aboutsummaryrefslogtreecommitdiffstats
path: root/Mailman/Utils.py (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Defended against a user submitting URLs with query fragments or POSTMark Sapiro2015-09-161-0/+16
| | | data containing multiple occurrences of the same variable.
* Improved identification of remote clients coming via a proxy server.Mark Sapiro2015-06-231-1/+8
|\
| * Support for HTTP_X_FORWARDED_FOR and HTTP_FORWARDED_FOR (RFC 7239) Jim Popovitch2015-06-231-1/+5
|/
* The vette log entry for DMARC policy hits now contains the list name.Mark Sapiro2015-05-011-4/+4
|
* Fix for path traversal vulnerability.Mark Sapiro2015-03-271-0/+6
|
* Implemented the equivalent domains feature for list posting/moderation.Mark Sapiro2015-01-231-0/+34
|
* A number of changes from the unofficial 2.2 branch have been backported toMark Sapiro2015-01-221-1/+57
| | | | | the 2.1 branch for release with 2.1.19. The 2.2 branch is now no different from the 2.1 branch and will no longer be maintained.
* The options CGI now rejects all but HTTP GET and POST requests.Mark Sapiro2014-09-211-0/+5
|
* If checking DNS for dmarc_moderation_action and DNS lookup is notMark Sapiro2014-05-291-1/+5
| | | | available, log it. (LP: #1324541)
* Make dmarc_quarantine_moderaction_action a list setting.Mark Sapiro2014-05-021-3/+2
|
* More fine tuning of dmarc_moderation_action.Mark Sapiro2014-05-021-8/+8
|
* The new Utils.IsDMARCProhibited() used collections.defaultdict whichMark Sapiro2014-04-191-3/+2
| | | requires Python 2.5. Changed to use a dict and setdefault.
* Added and modified various options regarding DMARC. See the NEWS file.Mark Sapiro2014-04-151-1/+96
|\
| * Added suuport for p=quarantine based on feedback from Franck Martin.Jim Popovitch2013-11-081-0/+5
| |
| * Incorporated some feedback from Mark S.Jim Popovitch2013-10-201-1/+1
| |
| * Handle CNAMEs when chasing DMARC TXT records.Phil Pennock2013-03-181-5/+44
| | | | | | | | | | | | | | | | Handle TXT records missing tags, check all such records, etc. Use \b boundary anchors in regexp check. (Should only be one, but if there are multiple, check them all, reject if any of them say p=reject).
| * Hold/Reject/Discard moderation support for Senders with a DMARC p=reject policyJim Popovitch2013-03-031-0/+39
| |
* | Fixed email address validation to do a bit better in obscure cases.Mark Sapiro2013-12-061-3/+4
|/
* Strengthened the validation of email addresses.Mark Sapiro2011-11-131-8/+3
|
* Strengthened the validation of email address domains.Mark Sapiro2011-09-151-0/+6
|
* Made the web escaping of additional characters a configuration setting.Mark Sapiro2011-05-011-12/+6
|
* Yet another change to the broken browser HTML escaping.Mark Sapiro2011-04-261-1/+2
|
* Don't try converting non-ascii to HTML entities in unicode.Mark Sapiro2011-04-261-2/+5
|
* Strengthened escaping of user web data by including some characters thatMark Sapiro2011-04-251-0/+8
| | | | some older browsers misinterpret as < or >.
* Changed the maximum number of arguments for the who command to beMark Sapiro2011-03-211-2/+2
| | | | | considered administrivia from 2 to 1 to help avoid false positives. Bug #739524.
* Two potential XSS vulnerabilities have been identified and fixed.Mark Sapiro2010-09-091-93/+94
|
* XSS protection in the web interface went too far in escaping HTMLMark Sapiro2009-08-011-1/+3
| | | | entities. Fixed.
* Backported several bug fixes from the 2.2 branch.Mark Sapiro2009-07-311-20/+21
|
* Mailman/Utils.pyMark Sapiro2009-01-021-2/+2
| | | | | | | | | | - Fixed a long standing error that stopped relative hrefs from being generated for links on Mailman's web pages. Mailman/Cgi/admindb.py - Changed the admindb interface so that when messages are rejected from the summary page, the reject reason is the rejection message from the Errors.HoldMessage subclass instead of the generic "No reason given".
* Changed the regexp for Utils.suspiciousHTML to exempt theMark Sapiro2008-12-051-1/+2
| | | | | <link rel="SHORTCUT ICON" href="<mm-favicon>"> tag in the options.html template.
* Apply Heiko Rommel's patch for hashlib deprecation warnings for bug 293178.Barry Warsaw2008-11-121-3/+14
| | | | I've modified the patch to improve some of the stylistic issues.
* Changed Utils.ValidateEmail to not allow specials (particularly ':')Mark Sapiro2008-05-071-2/+9
| | | | | in unquoted local parts (SF bug # 1956393).
