------------------------------------------------------------ revno: 1829 fixes bug: https://launchpad.net/bugs/1859104 committer: Mark Sapiro <m...@msapiro.net> branch nick: 2.1 timestamp: Thu 2020-01-09 17:00:40 -0800 message: Implement REFUSE_SECOND_PENDING setting to prevent multiple pending subscribes. modified: Mailman/Cgi/subscribe.py Mailman/Commands/cmd_subscribe.py Mailman/Defaults.py.in Mailman/Errors.py Mailman/MailList.py NEWS
-- lp:mailman/2.1 https://code.launchpad.net/~mailman-coders/mailman/2.1 Your team Mailman Checkins is subscribed to branch lp:mailman/2.1. To unsubscribe from this branch go to https://code.launchpad.net/~mailman-coders/mailman/2.1/+edit-subscription
=== modified file 'Mailman/Cgi/subscribe.py' --- Mailman/Cgi/subscribe.py 2019-06-19 23:56:49 +0000 +++ Mailman/Cgi/subscribe.py 2020-01-10 01:00:40 +0000 @@ -291,6 +291,9 @@ Your subscription request was deferred because %(x)s. Your request has been forwarded to the list moderator. You will receive email informing you of the moderator's decision when they get to your request.""") + except Errors.MMAlreadyPending: + # User already has a subscription pending + results = _('You already have a subscription pending confirmation') except Errors.MMAlreadyAMember: # Results string depends on whether we have private rosters or not if not privacy_results: === modified file 'Mailman/Commands/cmd_subscribe.py' --- Mailman/Commands/cmd_subscribe.py 2018-06-17 23:47:34 +0000 +++ Mailman/Commands/cmd_subscribe.py 2020-01-10 01:00:40 +0000 @@ -128,6 +128,10 @@ except Errors.MMAlreadyAMember: res.results.append(_('You are already subscribed!')) return STOP + except Errors.MMAlreadyPending: + res.results.append( + _('You already have a subscription pending confirmation')) + return STOP except Errors.MMCantDigestError: res.results.append( _('No one can subscribe to the digest of this list!')) === modified file 'Mailman/Defaults.py.in' --- Mailman/Defaults.py.in 2019-11-08 21:04:52 +0000 +++ Mailman/Defaults.py.in 2020-01-10 01:00:40 +0000 @@ -1122,6 +1122,14 @@ '^x-ack:', '^x-beenthere:', '^x-list-administrivia:', '^x-spam-', ] +# +# It is possible to mailbomb a third party by repeatrdly posting the subscribe +# form. You can prevent this by setting the following to Yes which will refuse +# pending a subscription confirmation when one is already pending. The down +# side to this is if a subscriber loses or doesn't receive the confirmation +# request email, she has to wait PENDING_REQUEST_LIFE (default 3 days) before +# she can request another. +REFUSE_SECOND_PENDING = No === modified file 'Mailman/Errors.py' --- Mailman/Errors.py 2018-06-17 23:47:34 +0000 +++ Mailman/Errors.py 2020-01-10 01:00:40 +0000 @@ -31,6 +31,7 @@ class MMMemberError(Exception): pass class MMBadUserError(MMMemberError): pass class MMAlreadyAMember(MMMemberError): pass +class MMAlreadyPending(MMMemberError): pass # "New" style membership exceptions (new w/ MM2.1) class MemberError(Exception): pass === modified file 'Mailman/MailList.py' --- Mailman/MailList.py 2019-11-08 21:51:55 +0000 +++ Mailman/MailList.py 2020-01-10 01:00:40 +0000 @@ -833,6 +833,25 @@ # # Membership management front-ends and assertion checks # + def CheckPending(self, email): + """Check if there is already an unexpired pending subscription for + this email. + """ + if not mm_cfg.REFUSE_SECOND_PENDING: + return False + pends = self._Pending__load() + # Save and reload the db to evict expired pendings. + self._Pending__save(pends) + pends = self._Pending__load() + for k, v in pends.items(): + if k in ('evictions', 'version'): + continue + op, data = v + if (op == Pending.SUBSCRIPTION and + data.address.lower() == email.lower()): + return True + return False + def InviteNewMember(self, userdesc, text=''): """Invite a new member to the list. @@ -919,6 +938,8 @@ Utils.ValidateEmail(email) if self.isMember(email): raise Errors.MMAlreadyAMember, email + if self.CheckPending(email): + raise Errors.MMAlreadyPending, email if email.lower() == self.GetListEmail().lower(): # Trying to subscribe the list to itself! raise Errors.MMBadEmailError === modified file 'NEWS' --- NEWS 2019-11-08 21:51:55 +0000 +++ NEWS 2020-01-10 01:00:40 +0000 @@ -38,6 +38,12 @@ controls the dropping of addresses from the Cc: header in delivered messages by the duplicate avoidance process. (LP: #1845751) + - There is a new REFUSE_SECOND_PENDING mm_cfg.py setting that will cause + a second request to subscribe to a list when there is already a pending + confirmation for that user. This can be set to Yes to prevent + mailbombing of a third party by repeatedly posting the subscribe form. + (LP: #1859104) + i18n - The Japanese translation has been updated by Yasuhito FUTATSUKI.
_______________________________________________ Mailman-checkins mailing list Mailman-checkins@python.org Unsubscribe: https://mail.python.org/mailman/options/mailman-checkins/archive%40jab.org