diff options
| -rw-r--r-- | Mailman/Cgi/listinfo.py | 16 | ||||
| -rwxr-xr-x[-rw-r--r--] | Mailman/Cgi/subscribe.py | 20 | ||||
| -rwxr-xr-x | Mailman/Defaults.py.in | 15 | ||||
| -rw-r--r-- | NEWS | 8 |
4 files changed, 57 insertions, 2 deletions
diff --git a/Mailman/Cgi/listinfo.py b/Mailman/Cgi/listinfo.py index 8aaae14c..5fbaaaf3 100644 --- a/Mailman/Cgi/listinfo.py +++ b/Mailman/Cgi/listinfo.py @@ -1,4 +1,4 @@ -# Copyright (C) 1998-2010 by the Free Software Foundation, Inc. +# Copyright (C) 1998-2012 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License @@ -22,6 +22,7 @@ import os import cgi +import time from Mailman import mm_cfg from Mailman import Utils @@ -184,6 +185,19 @@ def list_listinfo(mlist, lang): replacements['<mm-confirm-password>'] = mlist.FormatSecureBox('pw-conf') replacements['<mm-subscribe-form-start>'] = mlist.FormatFormStart( 'subscribe') + if mm_cfg.SUBSCRIBE_FORM_SECRET: + now = str(int(time.time())) + replacements['<mm-subscribe-form-start>'] += ( + '<input type="hidden" name="sub_form_token" value="%s:%s">\n' + % (now, Utils.sha_new(mm_cfg.SUBSCRIBE_FORM_SECRET + + now + + mlist.internal_name() + + os.environ.get('REMOTE_HOST', + os.environ.get('REMOTE_ADDR', + 'w.x.y.z')) + ).hexdigest() + ) + ) # Roster form substitutions replacements['<mm-roster-form-start>'] = mlist.FormatFormStart('roster') replacements['<mm-roster-option>'] = mlist.FormatRosterOptionForUser(lang) diff --git a/Mailman/Cgi/subscribe.py b/Mailman/Cgi/subscribe.py index 7c49c51c..0fde280a 100644..100755 --- a/Mailman/Cgi/subscribe.py +++ b/Mailman/Cgi/subscribe.py @@ -1,4 +1,4 @@ -# Copyright (C) 1998-2011 by the Free Software Foundation, Inc. +# Copyright (C) 1998-2012 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License @@ -20,6 +20,7 @@ import sys import os import cgi +import time import signal from Mailman import mm_cfg @@ -120,6 +121,23 @@ def process_form(mlist, doc, cgidata, lang): remote = os.environ.get('REMOTE_HOST', os.environ.get('REMOTE_ADDR', 'unidentified origin')) + # Are we checking the hidden data? + if mm_cfg.SUBSCRIBE_FORM_SECRET: + now = int(time.time()) + try: + ftime, fhash = cgidata.getvalue('sub_form_token', '').split(':') + then = int(ftime) + except ValueError: + ftime = fhash = '' + then = now + token = Utils.sha_new(mm_cfg.SUBSCRIBE_FORM_SECRET + + ftime + + mlist.internal_name() + + remote).hexdigest() + if now - then > mm_cfg.FORM_LIFETIME: + results.append(_('The form is too old. Please GET it again.')) + if token != fhash: + results.append(_('You must GET the form before submitting it.')) # Was an attempt made to subscribe the list to itself? if email == mlist.GetListEmail(): syslog('mischief', 'Attempt to self subscribe %s: %s', email, remote) diff --git a/Mailman/Defaults.py.in b/Mailman/Defaults.py.in index a794c65c..2b0aa3ed 100755 --- a/Mailman/Defaults.py.in +++ b/Mailman/Defaults.py.in @@ -111,6 +111,21 @@ AUTHENTICATION_COOKIE_LIFETIME = 0 # Form lifetime is set against Cross Site Request Forgery. FORM_LIFETIME = hours(1) +# If the following is set to a non-empty string, this string in combination +# with the time, list name and the IP address of the requestor is used to +# create a hidden hash as part of the subscribe form on the listinfo page. +# This hash is checked upon form submission and the subscribe fails if it +# doesn't match. I.e. the form posted must be first retrieved from the +# listinfo CGI by the same IP that posts it. The subscribe also fails if +# the time the form was retrieved is more than the above FORM_LIFETIME +# before submission. +# Important: If you have any static subscribe forms on your web site, setting +# this option will break them. With this option set, subscribe forms must be +# dynamically generated to include the hidden data. See the code block +# beginning with "if mm_cfg.SUBSCRIBE_FORM_SECRET:" in Mailman/Cgi/listinfo.py +# for the details of the hidden data. +SUBSCRIBE_FORM_SECRET = None + # Command that is used to convert text/html parts into plain text. This # should output results to standard output. %(filename)s will contain the # name of the temporary file that the program should operate on. @@ -9,6 +9,14 @@ Here is a history of user visible changes to Mailman. New Features + - There is a new mm_cfg.py setting SUBSCRIBE_FORM_SECRET which will put + a dynamically generated, hidden hash in the listinfo subscribe form and + check it upon submission. Setting this will prevent automated processes + (bots) from successfully POSTing web subscribes without first retrieving + and parsing the form from the listinfo page. Note that enabling this + will break ant static subscribe forms on your site. See the description + in Defaults.py for more info. (LP: 1082746) + - add_members now has an option to add members with mail delivery disabled by admin. (LP: 1070574) |