* Mailman/Cgi/edithtml.pyMark Sapiro2007-12-041-0/+151
| | | | | | | | | | | | Mailman/Gui/General.py Mailman/Utils.py - Better detection of potentially evil HTML in GUI. Mailman/Version.py NEWS - Updates for 2.1.10b1 release. Mailman/Gui/General.py messages/mailman.pot - Added admin_member_chunksize to Gui. Two new associated messages.
* Mailman/Defaults.py.inMark Sapiro2007-11-251-0/+3
| | | | | | | | | | | Mailman/Utils.py Mailman/htmlformat.py Mailman/Cgi/create.py messages/ja/doc/Defaults.py.in - Added direction ('ltr', 'rtl') to the LC_DESCRIPTIONS table to support the Hebrew translation. messages/he/LC_MESSAGES/mailman.po - Corrected a typo '\b' -> '\n'. messages/zh_CN/LC_MESSAGES/mailman.po - Corrected a typo '\\b' -> '/b'.
* Detect 'who' with 1 or 2 arguments as administrivia.Mark Sapiro2007-07-171-2/+2
|
* CVE-2006-3636. Fixes for various cross-site scripting issues. Discovery bybwarsaw2006-08-301-1/+1
| | | | | Moritz Naumann and most of the repair work done by Mark Sapiro (with some additional work by Barry).
* Back port Python 2.5 compatibility changes to Mailman 2.1. Specifically,bwarsaw2006-07-301-3/+5
| | | | | | | | | | | | | | | | | | - In SecurityManager.py, fix the parsecookie() code to work with Python 2.5 generated cookie text. The latter was changed to be more RFC compliant so it does not output trailing semicolons for each line of cookie text. This broke the splitting rules, so now first split on newlines, then on ';\s*'. This should work across all Python versions. - In Python 2.5, exceptions are new-style, and thus are no longer of ClassType. The instantiation type test in hold_for_approval() was too naive. This one is fixed differently here than in the MM trunk because in Python 2.1, 'type' isn't a type, it's a function and so can't be used as the second argument to isinstance() directly. - Raising strings generates deprecation warnings in Python 2.5. Switch the one weird use of this in Utils.py to use a class exception. Don't call it "quick exit" though because it's probably not.
* - Decorate.py Fixed bug 1507248 by ignoring header/footer charactersmsapiro2006-06-231-2/+8
| | | | | | | | outside the character set of the list's language. - Utils.py Fixed a security hole which allowed a crafted URI to inject bogus apparent messages into the error log, possibly inducing an admin to visit a phishing site.
* Improved fix for bug 1275856 to return host part of DEFAULT_URL if any frommsapiro2006-03-181-7/+5
| | | | get_domain() if VIRTUAL_HOST_OVERVIEW off.
* Fixed long standing bug (1275856) - get_domain() returned DEFAULT_EMAIL_HOSTmsapiro2006-03-121-3/+8
| | | | instead of DEFAULT_URL_HOST is VIRTUAL_HOST_OVERVIEW was off.
* FSF office has moved to 51 Franklin Street.tkikuchi2005-08-271-1/+1
|
* New names added to ACKNOWLEDGMENTS. Updated NEWS in preparation for 2.1.6b1.bwarsaw2005-01-161-1/+1
| | | | Update copyright years for files changes in 2005. Whitespace normalization.
* Sorry, leagality of '%' and '!' is a matter of MTA (of the user's).tkikuchi2005-01-111-1/+1
| | | | Canceling last check in.
* Add '%' and '!' in _badchars. They are used for source routing.tkikuchi2005-01-111-1/+1
|
* Secure_MakeRandomPassword(): Log an error when secure passwords were requestedbwarsaw2004-12-311-0/+3
| | | | but urandom is not available.
* From the NEWS file:bwarsaw2004-12-301-6/+45
| | | | | | | | | | - Added the ability for Mailman generated passwords (both member and list admin) to be more cryptographically secure. See new configuration variables USER_FRIENDLY_PASSWORDS, MEMBER_PASSWORD_LENGTH, and ADMIN_PASSWORD_LENGTH. Also added a new bin/withlist script called reset_pw which can be used to reset all member passwords. Passwords generated by Mailman are now 8 characters by default for members, and 10 characters for list administrators.
* [ 1030228 ] Mass Subscribe address with control character - can't deletetkikuchi2004-10-091-1/+1
| | | | Also, '/' can be used now.
* More error handling for oneline().tkikuchi2004-09-181-1/+2
|
* oneline(): Another part of TK's patch # 865661. This one adds abwarsaw2003-12-261-0/+15
| | | | | utility function that returns a header in an i18n-safe way such that it is guaranteed to span exactly one line.
* True/False where appropriate.bwarsaw2003-12-011-1/+1
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-25 09:12:50 +0000