forked from AntonMcClure/mailman2-python3
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathNEWS
4973 lines (3585 loc) · 207 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
-*- coding: iso-8859-1 -*-
Mailman - The GNU Mailing List Management System
Copyright (C) 1998-2020 by the Free Software Foundation, Inc.
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
Here is a history of user visible changes to Mailman.
2.1.39 (13-Dec-2021)
Bug Fixes and other patches
- User matching for CSRF tokens is no longer case sensitive., and a
potential NamerError in logging is fixed. (LP: #1954694)
2.1.38 (30-Nov-2021)
Security
- A potential CSRF attack against a list admin from a list member or
moderator has been blocked. CVE-2021-44227 (LP: #1952384)
Bug Fixes and other patches
- NotAMemberError exception from the user options page when the user has
been asynchronously unsubscribed is fixed. (LP: #1951769)
2.1.37 (12-Nov-2021)
Bug Fixes and other patches
- A bug in the fix for CVE-2021-43332 has neen fixed. (LP: #1950833)
2.1.36 (12-Nov-2021)
Security
- A potential XSS attack via the user options page has been reported by
Harsh Jaiswal. This is fixed. CVE-2021-43331 (LP: #1949401)
- A potential for for a list moderator to carry out an off-line brute force
attack to obtain the list admin password has been reported by Andre
Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed.
CVE-2021-43332 (LP: #1949403)
2.1.35 (19-Oct-2021)
Security
- A potential for for a list member to carry out an off-line brute force
attack to obtain the list admin password has been reported by Andre
Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed.
CVE-2021-42096 (LP: #1947639)
- A CSRF attack via the user options page could allow takeover of a users
account. This is fixed. CVE-2021-42097 (LP: #1947640)
Bug Fixes and other patches
- Fixed an issue where sometimes the wrapper message for DMARC mitigation
Wrap Message has no Subject:. (LP: #1915655)
- Plain text message bodies with Content-Disposition: and no declared
charset are no longer scrubbed. (LP: #1917968)
- CommandRunner now recodes message bodies in the charset of the user's
or list's language to avoid a possible UnicodeError when including the
message body in the reply. (LP: #1921682)
- Delivery disabled by bounce notices to admins now have 'disabled'
properly translated. (LP: #1922843)
- DMARC policy discovery ignores domains with multiple DMARC records per
RFC 7849, (LP: 1931029)
2.1.34 (26-Jun-2020)
i18n
- The Spanish translation has been updated by Omar Walid Llorente.
Bug Fixes and other patches
- The fix for LP: #1859104 can result in ValueError being thrown on
attempts to subscribe to a list. This is fixed and extended to apply
REFUSE_SECOND_PENDING to unsubscription as well. (LP: #1878458)
- DMARC mitigation no longer misses if the domain name returned by DNS
contains upper case. (LP: #1881035)
- A new WARN_MEMBER_OF_SUBSCRIBE setting can be set to No to prevent
mailbombing of a member of a list with private rosters by repeated
subscribe attempts. (LP: #1883017)
- Very long filenames for scrubbed attachments are now truncated.
(LP: #1884456)
2.1.33 (07-May-2020)
Security
- A content injection vulnerability via the private login page has been
fixed. CVE-2020-15011 (LP: #1877379)
2.1.32 (05-May-2020)
i18n
Fixed a typo in the Spanish translation and updated mailman.pot and
the message catalog for 2.1.31 security fix.
2.1.31 (05-May-2020)
Security
- A content injection vulnerability via the options login page has been
discovered and reported by Vishal Singh. This is fixed. CVE-2020-12108
(LP: #1873722)
i18n
- The Spanish translation has been updated by Omar Walid Llorente.
Bug Fixes and other patches
- Bounce recognition for a non-compliant Yahoo format is added.
- Archiving workaround for non-ascii in string.lowercase in some Python
packages is added.
2.1.30 (13-Apr-2020)
New Features
- Thanks to Jim Popovitch, there is now a dmarc_moderation_addresses
list setting that can be used to apply dmarc_moderation_action to mail
From: addresses listed or matching listed regexps. This can be used
to modify mail to addresses that don't accept external mail From:
themselves.
- There is a new MAX_LISTNAME_LENGTH setting. The fix for LP: #1780874
obtains a list of the names of all the all the lists in the installation
in order to determine the maximum length of a legitimate list name. It
does this on every web access and on sites with a very large number of
lists, this can have performance implications. See the description in
Defaults.py for more information.
