From 0a86542dae3279874f731052f2a8fe9a41596940 Mon Sep 17 00:00:00 2001
From: Mark Sapiro <mark@msapiro.net>
Date: Mon, 23 Jul 2018 07:07:29 -0700
Subject: Truncate long invalid list names in web error messages.

---
 Mailman/Utils.py | 21 ++++++++++++++++-----
 NEWS             |  7 ++++++-
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/Mailman/Utils.py b/Mailman/Utils.py
index 49121e28..7b8015a4 100644
--- a/Mailman/Utils.py
+++ b/Mailman/Utils.py
@@ -280,17 +280,28 @@ CRNLpat = re.compile(r'[^\x21-\x7e]')
 def GetPathPieces(envar='PATH_INFO'):
     path = os.environ.get(envar)
     if path:
+        remote = os.environ.get('HTTP_FORWARDED_FOR',
+                 os.environ.get('HTTP_X_FORWARDED_FOR',
+                 os.environ.get('REMOTE_ADDR',
+                                'unidentified origin')))
         if CRNLpat.search(path):
             path = CRNLpat.split(path)[0]
-            remote = os.environ.get('HTTP_FORWARDED_FOR',
-                     os.environ.get('HTTP_X_FORWARDED_FOR',
-                     os.environ.get('REMOTE_ADDR',
-                                    'unidentified origin')))
             syslog('error',
                 'Warning: Possible malformed path attack domain=%s remote=%s',
                    get_domain(),
                    remote)
-        return [p for p in path.split('/') if p]
+        # Check for listname injections that won't be websafed.
+        pieces = [p for p in path.split('/') if p]
+        # Get the longest listname or 20 if none.
+        if list_names():
+            longest = max([len(x) for x in list_names()])
+        else:
+            longest = 20
+        if len(pieces[0]) > longest:
+            syslog('mischief',
+               'Hostile listname: listname=%s: remote=%s', pieces[0], remote)
+            pieces[0] = pieces[0][:longest] + '...'
+        return pieces
     return None
 
 
diff --git a/NEWS b/NEWS
index 041fc7cc..b22c7a90 100644
--- a/NEWS
+++ b/NEWS
@@ -5,7 +5,12 @@ Copyright (C) 1998-2018 by the Free Software Foundation, Inc.
 
 Here is a history of user visible changes to Mailman.
 
-2.1.28 (xx-xxx-xxxx)
+2.1.28 (23-Jul-2018)
+
+  Security
+ 
+    - A content spoofing vulnerability with invalid list name messages in
+      the web UI has been fixed.  CVE-2018-13796  (LP: #1780874)
 
   New Features
 
-- 
cgit v1.2.3


From 4aae75a4e4f560630060f7b3f5c3cdc226d127a3 Mon Sep 17 00:00:00 2001
From: Mark Sapiro <mark@msapiro.net>
Date: Mon, 23 Jul 2018 07:50:30 -0700
Subject: Bumped branch version to: 2.1.28

---
 Mailman/Version.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Mailman/Version.py b/Mailman/Version.py
index 2d90eee8..9e6d1277 100644
--- a/Mailman/Version.py
+++ b/Mailman/Version.py
@@ -16,7 +16,7 @@
 # USA.
 
 # Mailman version
-VERSION = '2.1.27'
+VERSION = '2.1.28'
 
 # And as a hex number in the manner of PY_VERSION_HEX
 ALPHA = 0xa
@@ -28,7 +28,7 @@ FINAL = 0xf
 
 MAJOR_REV = 2
 MINOR_REV = 1
-MICRO_REV = 27
+MICRO_REV = 28
 REL_LEVEL = FINAL
 # at most 15 beta releases!
 REL_SERIAL = 0
-- 
cgit v1.2.3