--- mailman-2.1.5.1/Mailman/Cgi/admindb.py.CVE-2006-3636 2004-04-30 18:50:42.000000000 +0200 +++ mailman-2.1.5.1/Mailman/Cgi/admindb.py 2006-08-23 12:24:06.000000000 +0200 @@ -310,7 +310,7 @@ ' ' + _('Permanently ban from this list') # While the address may be a unicode, it must be ascii paddr = addr.encode('us-ascii', 'replace') - table.AddRow(['%s
%s' % (paddr, fullname), + table.AddRow(['%s
%s' % (paddr, Utils.websafe(fullname)), radio, TextBox('comment-%d' % id, size=40) ]) @@ -354,7 +354,7 @@ mlist.HandleRequest(id, mm_cfg.DISCARD) continue num += 1 - table.AddRow(['%s
%s' % (addr, fullname), + table.AddRow(['%s
%s' % (addr, Utils.websafe(fullname)), RadioButtonArray(id, (_('Defer'), _('Approve'), _('Reject'), --- mailman-2.1.5.1/Mailman/Cgi/create.py.CVE-2006-3636 2004-02-29 18:07:51.000000000 +0100 +++ mailman-2.1.5.1/Mailman/Cgi/create.py 2006-08-23 12:24:06.000000000 +0200 @@ -187,15 +187,24 @@ mlist.Create(listname, owner, pw, langs, emailhost) finally: os.umask(oldmask) - except Errors.EmailAddressError, s: + except Errors.EmailAddressError, e: + if e.args: + s = Utils.websafe(e.args[0]) + else: + s = Utils.websafe(owner) request_creation(doc, cgidata, _('Bad owner email address: %(s)s')) return except Errors.MMListAlreadyExistsError: + # MAS: List already exists so we don't need to websafe it. request_creation(doc, cgidata, _('List already exists: %(listname)s')) return - except Errors.BadListNameError, s: + except Errors.BadListNameError, e: + if e.args: + s = Utils.websafe(e.args[0]) + else: + s = Utils.websafe(listname) request_creation(doc, cgidata, _('Illegal list name: %(s)s')) return @@ -318,15 +327,17 @@ ftable.AddRow([Center(Italic(_('List Identity')))]) ftable.AddCellInfo(ftable.GetCurrentRowIndex(), 0, colspan=2) - safelistname = Utils.websafe(cgidata.getvalue('listname', '')) + listname = cgidata.getvalue('listname', '') + # MAS: Don't websafe twice. TextBox does it. ftable.AddRow([Label(_('Name of list:')), - TextBox('listname', safelistname)]) + TextBox('listname', listname)]) ftable.AddCellInfo(ftable.GetCurrentRowIndex(), 0, bgcolor=GREY) ftable.AddCellInfo(ftable.GetCurrentRowIndex(), 1, bgcolor=GREY) - safeowner = Utils.websafe(cgidata.getvalue('owner', '')) + owner = cgidata.getvalue('owner', '') + # MAS: Don't websafe twice. TextBox does it. ftable.AddRow([Label(_('Initial list owner address:')), - TextBox('owner', safeowner)]) + TextBox('owner', owner)]) ftable.AddCellInfo(ftable.GetCurrentRowIndex(), 0, bgcolor=GREY) ftable.AddCellInfo(ftable.GetCurrentRowIndex(), 1, bgcolor=GREY) --- mailman-2.1.5.1/Mailman/Cgi/options.py.CVE-2006-3636 2004-02-29 17:45:27.000000000 +0100 +++ mailman-2.1.5.1/Mailman/Cgi/options.py 2006-08-23 12:24:06.000000000 +0200 @@ -652,7 +652,7 @@ fullname = Utils.uncanonstr(mlist.getMemberName(user), userlang) if fullname: - presentable_user += ', %s' % fullname + presentable_user += ', %s' % Utils.websafe(fullname) # Do replacements replacements = mlist.GetStandardReplacements(userlang) --- mailman-2.1.5.1/Mailman/Cgi/edithtml.py.CVE-2006-3636 2002-05-22 05:00:18.000000000 +0200 +++ mailman-2.1.5.1/Mailman/Cgi/edithtml.py 2006-08-23 12:24:06.000000000 +0200 @@ -140,7 +140,8 @@ doc.AddItem('

') doc.AddItem('

') form = Form(mlist.GetScriptURL('edithtml') + '/' + template_name) - text = Utils.websafe(Utils.maketext(template_name, raw=1, mlist=mlist)) + text = Utils.maketext(template_name, raw=1, mlist=mlist) + # MAS: Don't websafe twice. TextArea does it. form.AddItem(TextArea('html_code', text, rows=40, cols=75)) form.AddItem('