- Thanks to Ralf Jung there is now the ability to add text based captchas
(aka textchas) to the listinfo subscribe form. See the documentation
for the new CAPTCHA setting in Defaults.py for how to enable this. Also
note that if you have custom listinfo.html templates, you will have to
add a <mm-captcha-ui> tag to those templates to make this work. This
feature can be used in combination with or instead of the Google
reCAPTCHA feature added in 2.1.26.
- Thanks to Ralf Hildebrandt the web admin Membership Management section
now has a feature to sync the list's membership with a list of email
addresses as with the bin/sync_members command.
- There is a new drop_cc list attribute set from DEFAULT_DROP_CC. This
controls the dropping of addresses from the Cc: header in delivered
messages by the duplicate avoidance process. (LP: #1845751)
- There is a new REFUSE_SECOND_PENDING mm_cfg.py setting that will cause
a second request to subscribe to a list when there is already a pending
confirmation for that user. This can be set to Yes to prevent
mailbombing of a third party by repeatedly posting the subscribe form.
(LP: #1859104)
i18n
- The Japanese translation has been updated by Yasuhito FUTATSUKI.
- The German translation has been updated by Ludwig Reiter.
- The Spanish translation has been updated by Omar Walid Llorente.
- The Brazilian Portugese translation has been updated by Emerson de Mello.
Bug Fixes and other patches
- Fixed the confirm CGI to catch a rare TypeError on simultaneous
confirmations of the same token. (LP: #1785854)
- Scrubbed application/octet-stream MIME parts will now be given a
.bin extension instead of .obj. CVE-2020-12137 (LP: #1886117)
- Added bounce recognition for a non-compliant opensmtpd DSN with
Action: error. (LP: #1805137)
- Corrected and augmented some security log messages. (LP: #1810098)
- Implemented use of QRUNNER_SLEEP_TIME for bin/qrunner --runner=All.
(LP: #1818205)
- Leading/trailing spaces in provided email addresses for login to private
archives and the user options page are now ignored. (LP: #1818872)
- Fixed the spelling of the --no-restart option for mailmanctl.
- Fixed an issue where certain combinations of charset and invalid
characters in a list's description could produce a List-ID header
without angle brackets. (LP: #1831321)
- With the Postfix MTA and virtual domains, mappings for the site list
-bounces and -request addresses in each virtual domain are now added
to data/virtual-mailman (-owner was done in 2.1.24). (LP: #1831777)
- The paths.py module now extends sys.path with the result of
site.getsitepackages() if available. (LP: #1838866)
- A bug causing a UnicodeDecodeError in preparing to send the confirmation
request message to a new subscriber has been fixed. (LP: #1851442)
- The SimpleMatch heuristic bounce recognizer has been improved to not
return most invalid email addresses. (LP: #1859011)
2.1.29 (24-Jul-2018)
Bug Fixes
- Fixed the listinfo and admin overview pages that were broken by
LP: #1780874. (LP: #1783417)
2.1.28 (23-Jul-2018)
Security
- A content spoofing vulnerability with invalid list name messages in
the web UI has been fixed. CVE-2018-13796 (LP: #1780874)
New Features
- It is now possible to edit HTML and text templates via the web admin
UI in a supported language other than the list's preferred_language.
Thanks to Yasuhito FUTATSUKI.
i18n
- The Japanese translation has been updated by Yasuhito FUTATSUKI.
- The German translation has been updated by Ralf Hildebrandt.
- The Esperanto translation has been updated by Rubén Fernández Asensio.
Bug fixes and other patches
- The BLOCK_SPAMHAUS_LISTED_DBL_SUBSCRIBE feature added in 2.1.27 was
not working. This is fixed. (LP: #1779774)
- Escaping of HTML entities for the web UI is now done more selectively.
(LP: #1779445)
2.1.27 (22-Jun-2018)
Security
- Existing protections against malicious listowners injecting evil
scripts into listinfo pages have had a few more checks added.
JVN#00846677/JPCERT#97432283/CVE-2018-0618
- A few more error messages have had their values HTML escaped.
JVN#00846677/JPCERT#97432283/CVE-2018-0618
- The hash generated when SUBSCRIBE_FORM_SECRET is set could have been
the same as one generated at the same time for a different list and
IP address. While this is not thought to be exploitable in any way,
the generation has been changed to avoid this. Thanks to Ralf Jung.
New Features
- An option has been added to bin/add_members to issue invitations
instead of immediately adding members. (LP: #1773064)
- A new BLOCK_SPAMHAUS_LISTED_IP_SUBSCRIBE setting has been added to
enable blocking web subscribes from IPv4 addresses listed in Spamhaus
SBL, CSS or XBL. It will work with IPv6 addresses if Python's
py2-ipaddress module is installed. The module can be installed via pip
if not included in your Python.
