From 23c33ffc04737e21135743bdb7c56921966176a6 Mon Sep 17 00:00:00 2001 From: Mark Sapiro Date: Tue, 4 Dec 2007 11:42:54 -0800 Subject: Forced lower case listnames in a few command line tools --- bin/change_pw | 7 ++++--- bin/inject | 15 ++++++++------- bin/list_admins | 13 +++++++------ bin/list_owners | 7 ++++--- 4 files changed, 23 insertions(+), 19 deletions(-) diff --git a/bin/change_pw b/bin/change_pw index 1305e1a4..965f5e50 100644 --- a/bin/change_pw +++ b/bin/change_pw @@ -1,6 +1,6 @@ #! @PYTHON@ # -# Copyright (C) 2001-2004 by the Free Software Foundation, Inc. +# Copyright (C) 2001-2007 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License @@ -14,7 +14,8 @@ # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, +# USA. """Change a list's password. @@ -133,7 +134,7 @@ def main(): elif opt in ('-d', '--domain'): domains[arg] = 1 elif opt in ('-l', '--listname'): - listnames[arg] = 1 + listnames[arg.lower()] = 1 elif opt in ('-p', '--password'): password = arg elif opt in ('-q', '--quiet'): diff --git a/bin/inject b/bin/inject index cc79f631..432c2922 100644 --- a/bin/inject +++ b/bin/inject @@ -1,20 +1,21 @@ #! @PYTHON@ # -# Copyright (C) 2002 by the Free Software Foundation, Inc. +# Copyright (C) 2002-2007 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. -# +# # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. -# +# # You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, +# USA. """Inject a message from a file into Mailman's incoming queue. @@ -82,13 +83,13 @@ def main(): if not os.path.isdir(qdir): usage(1, _('Bad queue directory: %(qdir)s')) elif opt in ('-l', '--listname'): - listname = arg + listname = arg.lower() if listname is None: usage(1, _('A list name is required')) elif not Utils.list_exists(listname): usage(1, _('No such list: %(listname)s')) - + if len(args) == 0: # Use standard input msgtext = sys.stdin.read() diff --git a/bin/list_admins b/bin/list_admins index c628a42d..b86a5eb8 100644 --- a/bin/list_admins +++ b/bin/list_admins @@ -1,20 +1,21 @@ #! @PYTHON@ # -# Copyright (C) 2001,2002 by the Free Software Foundation, Inc. +# Copyright (C) 2001-2007 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. -# +# # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. -# +# # You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, +# USA. """List all the owners of a mailing list. @@ -71,7 +72,7 @@ def main(): except getopt.error, msg: usage(1, msg) - listnames = args + listnames = [x.lower() for x in args] vhost = None for opt, arg in opts: if opt in ('-h', '--help'): diff --git a/bin/list_owners b/bin/list_owners index 5b050450..4c2d908d 100644 --- a/bin/list_owners +++ b/bin/list_owners @@ -1,6 +1,6 @@ #! @PYTHON@ # -# Copyright (C) 2002 by the Free Software Foundation, Inc. +# Copyright (C) 2002-2007 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License @@ -14,7 +14,8 @@ # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, +# USA. """List the owners of a mailing list, or all mailing lists. @@ -84,7 +85,7 @@ def main(): elif opt in ('-w', '--with-listnames'): withnames = True - listnames = args or Utils.list_names() + listnames = [x.lower() for x in args] or Utils.list_names() bylist = {} for listname in listnames: -- cgit v1.2.3 From 18f080804e368c63de499b32717d57701aaf8880 Mon Sep 17 00:00:00 2001 From: Mark Sapiro Date: Tue, 4 Dec 2007 11:52:18 -0800 Subject: Mailman/Cgi/edithtml.py Mailman/Gui/General.py Mailman/Utils.py - Better detection of potentially evil HTML in GUI. Mailman/Version.py NEWS - Updates for 2.1.10b1 release. Mailman/Gui/General.py messages/mailman.pot - Added admin_member_chunksize to Gui. Two new associated messages. --- Mailman/Cgi/edithtml.py | 17 ++++- Mailman/Gui/General.py | 32 ++++++--- Mailman/Utils.py | 151 ++++++++++++++++++++++++++++++++++++++++++ Mailman/Version.py | 6 +- NEWS | 58 +++++++++++------ messages/mailman.pot | 170 ++++++++++++++++++++++++++---------------------- 6 files changed, 322 insertions(+), 112 deletions(-) diff --git a/Mailman/Cgi/edithtml.py b/Mailman/Cgi/edithtml.py index b5967b34..3aa8ab4e 100644 --- a/Mailman/Cgi/edithtml.py +++ b/Mailman/Cgi/edithtml.py @@ -1,4 +1,4 @@ -# Copyright (C) 1998-2006 by the Free Software Foundation, Inc. +# Copyright (C) 1998-2007 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License @@ -159,7 +159,20 @@ def ChangeHTML(mlist, cgi_info, template_name, doc): doc.AddItem('
