diff --git a/mail/mailman/Makefile b/mail/mailman/Makefile index 65c8df3f485a..ecf88cdd7569 100644 --- a/mail/mailman/Makefile +++ b/mail/mailman/Makefile @@ -1,241 +1,241 @@ PORTNAME= mailman DISTVERSION= 2.1.39 -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= mail MASTER_SITES= GNU \ SF/${PORTNAME}/Mailman%202.1%20%28stable%29/${PORTVERSION} \ https://launchpad.net/mailman/${DISTVERSION:R}/${DISTVERSION}/+download/ DIST_SUBDIR= mailman PATCH_SITES= LOCAL/mandree PATCH_DIST_STRIP= -p1 MAINTAINER= mandree@FreeBSD.org COMMENT= Mailing list manager with user-friendly web front-end WWW= https://www.list.org/ LICENSE= GPLv2 LICENSE_FILE= ${WRKSRC}/gnu-COPYING-GPL -USES= autoreconf cpe fakeroot python:2.7 shebangfix tar:tgz +USES= cpe fakeroot python:2.7 shebangfix tar:tgz CPE_VENDOR= gnu USE_RC_SUBR= mailman SHEBANG_FILES= bin/msgfmt.py \ tests/fblast.py \ tests/onebounce.py GNU_CONFIGURE= yes GNU_CONFIGURE_PREFIX= ${MAILMANDIR} CONFIGURE_ARGS+=--with-python=${PYTHON_CMD} \ --with-username=${MM_USERNAME} \ --with-groupname=${MM_GROUPNAME} \ --with-mail-gid=${MAIL_GID} --with-cgi-gid=${CGI_GID} \ --with-permcheck=no \ --with-mailhost=localhost \ --with-urlhost=localhost CONFLICTS= ja-mailman-2.1.* mailman*exim* mailman*postfix* # The Mailman port supports a number of variables that may be tweaked at # build time. Getting the values of some of them right is crucial! # MM_USERNAME?= mailman MM_USERID?= 91 MM_GROUPNAME?= ${MM_USERNAME} MM_GROUPID?= ${MM_USERID} MM_DIR?= mailman CGI_GID?= www IMGDIR?= www/icons # # End of user-configurable variables. USERS= ${MM_USERNAME} GROUPS= ${MM_GROUPNAME} MAILMANDIR= ${PREFIX}/${MM_DIR} PLIST_SUB= MMDIR=${MM_DIR} IMGDIR=${IMGDIR} MM_USERNAME=${MM_USERNAME} MM_GROUPNAME=${MM_GROUPNAME} SUB_FILES= pkg-message pkg-install mailman.newsyslog.sample SUB_LIST= MAILMANDIR=${MAILMANDIR} USER=${MM_USERNAME} GROUP=${MM_GROUPNAME} PYTHON_CMD="${PYTHON_CMD}" PKGDEINSTALL= ${PKGINSTALL} PORTDOCS= ACKNOWLEDGMENTS BUGS FAQ INSTALL NEWS README README-I18N.en \ README.CONTRIB README.NETSCAPE \ README.USERAGENT TODO UPGRADING \ mailman-admin.txt \ mailman-install.txt \ mailman-member.txt \ FreeBSD-post-install-notes OPTIONS_SINGLE= MTA OPTIONS_SINGLE_MTA= COURIER EXIM4 OPENSMTPD POSTFIX SENDMAIL OPTIONS_DEFINE= HTDIG NAMAZU2 NOMAILPWD NLS DOCS OPTIONS_DEFAULT= SENDMAIL NOMAILPWD COURIER_DESC= for use with courier EXIM4_DESC= for use with exim4 EXIM4_RUN_DEPENDS= exim>=0:mail/exim OPENSMTPD_DESC= for use with opensmtpd - EXPERIMENTAL - POSTFIX_DESC= for use with postfix POSTFIX_RUN_DEPENDS= postfix:mail/postfix SENDMAIL_DESC= for use with sendmail HTDIG_DESC= - EXPERIMENTAL - htdig integration patches NAMAZU2_DESC= Make private archives searchable with namazu2 NOMAILPWD_DESC= Elide plaintext passwords from monthly reminders MTA_DESC= Integrate with which MTA? .include SUB_LIST+= NLS="${PORT_OPTIONS:MNLS}" # enforce EXAMPLES option, necessary so that @sample # can install the newsyslog file .if empty(PORT_OPTIONS:MEXAMPLES) PORT_OPTIONS+= EXAMPLES .endif .if ${PORT_OPTIONS:MNLS} USES+= gettext PLIST_SUB+= NLS="" .else PLIST_SUB+= NLS="@comment " MAKE_ARGS+= LANGUAGES=en .endif .if ${PORT_OPTIONS:MSENDMAIL} MAIL_GID?