- Thanks to Jim Popovitch, Mailman has a new 'security' log and logs
authentication failures to the various web CGI functions. The logged
data include the remote IP and can be used to automate blocking of IPs
with something like fail2ban. Since Mailman 2.1.14, these have returned
an http 401 status and the information should be logged by the web
server, but this new log makes that more convenient. Also, the
'mischief' log entries for 'hostile listname' noe include the remote IP
if available.
- Thanks to Jim Popovitch, admin notices of (un)subscribes now may give
the source of the action. This consists of a %(whence)s replacement
that has been added to the admin(un)subscribeack.txt templates. Thanks
to Yasuhito FUTATSUKI for updating the non-English templates and help
with internationalizing the reasons.
- Thanks to Jim Popovitch, there is a new
BLOCK_SPAMHAUS_LISTED_DBL_SUBSCRIBE setting to enable blocking web
subscribes for addresses in domains listed in the Spamhaus DBL.
i18n
- The Japanese translation has been updated by Yasuhito FUTATSUKI.
- The Russian translation has been updated by Danil Smirnov.
- A partial Esperanto translation has been added. Thanks to
Rubén Fernández Asensio.
- Fixed a '# -*- coding:' line in the Russian message catalog that was
mistakenly translated to Russian. (LP: #1777342)
Bug fixes and other patches
- Some messages from bin/arch were not issued in the charset of the system
locale when DISABLE_COMMAND_LOCALE_CSET is No. Thanks to Yasuhito
FUTATSUKI this is now fixed. (LP: #1768892)
- The message displayed in the browser when accessing a Mailman CGI when
mm_cfg.py can't be imported due to some exception other than ImportError
has been improved. (LP: #1760506)
- The reimplementation of DELIVERY_RETRY_WAIT in 2.1.26 could cause extra
dequeueing and requeueing in the out queue by OutgoingRunner. This is
fixed. (LP: #1762871)
- A Python 2.7 dependency introduced in the ToDigests handler in Mailman
2.1.24 has been removed. (LP: #1755317)
- Bad values in a list's topics will no longer break everything that
might instantiate the list. (LP: #1754516)
- A Python 2.7 dependency introduced with the reCAPTCHA feature in 2.1.26
has been removed. (LP: #1752658)
- The reCAPTCHA feature requires JavaScript. If JavaScript is not enabled,
a message will be displayed on the subscribe form that JavaScript is
required. (LP: #1769374)
- Quoting in the mailman-config command has been changed from double to
single quotes to allow double-quoted parameters. (LP: #1774986)
- Approving a held subscription for a user with a 'different' preferred
language no longer corrupts the results page. (LP: #1777222)
- An issue with garbled descriptions on listinfo and admin overview pages
and the heading of a list's listinfo page due to incompatible character
sets has been fixed thanks to Yasuhito FUTATSUKI.
Miscellaneous
- Added to the contrib directory, a script from Jim Popovitch to generate
Sitemap files for a list's archive.
2.1.26 (04-Feb-2018)
Security
- An XSS vulnerability in the user options CGI could allow a crafted URL
to execute arbitrary javascript in a user's browser. A related issue
could expose information on a user's options page without requiring
login. These are fixed. Thanks to Calum Hutton for the report.
CVE-2018-5950 (LP: #1747209)
New Features
- Thanks to David Siebörger who adapted an existing patch by Andrea
Veri to use Google reCAPTCHA v2 there is now the ability to add
reCAPTCHA to the listinfo subscribe form. There are two new mm_cfg.py
settings for RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY, the values
for which you obtain for your domain(s) from Google at
<https://www.google.com/recaptcha/admin>.
- Thanks to Lindsay Haisley, there is a new bin/mailman-config command
to display various information about this Mailman version and how it
was configured.
i18n
- The Japanese message catalog has been updated for added strings by
Yasuhito FUTATSUKI.
- The German translation of a couple of templates has been updated by
Thomas Hochstein.
- The Japanese translation of Defaults.py.in has been updated by
Yasuhito FUTATSUKI.
Bug fixes and other patches
- Fixed an i18n bug in the reCAPTCHA feature. (LP: #1746189)
- Added a few more environment variables to the list of those passed
to CGIs to support an nginx/uwsgi configuration. (LP #1744739)
- Mailman 2.1.22 introduced a Python 2.7 dependency that could affect
bin/arch processing a message without a valid Date: header. The
dependency has been removed. (LP: #1740543)
- Messages held for header_filter_rules now show the matched regexp in
the hold reason. (LP: #1737371)
- When updating the group and mode of a .db file with Mailman's Postfix
integration, a missing file is ignored. (LP: #1734162)
- The DELIVERY_RETRY_WAIT setting is now effective. (LP: #1729472)
2.1.25 (26-Oct-2017)
New Features
- The admindb held subscriptions listing now includes the date of the
most recent request from the address. (LP: #1697097)
Accessibility
- The admin Membership List now includes text for screen readers which
identifies the function of each checkbox. CSS is added to the page to
visually hide the text but still allow screen readers to read it.
