fead6a5671cba7c8113b6278e9 /Mailman | |
parent | 021c86bed55dc1424576a894d84b3ec3c65736ba (diff) | |
download | mailman2-4fe8740ec232a59edd0fde6087bd7b014b17f5ef.tar.gz mailman2-4fe8740ec232a59edd0fde6087bd7b014b17f5ef.tar.xz mailman2-4fe8740ec232a59edd0fde6087bd7b014b17f5ef.zip |
Avoid NotAMemberError in CSRF check from user options page.
Diffstat (limited to 'Mailman')
-rw-r--r-- | Mailman/Cgi/options.py | 22 |
1 files changed, 11 insertions, 11 deletions
diff --git a/Mailman/Cgi/options.py b/Mailman/Cgi/options.py index 3db0a172..af6e3add 100644 --- a/Mailman/Cgi/options.py +++ b/Mailman/Cgi/options.py @@ -156,17 +156,6 @@ def main(): else: user = user[-1].strip() - # Avoid cross-site scripting attacks - if set(params) - set(safe_params): - csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'), - Utils.UnobscureEmail(urllib.unquote(user))) - else: - csrf_checked = True - # if password is present, void cookie to force password authentication. - if cgidata.getfirst('password'): - os.environ['HTTP_COOKIE'] = '' - csrf_checked = True - safeuser = Utils.websafe(user) try: Utils.ValidateEmail(user) @@ -183,6 +172,17 @@ def main(): print doc.Format() return + # Avoid cross-site scripting attacks + if set(params) - set(safe_params): + csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'), + Utils.UnobscureEmail(urllib.unquote(user))) + else: + csrf_checked = True + # if password is present, void cookie to force password authentication. + if cgidata.getfirst('password'): + os.environ['HTTP_COOKIE'] = '' + csrf_checked = True + # Find the case preserved email address (the one the user subscribed with) lcuser = user.lower() try: |