= mailnull .endif .if ${PORT_OPTIONS:MEXIM4} MAIL_GID?= mail .endif .if ${PORT_OPTIONS:MPOSTFIX} MAIL_GID?= mailman EXTRA_PATCHES+= ${FILESDIR}/postfix-verp.diff .endif .if ${PORT_OPTIONS:MCOURIER} MAIL_GID?= courier .endif .if ${PORT_OPTIONS:MOPENSMTPD} MAIL_GID?= _smtpd .endif .if ${PORT_OPTIONS:MHTDIG} # no whitespace here! PKGNAMESUFFIX:= ${PKGNAMESUFFIX}-with-htdig # how to create PATCHFILES: #X identify what is the version of msapiro's patches corresponding to the release. #X fetch http://bazaar.launchpad.net/~msapiro/mailman/htdig/tarball/1822 #X unpack this tarball, and the original distfile #X diff -NEur original-unpack bazaar-unpack | xz --best -c >msapiro-htdig-1822.patch.xz #X upload the latter with mode 0644 or similar to freefall's public_distfiles/ directory _HTDIGREV= 1822 PATCHFILES+= msapiro-htdig-${_HTDIGREV}.patch.xz RUN_DEPENDS+= htdig:textproc/htdig PLIST_SUB+= SUB_HTDIG="" .else PLIST_SUB+= SUB_HTDIG="@comment " .endif .if ${PORT_OPTIONS:MNAMAZU2} RUN_DEPENDS+= mknmz:databases/namazu2 EXTRA_PATCHES+= ${FILESDIR}/extra-patch-Mailman-Cgi-private.py .endif .if ${PORT_OPTIONS:MNOMAILPWD} EXTRA_PATCHES+= ${FILESDIR}/extra-patch-mailpasswds .endif BUILD_DEPENDS+= ${PYTHON_PKGNAMEPREFIX}dnspython1>=0:dns/py-dnspython1@${PY_FLAVOR} RUN_DEPENDS+= ${PYTHON_PKGNAMEPREFIX}dnspython1>=0:dns/py-dnspython1@${PY_FLAVOR} pre-everything:: @${ECHO} "" @${ECHO} "You may change the following build options:" @${ECHO} "" @${ECHO} "Option Default Value Description" @${ECHO} "------------- --------------- ------------------------------------------------" @${ECHO} "MM_USERNAME mailman The username of the Mailman user." @${ECHO} "MM_USERID 91 The user ID of the Mailman user." @${ECHO} "MM_GROUPNAME mailman The group to which the Mailman user will belong." @${ECHO} "MM_GROUPID \$$MM_USERID The group ID for the Mailman user." @${ECHO} "MM_DIR mailman Mailman will be installed in" @${ECHO} " ${PREFIX}/${MM_DIR}." @${ECHO} "CGI_GID www The group name or id under which your web" @${ECHO} " server executes CGI scripts." @${ECHO} "IMGDIR www/icons Icon images will be installed in" @${ECHO} " ${PREFIX}/${IMGDIR}." @${ECHO} "" post-patch: ${REINPLACE_CMD} -e 's#%%LOCALBASE%%#${LOCALBASE}#g' \ ${WRKSRC}/Mailman/Defaults.py.in ${REINPLACE_CMD} -e 's/^0,5,10/#&/' ${WRKSRC}/cron/crontab.in.in .if empty(PORT_OPTIONS:MNLS) ${REINPLACE_CMD} -e 's/messages//' ${WRKSRC}/Makefile.in .endif ${MV} ${WRKSRC}/configure.in ${WRKSRC}/configure.ac # suppress warning # post-patch-HTDIG-on is to fix https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=238508 post-patch-HTDIG-on: # these should match those in ht://Dig's ${LOCALBASE}/bin/rundig ${REINPLACE_CMD} -E \ -e 's#^(DBDIR)=/opt/www/var/htdig#\1=${LOCALBASE}/share/htdig/database#' \ -e 's#^(COMMONDIR)=/opt/www/share/htdig#\1=${LOCALBASE}/share/htdig/common#' \ -e 's#^(BINDIR)=/opt/www/bin#\1=${LOCALBASE}/bin#' \ -e 's#^(conffile)=/opt/www/conf/#\1=${LOCALBASE}/etc/htdig/#' \ ${WRKSRC}/cron/rundig ${REINPLACE_CMD} -E \ -e 's#/opt/www/htdig/bin#${LOCALBASE}/bin#' \ ${WRKSRC}/Mailman/Cgi/remote?mmsearch .if ${PORT_OPTIONS:MPOSTFIX} pre-configure: ${ECHO} "MTA = 'Postfix'" >> ${WRKSRC}/Mailman/mm_cfg.py.dist.in .endif post-install: ${MKDIR} ${STAGEDIR}${EXAMPLESDIR} ${INSTALL_DATA} ${WRKDIR}/mailman.newsyslog.sample ${STAGEDIR}${EXAMPLESDIR} .for i in admindb admin confirm create edithtml listinfo options private \ rmlist roster subscribe ${STRIP_CMD} ${STAGEDIR}${MAILMANDIR}/cgi-bin/${i} .endfor .if ${PORT_OPTIONS:MHTDIG} .for i in htdig mmsearch ${STRIP_CMD} ${STAGEDIR}${MAILMANDIR}/cgi-bin/${i} .endfor .endif ${STRIP_CMD} ${STAGEDIR}${MAILMANDIR}/mail/mailman # Compile additional Python scripts: .for dir in bin (cd ${STAGEDIR}${MAILMANDIR} \ && ${PYTHON_CMD} ${PYTHON_LIBDIR}/compileall.py \ -d ${MAILMANDIR}/${dir} ${dir}) .endfor @${RM} ${STAGEDIR}${MAILMANDIR}/pythonlib/*.egg-info @${RM} ${STAGEDIR}${MAILMANDIR}/Mailman/mm_cfg.py @${RM} ${STAGEDIR}${MAILMANDIR}/Mailman/mm_cfg.pyc @${MKDIR} ${STAGEDIR}${PREFIX}/${IMGDIR} ${CP} -p ${STAGEDIR}${MAILMANDIR}/icons/* ${STAGEDIR}${PREFIX}/${IMGDIR} ${INSTALL_DATA} ${FILESDIR}/powerlogo.png \ ${STAGEDIR}${PREFIX}/${IMGDIR}/ ${INSTALL_DATA} ${FILESDIR}/powerlogo.png \ ${STAGEDIR}${MAILMANDIR}/icons/ .if ${PORT_OPTIONS:MDOCS} ${CP} -R ${WRKSRC}/doc/* ${WRKSRC}/ @${MKDIR} ${STAGEDIR}${DOCSDIR} ${INSTALL_DATA} ${FILESDIR}/FreeBSD-post-install-notes ${STAGEDIR}${DOCSDIR} .for docfile in ${PORTDOCS:NFreeBSD-post-install-notes} ${INSTALL_DATA} ${WRKSRC}/${docfile} ${STAGEDIR}${DOCSDIR} .endfor .endif @${MKDIR} ${STAGEDIR}${PYTHONPREFIX_SITELIBDIR} ${ECHO} "This marker file ensures that Python's upgrade-site-packages handles ${PKGNAME}." >${STAGEDIR}${PYTHONPREFIX_SITELIBDIR}/mailman-info.txt ${INSTALL_SCRIPT} ${PKGINSTALL} ${STAGEDIR}${MAILMANDIR}/bin/FreeBSD-post-install ${MKDIR} ${STAGEDIR}${MAILMANDIR}/templates/site/en ${INSTALL_DATA} ${FILESDIR}/templates_site_README.txt ${STAGEDIR}${MAILMANDIR}/templates/site/README.txt .include diff --git a/mail/mailman/files/patch-0-r1885-r1893 b/mail/mailman/files/patch-0-r1885-r1893 new file mode 100644 index 000000000000..fbcde7e7f206 --- /dev/null +++ b/mail/mailman/files/patch-0-r1885-r1893 @@ -0,0 +1,195 @@ +This is a patch generated by unpacking +https://bazaar.launchpad.net/tarball/1885 +https://bazaar.launchpad.net/tarball/1893 +as .tgz tarballs into separate directories and diffing it +with GNU diff -NEur: + +diff -NEur bin/cleanarch bin/cleanarch +--- bin/cleanarch 2018-06-18 01:47:34.744000000 +0200 ++++ bin/cleanarch 2022-01-11 04:08:45.300000000 +0100 +@@ -60,7 +60,7 @@ + # From RFC 2822, a header field name must contain only characters from 33-126 + # inclusive, excluding colon. I.e. from oct 41 to oct 176 less oct 072. Must + # use re.match() so that it's anchored at the beginning of the line. +-fre = re.compile(r'[\041-\071\073-\176]+') ++fre = re.compile(r'[\041-\071\073-\176]+:') + + + +diff -NEur Mailman/Cgi/options.py Mailman/Cgi/options.py +--- Mailman/Cgi/options.py 