Similar text has been added to some radio buttons on the admindb pages.
i18n
- The Russian translation has been updated by Sergey Matveev.
(LP: #1708016)
Bug fixes and other patches
- Thanks to Jim Popovitch, certain failures in DNS lookups of DMARC policy
will now result in mitigations being applied. (LP: #1722013)
- The default DMARC reject reason now properly replaces %(listowner)s.
(LP: #1718962)
- The web roster page now shows case preserved email addresses.
(LP: #1707447)
- Changed the SETGID wrappers to only pass those items in the environment
that are needed by the called scripts. (LP: #1705736)
- Fixed MTA/Postfix.py to ensure that created aliases(.db) and
virtual-mailman(.db) files are readable by Postfix and the .db files are
owned by the Mailman user. (LP: #1696066)
- Defended against certain web attacks that cause exceptions and "we hit
a bug" responses when POST data or query fragments contain multiple
values for the same parameter. (LP: #1695667)
- The fix for LP: #1614841 caused a regression in the options CGI. This
has been fixed. (LP: #1602608)
- Added a -a option to the (e)grep commands in contrib/mmdsr to account
for logs that may have non-ascii and be seen as binary.
- Fixed the -V option to bin/list_lists to not show lists whose host is a
subdomain of the given domain. (LP: #1695610)
2.1.24 (02-Jun-2017)
Security
- A most likely unexploitable XSS attach that relies on the Mailman web
server passing a crafted Host: header to the CGI environment has been
fixed. Apache for one is not vulnerable. Thanks to Alqnas Eslam.
New Features
- There is a new RCPT_BASE64_HEADER_NAME setting. If this is set to a
non-empty string, that string is the name of a header that will be added
to personalized and VERPed deliveries with value equal to the base64
encoding of the recipient's email address. This is intended to enable
identification of the recipient otherwise redacted from "spam report"
feedback loop messages.
- cron/senddigests has a new -e/--exceptlist option to send pending
digests for all but a named list. (LP: #1619770)
- The values for DEFAULT_DIGEST_FOOTER and DEFAULT_MSG_FOOTER have been
changed to use a standard signature separator for DEFAULT_MSG_FOOTER
and to remove the unneded line of underscores from DEFAULT_DIGEST_FOOTER.
(LP: #266269)
i18n
- The Polish html templates have been recoded to use html entities
instead of non-ascii characters.
- The Basque (Euskara) translation has been updated by Gari Araolaza.
- The German "details for personalize" page has been updated by
Christian F Buser.
- The Japanese translation has been updated by Yasuhito FUTATSUKI.
Bug fixes and other patches
- The list-owner@virtual.domain addresses are now added to virtual-mailman
as they are exposed in 'list created' emails. (LP: #1694384)
- The 'list run by' addresses in web page footers are now just the
list-owner address. (LP: #1694384)
- Changed member_verbosity_threshold from a >= test to a strictly > test
to avoid the issue of moderating every post when the threshold = 1.
(LP: #1693366)
- Subject prefixing has been improved to always have a space between
the prefix and the subject even with non-ascii in the prefix. This
will sometimes result in two spaces when the prefix is non-ascii but
the subject is ascii, but this is the lesser evil. (LP: #1525954)
- Treat message and digest headers and footers as empty if they contain
only whitespace. (LP: #1673307)
- Ensured that added message and digest headers and footers always have
a terminating new-line. (LP: #1670033)
- Fixed an uncaught TypeError in the subscribe CGI. (LP: #1667215)
- Added recognition for a newly seen mailEnable bounce.
