From 6efea059931995de8713f35bccc1116905175cf2 Mon Sep 17 00:00:00 2001 From: Mark Sapiro Date: Thu, 14 Jul 2016 14:27:49 -0700 Subject: Catch TypeError from certain defective crafted POST requests. --- Mailman/Cgi/subscribe.py | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) (limited to 'Mailman/Cgi/subscribe.py') diff --git a/Mailman/Cgi/subscribe.py b/Mailman/Cgi/subscribe.py index ab5c7cd8..36d25fa2 100755 --- a/Mailman/Cgi/subscribe.py +++ b/Mailman/Cgi/subscribe.py @@ -1,4 +1,4 @@ -# Copyright (C) 1998-2015 by the Free Software Foundation, Inc. +# Copyright (C) 1998-2016 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License @@ -70,7 +70,16 @@ def main(): # See if the form data has a preferred language set, in which case, use it # for the results. If not, use the list's preferred language. cgidata = cgi.FieldStorage() - language = cgidata.getvalue('language') + try: + language = cgidata.getvalue('language', '') + except TypeError: + # Someone crafted a POST with a bad Content-Type:. + doc.AddItem(Header(2, _("Error"))) + doc.AddItem(Bold(_('Invalid options to CGI script.'))) + # Send this with a 400 status. + print 'Status: 400 Bad Request' + print doc.Format() + return if not Utils.IsLanguage(language): language = mlist.preferred_language i18n.set_language(language) -- cgit v1.2.3