') return code = cgi_info['html_code'].value - code = re.sub(r'<([/]?script.*?)>', r'<\1>', code) + if Utils.suspiciousHTML(code): + doc.AddItem(Header(3, + _("""The page you saved contains suspicious HTML that could +potentially expose your users to cross-site scripting attacks. This change +has therefore been rejected. If you still want to make these changes, you +must have shell access to your Mailman server. + """))) + doc.AddItem(_('See ')) + doc.AddItem(Link( +'http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq04.048.htp', + _('FAQ 4.48.'))) + doc.AddItem(Header(3,_("Page Unchanged."))) + doc.AddItem('
') + return langdir = os.path.join(mlist.fullpath(), mlist.preferred_language) # Make sure the directory exists omask = os.umask(0) diff --git a/Mailman/Gui/General.py b/Mailman/Gui/General.py index 6b03fd2c..8271a30e 100644 --- a/Mailman/Gui/General.py +++ b/Mailman/Gui/General.py @@ -1,4 +1,4 @@ -# Copyright (C) 2001-2006 by the Free Software Foundation, Inc. +# Copyright (C) 2001-2007 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License @@ -19,6 +19,8 @@ import re +from types import IntType + from Mailman import mm_cfg from Mailman import Utils from Mailman import Errors @@ -358,6 +360,10 @@ class General(GUIBase): _('''Maximum length in kilobytes (KB) of a message body. Use 0 for no limit.''')), + ('admin_member_chunksize', mm_cfg.Number, 7, 0, + _('''Maximum number of members to show on one page of the + Membership List.''')), + ('host_name', mm_cfg.Host, WIDTH, 0, _('Host name this list prefers for email.'), @@ -436,17 +442,25 @@ class General(GUIBase): # Convert any html entities to Unicode mlist.subject_prefix = Utils.canonstr( val, mlist.preferred_language) + elif property == 'info': + if val <> mlist.info: + if Utils.suspiciousHTML(val): + doc.addError(_("""The info attribute you saved +contains suspicious HTML that could potentially expose your users to cross-site +scripting attacks. This change has therefore been rejected. If you still want +to make these changes, you must have shell access to your Mailman server. +This change can be made with bin/withlist or with bin/config_list by setting +mlist.info. + """)) + else: + mlist.info = val + elif property == 'admin_member_chunksize' and (val < 1 + or not isinstance(val, IntType)): + doc.addError(_("""admin_member_chunksize attribute not + changed! It must be an integer > 0.""")) else: GUIBase._setValue(self, mlist, property, val, doc) - def _escape(self, property, value): - # The 'info' property allows HTML, but let's sanitize it to avoid XSS - # exploits. Everything else should be fully escaped. - if property <> 'info': - return GUIBase._escape(self, property, value) - # Sanitize tags but nothing else. Not the best - # solution, but expedient. - return re.sub(r'(?i)<([/]?script.*?)>', r'<\1>', value) def _postValidate(self, mlist, doc): if not mlist.reply_to_address.strip() and \ diff --git a/Mailman/Utils.py b/Mailman/Utils.py index 2641875c..7b2cf439 100644 --- a/Mailman/Utils.py +++ b/Mailman/Utils.py @@ -876,3 +876,154 @@ def oneline(s, cset): except (LookupError, UnicodeError, ValueError, HeaderParseError): # possibly charset problem. return with undecoded string in one line. return EMPTYSTRING.join(s.splitlines()) + + +# Patterns and functions to flag possible XSS attacks in HTML. +# This list is compiled from information at http://ha.ckers.org/xss.html, +# http://www.quirksmode.org/js/events_compinfo.html, +# http://www.htmlref.com/reference/appa/events1.htm, +# http://lxr.mozilla.org/mozilla/source/content/events/src/nsDOMEvent.cpp#59, +# http://www.w3.org/TR/DOM-Level-2-Events/events.html and +# http://www.xulplanet.com/references/elemref/ref_EventHandlers.html +# Many thanks are due to Moritz Naumann for his assistance with this. +_badwords = [ + '