- Fixed an uncaught NotAMemberError when a member is removed before a
probe bounce for the member is returned. (LP: #1664729)
- Fixed a TypeError thrown in the roster CGI when called with a listname
containing a % character. (LP: #1661810)
- Fixed a NameError issue in bin/add_members with
DISABLE_COMMAND_LOCALE_CSET = yes. (LP: #1647450)
- The CleanseDKIM handler has been removed from OWNER_PIPELINE. It isn't
needed there and has adverse DMARC implications for messages to -owner
of an anonymous list. (LP: #1645901)
- Fixed an issue with properly RFC 2047 encoding the display name in the
From: header for messages with DMARC mitigations. (LP: #1643210)
- Fixed an issue causing UnicodeError in sending digests following a
change of a list's preferred_language. (LP: #1644356)
- Enhanced the fix for race conditions in MailList().Load(). (LP: #266464)
- Fixed a typo in Utils.py that could have resulted in a NameError in
logging an unlikely occurrence. (LP: #1637745)
- Fixed a bug which created incorrect "view more members" links at the
bottom of the admin Membership List pages. (LP: #1637061)
- The 2.1.23 fix for LP: #1604544 only fixed the letter links at the top
of the Membership List. The links at the bottom have now been fixed.
- paths.py now adds dist-packages as well as site-packages to sys.path.
(LP: #1621172)
- INIT INFO has been added to the sample init.d script. (LP: #1620121)
2.1.23 (27-Aug-2016)
Security
- CSRF protection has been extended to the user options page. This was
actually fixed by Tokio Kikuchi as part of the fix for LP: #775294 and
intended for Mailman 2.1.15, but that fix wasn't completely merged at the
time. The full fix also addresses the admindb, and edithtml pages as
well as the user options page and the previously fixed admin pages.
Thanks to Nishant Agarwala for reporting the issue. CVE-2016-6893
(LP: #1614841)
New Features
- For header_filter_rules matching, RFC 2047 encoded headers, non-encoded
headers and header_filter_rules patterns are now all decoded to unicode.
Both XML character references of the form &#nnnn; and unicode escapes
of the form \Uxxxx in patterns are converted to unicodes as well. Both
headers and patterns are normalized to 'NFKC' normal form before
matching, but the normalization form can be set via a new NORMALIZE_FORM
mm_cfg setting. Also, the web UI has been updated to encode characters
in text fields that are invalid in the character set of the page's
language as XML character references instead of '?'. This should help
with entering header_filter_rules patterns to match 'odd' characters.
This feature is experimental and is problematic for some cases where it
is desired to have a header_filter_rules pattern with characters not in
the character set of the list's preferred language. For patterns
without such characters, the only change in behavior should be because
of unicode normalization which should improve matching. For other
situations such as trying to match a Subject: with CJK characters (range
U+4E00..U+9FFF) on an English language (ascii) list, one can enter a
pattern like '^subject:.*[一-鿿]' or
'^subject:.*[\u4e00;-\u9fff;]' to match a Subject with any character in
the range, and it will work, but depending on the actual characters and
the browser, submitting another, even unrelated change can garble the
original entry although this usually occurs only with ascii pages and
characters in the range \u0080-\u00ff. The \Uxxxx unicode escapes must
have exactly 4 hex digits, but they are case insensitive. (LP: #558155)
- Thanks to Jim Popovitch REMOVE_DKIM_HEADERS can now be set to 3 to
preserve the original headers as X-Mailman-Original-... before removing
them.
- Several additional templates have been added to those that can be edited
via the web admin GUI. (LP: #1583387)
- SMTPDirect.py can now do SASL authentication and STARTTLS security when
connecting to the outgoiung MTA. Associated with this are new
Defaults.py/mm_cfg.py settings SMTP_AUTH, SMTP_USER, SMTP_PASSWD and
SMTP_USE_TLS. (LP: #558281)
- There is a new Defaults.py/mm_cfg.py setting SMTPLIB_DEBUG_LEVEL which
can be set to 1 to enable verbose smtplib debugging to Mailman's error
log to help with debugging 'low level smtp failures'. (LP: #1573074)
- A list's nonmember_rejection_notice attribute will now be the default
rejection reason for a held non-member post in addition to it's prior
role as the reson for an automatically rejected non-member post.
(LP: #1572330)
i18n
- The French translation of 'Dutch' is changed from 'Hollandais' to
'Néerlandais' per Francis Jorissen.
- Some German language templates that were incorrectly utf-8 encoded have
been recoded as iso-8859-1. (LP: #1602779)
- Japanese translation and documentation in messages/ja has been updated by
Yasuhito FUTATSUKI.
Bug fixes and other patches
- The admin Membership List letter links could be incorrectly rendered as
Unicode strings following a search. (LP: #1604544)
- We no longer throw an uncaught TypeError with certain defective crafted
POST requests to Mailman's CGIs. (LP: #1602608)
- Scrubber links in archives are now in the list's preferred_language
rather than the poster's language. (LP: #1586505)
- Improved logging of banned subscription and address change attempts.