2021-11-24 04:38:19.869000000 +0100 ++++ Mailman/Cgi/options.py 2023-05-22 21:58:09.582000000 +0200 +@@ -1,4 +1,4 @@ +-# Copyright (C) 1998-2018 by the Free Software Foundation, Inc. ++# Copyright (C) 1998-2023 by the Free Software Foundation, Inc. + # + # This program is free software; you can redistribute it and/or + # modify it under the terms of the GNU General Public License +@@ -164,13 +164,40 @@ + loginpage(mlist, doc, None, language) + print doc.Format() + return +- # Sanity check the user, but only give the "no such member" error when +- # using public rosters, otherwise, we'll leak membership information. ++ # Sanity check the user, but we have to give the appropriate error msg ++ # to not potentially leak membership info. This is a kludge here. We ++ # have to check membership here to avoid LP: #1951769, but then we have ++ # to give the appropriate error to avoid LP: #1968443 ++ msgc = _('If you are a list member, a confirmation email has been sent.') ++ msgb = _('You already have a subscription pending confirmation') ++ msga = _("""If you are a list member, your unsubscription request has been ++ forwarded to the list administrator for approval.""") ++ msgd = _("""If you are a list member, ++ your password has been emailed to you.""") + if not mlist.isMember(user): + if mlist.private_roster == 0: + doc.addError(_('No such member: %(safeuser)s.')) +- loginpage(mlist, doc, None, language) +- print doc.Format() ++ user = None ++ elif cgidata.has_key('login-unsub'): ++ syslog('mischief', ++ 'Unsub attempt of non-member w/ private rosters: %s', ++ user) ++ if mlist.unsubscribe_policy: ++ doc.addError(msga, tag='') ++ else: ++ doc.addError(msgc, tag='') ++ user = None ++ elif cgidata.has_key('login-remind'): ++ syslog('mischief', ++ 'Reminder attempt of non-member w/ private rosters: %s', ++ user) ++ doc.addError(msgd, tag='') ++ user = None ++ # We get here with a non-None user in the case of a non-member with ++ # private rosters. This creates a possible membership leak, but we ++ # fix that a different way. See LP: #2017813. ++ loginpage(mlist, doc, user, language) ++ print doc.Format() + return + + # Avoid cross-site scripting attacks +@@ -204,10 +231,6 @@ + i18n.set_language(userlang) + + # Are we processing an unsubscription request from the login screen? +- msgc = _('If you are a list member, a confirmation email has been sent.') +- msgb = _('You already have a subscription pending confirmation') +- msga = _("""If you are a list member, your unsubscription request has been +- forwarded to the list administrator for approval.""") + if cgidata.has_key('login-unsub'): + # Because they can't supply a password for unsubscribing, we'll need + # to do the confirmation dance. +@@ -233,39 +256,20 @@ + finally: + mlist.Unlock() + else: +- # Not a member +- if mlist.private_roster == 0: +- # Public rosters +- doc.addError(_('No such member: %(safeuser)s.')) +- else: +- syslog('mischief', +- 'Unsub attempt of non-member w/ private rosters: %s', +- user) +- if mlist.unsubscribe_policy: +- doc.addError(msga, tag='') +- else: +- doc.addError(msgc, tag='') ++ # Not a member handled above. ++ pass + loginpage(mlist, doc, user, language) + print doc.Format() + return + + # Are we processing a password reminder from the login screen? +- msg = _("""If you are a list member, +- your password has been emailed to you.""") + if cgidata.has_key('login-remind'): + if mlist.isMember(user): + mlist.MailUserPassword(user) +- doc.addError(msg, tag='') ++ doc.addError(msgd, tag='') + else: +- # Not a member +- if mlist.private_roster == 0: +- # Public rosters +- doc.addError(_('No such member: %(safeuser)s.')) +- else: +- syslog('mischief', +- 'Reminder attempt of non-member w/ private rosters: %s', +- user) +- doc.addError(msg, tag='') ++ # Not a member handled above. ++ pass + loginpage(mlist, doc, user, language) + print doc.Format() + return +@@ -293,7 +297,9 @@ + # to authenticate via cgi (instead of cookie), then print an error + # message. + if cgidata.has_key('password'): +- doc.addError(_('Authentication failed.')) ++ if mlist.private_roster == 0: ++ # Only add error with public rosters lp: #2015416 ++ doc.addError(_('Authentication failed.')) + remote = os.environ.get('HTTP_FORWARDED_FOR', + os.environ.get('HTTP_X_FORWARDED_FOR', + os.environ.get('REMOTE_ADDR', +@@ -307,9 +313,11 @@ + syslog('mischief', + 'Login failure with private rosters: %s from %s', + user, remote) +- user = None ++ # Don't clear user here. See LP: #2017813. + # give an HTTP 401 for authentication failure +- print 'Status: 401 Unauthorized' ++ if mlist.private_roster == 0: ++ # Only add error with public rosters lp: #2015416 ++ print 'Status: 401 Unauthorized' + loginpage(mlist, doc, user, language) + print doc.Format() + return +diff -NEur messages/de/LC_MESSAGES/mailman.po messages/de/LC_MESSAGES/mailman.po +--- messages/de/LC_MESSAGES/mailman.po 2020-06-27 02:12:17.548000000 +0200 ++++ messages/de/LC_MESSAGES/mailman.po 2022-03-29 01:55:20.774000000 +0200 +@@ -4577,7 +4577,7 @@ + + #: Mailman/Defaults.py:1809 + msgid "Esperanto" +-msgstr "Deutsch" ++msgstr "Esperanto" + + # Mailman/Defaults.py:773 + #: Mailman/Defaults.py:1810 +diff -NEur NEWS NEWS +--- NEWS 2021-12-13 21:36:11.555000000 +0100 ++++ NEWS 2023-05-22 21:58:09.582000000 +0200 +@@ -5,6 +5,26 @@ + + Here is a history of user visible changes to Mailman. + ++2.1.40 (xx-xxx-xxxx) ++ ++ i18n ++ ++ - The German translation of `Esperanto` is fixed. (LP: #1966685) ++ ++ Bug Fixes and other patches ++ ++ - Test for a valid header following a Unix From_ line in bin/cleanarch ++ has been improved. (LP: #1957025) ++ - A 500 Internal Server Error when requesting the options page for a ++ non-member address on a list with private rosters is avoided. ++ (LP: #1961762) ++ - A possible list membership leak via the user options CGI is fixed. ++ (LP: #1968443) ++ - Another possible list membership leak via the user options CGI is fixed. ++ (LP: #2015416) ++ - Yet another possible list membership leak via the user options CGI is ++ fixed. (LP: #2017813) ++ + 2.1.39 (13-Dec-2021) + + Bug Fixes and other patches