From 851430b1cfbee6d92e4e1c0f110e4e66a1609d55 Mon Sep 17 00:00:00 2001
From: Mark Sapiro <mark@msapiro.net>
Date: Sun, 21 Sep 2014 19:06:41 -0700
Subject: The options CGI now rejects all but HTTP GET and POST requests.

---
 Mailman/Cgi/options.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'Mailman/Cgi')

diff --git a/Mailman/Cgi/options.py b/Mailman/Cgi/options.py
index 853a3922..c1c08659 100644
--- a/Mailman/Cgi/options.py
+++ b/Mailman/Cgi/options.py
@@ -52,6 +52,18 @@ def main():
     doc = Document()
     doc.set_language(mm_cfg.DEFAULT_SERVER_LANGUAGE)
 
+    method = Utils.GetRequestMethod()
+    if method.lower() not in ('get', 'post'):
+        title = _('CGI script error')
+        doc.SetTitle(title)
+        doc.AddItem(Header(2, title))
+        doc.addError(_('Invalid request method: %(method)s'))
+        doc.AddItem('<hr>')
+        doc.AddItem(MailmanLogo())
+        print 'Status: 405 Method Not Allowed'
+        print doc.Format()
+        return
+
     parts = Utils.GetPathPieces()
     lenparts = parts and len(parts)
     if not parts or lenparts < 1:
-- 
cgit v1.2.3