(LP: #1582856)
- In rare circumstances a list can be removed while the admin or listinfo
CGI or bin/list_lists is running causing an uncaught MMUnknownListError
to be thrown. The exception is now caught and handled. (LP: #1582532)
- Set the Date: header in the wrapper message when from_is_list or
dmarc_moderation_action is Wrap Message. (LP: #1581215)
- A site can now set DMARC_ORGANIZATIONAL_DOMAIN_DATA_URL to None or the
null string if it wants to avoid using this. (LP: #1578450)
- The white space to the left of the admindb Logout link is no longer
part of the link. (LP: #1573623)
2.1.22 (17-Apr-2016)
i18n
- Fixed a typo in the German options.html template. (LP: #1562408)
- An error in the Brazilian Portugese translation of Quarterly has been
fixed thanks to Kleber A. Benatti.
- The Brazilian Portugese translation has been updated by Emerson Ribeiro
de Mello.
Bug fixes and other patches
- All addresses in data/virtual-mailman are now properly appended with
VIRTUAL_MAILMAN_LOCAL_DOMAIN and duplicates are not generated if the
site list is in a virtual domain. (LP: #1570630)
- DMARC mitigations will now find the From: domain to the right of the
rightmost '@' rather than the leftmost '@'. (LP: #1568445)
- DMARC mitigations for a sub-domain of an organizational domain will now
use the organizational domain's sp= policy if any. (LP: #1568398)
- Modified NewsRunner.py to ensure that messages gated to Usenet have a
non-blank Subject: header and when munging the Message-ID to add the
original to References: to help with threading. (LP: #557955)
- Fixed the pipermail archiver to do a better job of figuring the date of
a post when its Date: header is missing, unparseable or has an obviously
out of range date. This should only affect bin/arch as ArchRunner has
code to fix dates at least if ARCHIVER_CLOBBER_DATE_POLICY has not been
set to 0 in mm_cfg.py. If posts have been added in the past to a list's
archive using bin/arch and an imported mbox, running bin/arch again could
result is some of those posts being archived with a different date.
(LP: #1555798)
- Fixed an issue with CommandRunner shunting a malformed message with a
null byte in the body. (LP: #1553888)
- Don't collapse multipart with a single sub-part inside multipart/signed
parts. (LP: #1551075)
2.1.21 (28-Feb-2016)
New Features
- There is a new dmarc_none_moderation_action list setting and a
DEFAULT_DMARC_NONE_MODERATION_ACTION mm_cfg.py setting to optionally
apply Munge From or Wrap Message actions to posts From: domains that
publish DMARC p=none. The intent is to eliminate failure reports to
the domain owner for messages that would be munged or wrapped if the
domain published a stronger DMARC policy. See the descriptions in
Defaults.py, the web UI and the bug report for more. (LP: #1539384)
- Thanks to Jim Popovitch there is now a feature to automatically turn
on moderation for a malicious list member who attempts to flood a list
with spam. See the details for the Privacy options ... -> Sender
filters -> member_verbosity_threshold and member_verbosity_interval
settings in the web admin UI and the documentation in Defaults.py for
the DEFAULT_MEMBER_VERBOSITY_* and VERBOSE_CLEAN_LIMIT settings for
information.
- bin/list_members now has options to display all moderated or all
non-moderated members.
- There is now a mm_cfg.py setting GLOBAL_BAN_LIST which is like the
individual list's ban_list but applies globally to all subscribe
requests. See the description in Defaults.py for more details.
i18n
- The Japanese translation has been updated by Yasuhito FUTATSUKI.
- Also thanks to Miloslav Trmac and Yasuhito FUTATSUKI, the l10n for
Mailman's bin/ commands has been fixed to display using the character
set of the user's work station even when Mailman's character set for
the language is different. Because this has not been tested over a
wide set of locales, there is an mm_cfg.py switch
DISABLE_COMMAND_LOCALE_CSET to disable it if it causes problems.
(LP: #558167)
- The Polish translation has been updated by Stefan Plewako.
- The German translation has been updated by Mirian Margiani and
Bernhard Schmidt.
- The Russian translation has been updated by Danil Smirnov.
- Several Galician templates that were improperly encoded as iso-8859-1
have been fixed. (LP: #1532504)
- The Brazilian Portugese translation has been updated by Emerson Ribeiro
de Mello.
Bug fixes and other patches
- If DMARC lookup fails to find a policy, also try the Organizational
Domain. Associated with this is a new mm_cfg.py setting
DMARC_ORGANIZATIONAL_DOMAIN_DATA_URL which sets the URL used to
retrieve the data for the algorithm that computes the Organizational
Domain. See https://publicsuffix.org/list/ for info. (LP: #1549420)
- Modified contrib/mmdsr to correctly report No such list names that
contain ".
