From 845dc52970be426af2a766be4609a8bef2bd1c05 Mon Sep 17 00:00:00 2001 From: Mark Sapiro Date: Sun, 4 Jun 2017 18:52:11 -0700 Subject: Fixed a regression in Cgi/options.py. --- Mailman/Cgi/options.py | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) (limited to 'Mailman') diff --git a/Mailman/Cgi/options.py b/Mailman/Cgi/options.py index faf732da..0bfa510a 100644 --- a/Mailman/Cgi/options.py +++ b/Mailman/Cgi/options.py @@ -110,7 +110,17 @@ def main(): # CSRF check safe_params = ['displang-button', 'language', 'email', 'password', 'login', 'login-unsub', 'login-remind', 'VARHELP', 'UserOptions'] - params = cgidata.keys() + try: + params = cgidata.keys() + except TypeError: + # Someone crafted a POST with a bad Content-Type:. + doc.AddItem(Header(2, _("Error"))) + doc.AddItem(Bold(_('Invalid options to CGI script.'))) + # Send this with a 400 status. + print 'Status: 400 Bad Request' + print doc.Format() + return + if set(params) - set(safe_params): csrf_checked = csrf_check(mlist, cgidata.getvalue('csrf_token')) else: @@ -124,17 +134,7 @@ def main(): # we might have a 'language' key in the cgi data. That was an explicit # preference to view the page in, so we should honor that here. If that's # not available, use the list's default language. - try: - language = cgidata.getvalue('language') - except TypeError: - # Someone crafted a POST with a bad Content-Type:. - doc.AddItem(Header(2, _("Error"))) - doc.AddItem(Bold(_('Invalid options to CGI script.'))) - # Send this with a 400 status. - print 'Status: 400 Bad Request' - print doc.Format() - return - + language = cgidata.getvalue('language') if not Utils.IsLanguage(language): language = mlist.preferred_language i18n.set_language(language) -- cgit v1.2.3