' + _('When you are done making changes...')) form.AddItem(SubmitButton('submit', _('Submit Changes'))) --- mailman-2.1.5.1/Mailman/Cgi/admin.py.CVE-2006-3636 2003-12-24 18:27:45.000000000 +0100 +++ mailman-2.1.5.1/Mailman/Cgi/admin.py 2006-08-23 12:25:48.000000000 +0200 @@ -1319,6 +1319,7 @@ # we display. Try uploading a file with 10k names -- it takes a while # to render the status page. for entry in entries: + safeentry = Utils.websafe(entry) fullname, address = parseaddr(entry) # Canonicalize the full name fullname = Utils.canonstr(fullname, mlist.preferred_language) @@ -1336,17 +1337,17 @@ send_admin_notif, invitation, whence='admin mass sub') except Errors.MMAlreadyAMember: - subscribe_errors.append((entry, _('Already a member'))) + subscribe_errors.append((safeentry, _('Already a member'))) except Errors.MMBadEmailError: if userdesc.address == '': subscribe_errors.append((_('<blank line>'), _('Bad/Invalid email address'))) else: - subscribe_errors.append((entry, + subscribe_errors.append((safeentry, _('Bad/Invalid email address'))) except Errors.MMHostileAddress: subscribe_errors.append( - (entry, _('Hostile address (illegal characters)'))) + (safeentry, _('Hostile address (illegal characters)'))) else: member = Utils.uncanonstr(formataddr((fullname, address))) subscribe_success.append(Utils.websafe(member)) @@ -1386,9 +1387,9 @@ addr, whence='admin mass unsub', admin_notif=send_unsub_notifications, userack=userack) - unsubscribe_success.append(addr) + unsubscribe_success.append(Utils.websafe(addr)) except Errors.NotAMemberError: - unsubscribe_errors.append(addr) + unsubscribe_errors.append(Utils.websafe(addr)) if unsubscribe_success: doc.AddItem(Header(5, _('Successfully Unsubscribed:'))) doc.AddItem(UnorderedList(*unsubscribe_success)) --- mailman-2.1.5.1/Mailman/Utils.py.CVE-2006-3636 2003-12-26 23:50:04.000000000 +0100 +++ mailman-2.1.5.1/Mailman/Utils.py 2006-08-23 12:24:06.000000000 +0200 @@ -201,7 +201,7 @@ _badchars = re.compile(r'[][()<>|;^,/\200-\377]') def ValidateEmail(s): - """Verify that the an email address isn't grossly evil.""" + """Verify that an email address isn't grossly evil.""" # Pretty minimal, cheesy check. We could do better... if not s or s.count(' ') > 0: raise Errors.MMBadEmailError --- mailman-2.1.5.1/Mailman/htmlformat.py.CVE-2006-3636 2003-09-22 04:58:13.000000000 +0200 +++ mailman-2.1.5.1/Mailman/htmlformat.py 2006-08-23 12:24:06.000000000 +0200 @@ -448,7 +448,11 @@ class TextBox(InputObj): def __init__(self, name, value='', size=mm_cfg.TEXTFIELDWIDTH): - InputObj.__init__(self, name, "TEXT", value, checked=0, size=size) + if isinstance(value, str): + safevalue = Utils.websafe(value) + else: + safevalue = value + InputObj.__init__(self, name, "TEXT", safevalue, checked=0, size=size) class Hidden(InputObj): def __init__(self, name, value=''): @@ -457,8 +461,12 @@ class TextArea: def __init__(self, name, text='', rows=None, cols=None, wrap='soft', readonly=0): + if isinstance(text, str): + safetext = Utils.websafe(text) + else: + safetext = text self.name = name - self.text = text + self.text = safetext self.rows = rows self.cols = cols self.wrap = wrap --- mailman-2.1.5.1/Mailman/Gui/General.py.CVE-2006-3636 2004-02-17 20:27:46.000000000 +0100 +++ mailman-2.1.5.1/Mailman/Gui/General.py 2006-08-23 12:24:06.000000000 +0200 @@ -433,13 +433,13 @@ GUIBase._setValue(self, mlist, property, val, doc) def _escape(self, property, value): - # The 'info' property allows HTML, but lets sanitize it to avoid XSS + # The 'info' property allows HTML, but let's sanitize it to avoid XSS # exploits. Everything else should be fully escaped. if property <> 'info': return GUIBase._escape(self, property, value) # Sanitize tags but nothing else. Not the best # solution, but expedient. - return re.sub(r'<([/]?script.*?)>', r'<\1>', value) + return re.sub(r'(?i)<([/]?script.*?)>', r'<\1>', value) def _postValidate(self, mlist, doc): if not mlist.reply_to_address.strip() and \ --- mailman-2.1.5.1/Mailman/HTMLFormatter.py.CVE-2006-3636 2003-09-29 17:01:22.000000000 +0200 +++ mailman-2.1.5.1/Mailman/HTMLFormatter.py 2006-08-23 12:24:06.000000000 +0200 @@ -332,8 +332,12 @@ return '' def FormatBox(self, name, size=20, value=''): + if isinstance(value, str): + safevalue = Utils.websafe(value) + else: + safevalue = value return '' % ( - name, size, value) + name, size, safevalue) def FormatSecureBox(self, name): return '' % name