From 6e4fc774d26cf26859618aa0ee251001e557bd4c Mon Sep 17 00:00:00 2001
From: Mark Sapiro <mark@msapiro.net>
Date: Thu, 2 Jul 2020 17:48:27 -0700
Subject: Added CVE and bug references to old NEWS item.

---
 NEWS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index 85bb2288..24bd861b 100644
--- a/NEWS
+++ b/NEWS
@@ -115,7 +115,7 @@ Here is a history of user visible changes to Mailman.
       confirmations of the same token.  (LP: #1785854)
 
     - Scrubbed application/octet-stream MIME parts will now be given a
-      .bin extension instead of .obj.
+      .bin extension instead of .obj.  CVE-2020-12137  (LP: #1886117)
 
     - Added bounce recognition for a non-compliant opensmtpd DSN with
       Action: error.  (LP: #1805137)
-- 
cgit v1.2.3


From cecc0ea4d8d4b813bcf8b04eb2c45b6143de3a7c Mon Sep 17 00:00:00 2001
From: Mark Sapiro <mark@msapiro.net>
Date: Sun, 13 Sep 2020 07:21:30 -0700
Subject: Update configure to indicate dnspython<2.0 is required.

---
 configure    | 7 ++++---
 configure.in | 7 ++++---
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/configure b/configure
index 6749b007..59702c2f 100755
--- a/configure
+++ b/configure
@@ -2277,10 +2277,11 @@ if test "$havednspython" = "no"
 then
     as_fn_error $? "
 
-***** dnspython not found. It is required for the new
-***** dmarc_moderation_action featurer. Get it from
+***** dnspython <2.0 not found. It is required for the new
+***** dmarc_moderation_action feature. Get it from
 ***** <http://www.dnspython.org/> or
-***** <https://pypi.python.org/pypi/dnspython/>" "$LINENO" 5
+***** <https://pypi.python.org/pypi/dnspython/>
+***** You must get a version < 2.0" "$LINENO" 5
 fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $havednspython" >&5
 $as_echo "$havednspython" >&6; }
diff --git a/configure.in b/configure.in
index e4956674..576b89b3 100644
--- a/configure.in
+++ b/configure.in
@@ -107,10 +107,11 @@ if test "$havednspython" = "no"
 then
     AC_MSG_ERROR([
  
-***** dnspython not found. It is required for the new
-***** dmarc_moderation_action featurer. Get it from
+***** dnspython <2.0 not found. It is required for the new
+***** dmarc_moderation_action feature. Get it from
 ***** <http://www.dnspython.org/> or
-***** <https://pypi.python.org/pypi/dnspython/>])
+***** <https://pypi.python.org/pypi/dnspython/>
+***** You must get a version < 2.0])
 fi
 AC_MSG_RESULT($havednspython)
  
-- 
cgit v1.2.3


From 9dd4dc9131506dff9dd8744b254b69f15d1a729c Mon Sep 17 00:00:00 2001
From: Mark Sapiro <mark@msapiro.net>
Date: Thu, 22 Oct 2020 12:15:52 -0700
Subject: Added onhashchange to the HTML _badwords list.

---
 Mailman/Utils.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Mailman/Utils.py b/Mailman/Utils.py
index 6e39c532..2615229b 100644
--- a/Mailman/Utils.py
+++ b/Mailman/Utils.py
@@ -1096,6 +1096,7 @@ _badwords = [
     r'\bonfilterchange\b',
     r'\bonfinish\b',
     r'\bonfocus(?:in|out)?\b',
+    r'\bonhashchange\b',
     r'\bonhelp\b',
     r'\boninput\b',
     r'\bonkey(?:up|down|press)\b',
-- 
cgit v1.2.3