- User's "Acknowledge" option will now be honored for posts to anonymous
lists. (LP: #1546679)
- Fixed a typo in the Non-digest options regular_exclude_ignore
description thanks to Yasuhito FUTATSUKI.
- DEFAULT_PASS_MIME_TYPES has been changed to accept text/plain sub-parts
from message/rfc822 parts and multipart parts other than mixed and
alternative and also accept pgp signatures. This only applies to newly
created lists and other than pgp signatures, still only accepts
text/plain. (LP: #1517446)
- Modified contrib/mmdsr to report held and banned subscriptions and DMARC
lookups in their own categories.
- Fixed a bug that could create a garbled From: header with certain DMARC
mitigation actions. (LP: #1536816)
- Treat a poster's address which matches an equivalent_domains address as
a list member for the regular_exclude_ignore check. (LP: #1526550)
- Fixed an issue that sometimes left no white space following
subject_prefix. (LP: #1525954)
- Vette log entries for banned subscriptions now include the source of
the request if available. (LP: #1525733)
- Submitting the user options form for a user who was asynchronously
unsubscribed would throw an uncaught NotAMemberError. (LP: #1523273)
- It was possible under some circumstances for a message to be shunted
after a handler rejected or discarded it, and the handler would be
skipped upon unshunting and the message accepted. (LP: #1519062)
- Posts gated to usenet will no longer have other than the target group
in the Newsgroups: header. (LP: #1512866)
- Invalid regexps in *_these_nonmembers, subscribe_auto_approval and
ban_list are now logged. (LP: #1507241)
- Refactored the GetPattern list method to simplify extending @listname
syntax to new attributes in the future. Changed Moderate.py to use the
GetPattern method to process the *_these_nonmembers lists.
- Changed CookHeaders to default to using space rather than tab as
continuation_ws when folding headers. (LP: #1505878)
- Fixed the 'pidfile' path in the sample init.d script. (LP: #1503422)
- Subject prefixing could fail to collapse multiple 'Re:' in an incomming
message if they all came after the list's subject_prefix. This is now
fixed. (LP: #1496620)
- Defended against a user submitting URLs with query fragments or POST
data containing multiple occurrences of the same variable.
(LP: #1496632)
- Fixed bin/mailmanctl to check its effective rather than real uid.
(LP: #1491187)
- Fixed cron/gate_news to catch EOFError on opening the newsgroup.
(LP: #1486263)
- Fixed a bug where a delayed probe bounce can throw an AttributeError.
(LP: #1482940)
- If a list is not digestable an the user is not currently set to
receive digests, the digest options will not be shown on the user's
options page. (LP: #1476298)
- Improved identification of remote clients for logging and subscribe
form checking in cases where access is via a proxy server. Thanks to
Jim Popovitch. Also updated contrib/mmdsr for log change.
- Fixed an issue with shunted messages on a list where the charset for
the list's preferred_language had been changed from iso-8859-1 to
utf-8 without recoding the list's description. (LP: #1462755)
- Mailman-Postfix integration will now add mailman@domain entries in
data/virtual-mailman for each domain in POSTFIX_STYLE_VIRTUAL_DOMAINS
which is a host_name of a list. This is so the addresses which are
exposed on admin and listinfo overview pages of virtual domains will
be deliverable. (LP: #1459236)
- The vette log entry for DMARC policy hits now contains the list name.
(LP: #1450826)
- If SUBSCRIBE_FORM_SECRET is enabled and a user's network has a load
balancer or similar in use the POSTing IP might not exactly match the
GETting IP. This is now accounted for by not requiring the last
octet (16 bits for ipV6) to match. (LP: #1447445)
- DKIM-Signature:, DomainKey-Signature: and Authentication-Results:
headers are now removed by default from posts to anonymous lists.
(LP: #1444673)
- The list admin web UI Mambership List search function often doesn't
return correct results for search strings (regexps) that contain
non-ascii characters. This is partially fixed. (LP: #1442298)
2.1.20 (31-Mar-2015)
Security
- A path traversal vulnerability has been discovered and fixed. This
vulnerability is only exploitable by a local user on a Mailman server
where the suggested Exim transport, the Postfix postfix_to_mailman.py
transport or some other programmatic MTA delivery not using aliases
is employed. CVE-2015-2775 (LP: #1437145)
New Features
- There is a new Address Change sub-section in the web admin Membership
Management section to allow a list admin to change a list member's
address in one step rather than adding the new address, copying settings
and deleting the old address. (LP: #266809)
i18n
- The Russian translation has been updated by Danil Smirnov.
- The Polish translation has been updated by Stefan Plewako.
Bug fixes and other patches
- A LookupError in SpamDetect on a message with RFC 2047 encoded headers
in an unknown character set is fixed. (LP: #1427389)
- Fixed a bug in CommandRunner that could process the second word of a
body line as a command word and a case sensitivity in commands in
Subject: with an Re: prefix. (LP: #1426829)
- Fixed a bug in CommandRunner that threw an uncaught KeyError if
the input to the list-request address contained a command word
terminated by a period. (LP: #1426825)
2.2 Branch Backports (released in conjunction with 2.1.19)
The following New Features and Bug Fixes have been in an "unofficial,
never to be released" Mailman 2.2 branch for several years. Until now,
they were never implemented on the official 2.1 branch because of their
i18n impacts. Given that there have been a number of i18n impacting
changes due to DMARC mitigations in the last few releases, it has been
decided to backport these as well.
All of these changes have been running in production on several lists
for years without problems other than untranslated strings, so they should
be reasonably "bug free".
New Features
- There is a new list attribute 'subscribe_auto_approval' which is a list
of email addresses and regular expressions matching email addresses
whose subscriptions are exempt from admin approval. (LP: #266609)
- Confirmed member change of address is logged in the 'subscribe' log,
and if admin_notify_mchanges is true, a notice is sent to the list
owner using a new adminaddrchgack.txt template.
- Added an 'automate' option to bin/newlist to send the notice to the
admin without the prompt.
- The processing of Topics regular expressions has changed. Previously the
Topics regexp was compiled in verbose mode but not documented as such
which caused some confusion. Also, the documentation indicated that
topic keywords could be entered one per line, but these entries were not
handled properly. Topics regexps are now compiled in non-verbose mode
and multi-line entries are 'ored'. Existing Topics regexps will be
converted when the list is updated so they will continue to work.
- Added real name display to the web roster. (LP: #266754)
Bug fixes and other patches
- Changed the response to an invalid confirmation to be more generic.
Not all confirmations are subscription requests.
- Changed the default nonmember_rejection_notice to be more user friendly.
(LP: #418728)
- Added "If you are a list member" qualification to some messages from the
options login page. (LP: #266442)
- Changed the 'Approve' wording in the admindbdetails.html template to
'Accept/Approve' for better agreement with the button labels.
- Added '(by thread)' to the previous and next message links in the
archive to emphasize that even if you got to the message from a
subject, date or author index, previous and next are still by thread.
2.1.19 (28-Feb-2015)
New Features
- The subscribe_auto_approval feature backported from the 2.2 branch and
described above has been enhanced to accept entries of the form
@listname to auto approve members of another list. (LP: #1417093)
- There is a new list attribute dmarc_wrapped_message_text and a
DEFAULT_DMARC_WRAPPED_MESSAGE_TEXT setting to set the default for new
lists. This text is added to a message which is wrapped because of
dmarc_moderation_action in a separate text/plain part that precedes the
message/rfc822 part containing the original message. It can be used to
provide an explanation of why the message was wrapped or similar info.
- There is a new list attribute equivalent_domains and a
DEFAULT_EQUIVALENT_DOMAINS setting to set the default for new lists which
in turn defaults to the empty string. This provides a way to specify one
or more groups of domains, e.g., mac.com, me.com, icloud.com, which are
considered equivalent for validating list membership for posting and
moderation purposes.
- There is a new WEB_HEAD_ADD setting to specify text to be added to the
<HEAD> section of Mailman's internally generated web pages. This doesn't
apply to pages built from templates, but in those cases, custom templates
can be created. (LP: #1409396)
- There is a new DEFAULT_SUBSCRIBE_OR_INVITE setting. Set this to Yes
to make the default selection on the admin Mass Subscriptions page
Invite rather than Subscribe. (LP: #1404511)
- There is a new list attribute in the Bounce processing section.
bounce_notify_owner_on_bounce_increment if set to Yes will cause
Mailman to notify the list owner on every bounce that increments a
list member's score but doesn't result in a probe or disable. There
is a new configuration setting setting
DEFAULT_BOUNCE_NOTIFY_OWNER_ON_BOUNCE_INCREMENT to set the default
for new lists. This in turn defaults to No. (LP: #1382150)
Changed behavior
- Mailman's log files, request.pck files and heldmsg-* files are no
longer created world readable to protect against access by untrusted
local users. Note that permissions on existing log files won't be
changed so if you are concerned about this and don't rotate logs or
have a logrotate process that creates new log files instead of letting
Mailman create them, you will need to address that. (LP: #1327404)
Other changes
- The Python Powered logo image has been replaced in the misc/ directory