pkgsrc/mail/mailman/distinfo

15 lines
785 B
Text
Raw Normal View History

$NetBSD: distinfo,v 1.21 2011/12/22 11:06:40 fhajny Exp $
Update Mailman to 2.1.14.1 Partly addresses pkg/25165. From the package's NEWS file: 2.1.14 (20-Sep-2010) Security - Two potential XSS vulnerabilities have been identified and fixed. New Features - A new feature for controlling the addition/replacement of the Sender: header in outgoing mail has been implemented. This allows a list owner to set include_sender_header on the list's General Options page in the admin GUI. The default for this setting is Yes which preserves the prior behavior of removing any pre-existing Sender: and setting it to the list's -bounces address. Setting this to No stops Mailman from adding or modifying the Sender: at all. Additionally, there is a new Defaults.py/mm_cfg.py setting ALLOW_SENDER_OVERRIDES which defaults to Yes but which can be set to No to remove the include_sender_header setting from General Options, and thus preserve the prior behavior completely. - Bounce processing has been enhanced so that if a bounce is returned to a list from a non-member who is a member of a regular_include_list, the bounce will be processed as a bounce for the included list. i18n - Fixed a missing format character in the German bin/mailmanctl docstring. - Updated Dutch translation from Jan Veuger. - Updated Japanese Translation from Tokio Kikuchi. - Updated Finnish translation from Joni Töyrylä. - Made a few corrections to some Polish templates. Bug #566731. - Made a minor change to the Chinese (China) message catalog. Bug #545772. - Changed a few DOCTYPE directives in templates for compliance. Bug #500952 and Bug #500955. Bug Fixes and other patches - Made minor wording improvements and typo corrections in some messages. Bug #426979. - Fixed i18n._() to catch exceptions due to bad formats. Bug #632660. - Fixed admindb interface to decode base64 and quoted-printable encoded message body excerpts for display. Bug #629738. - Fixed web CGI tracebacks to properly report sys.path. Bug #615114. - Changed the member options login page unsubscribe request to include the requesters IP address in the confirmation request. Bug #610527. - Changed fix_url to lock the list if not locked. Bug #610364. - Made a minor change to the English subscribeack.txt (welcome message) template to emphasize that a password is only required to unsubscribe *without confirmation*. - Fixed an issue in admindb that could result in a KeyError and "we hit a bug" response when a moderator acts on a post that had been handled by someone else after the first moderator had retrieved it. Bug #598671. - Fixed a bug which would fail to show a list on the admin and listinfo overview pages if its web_page_url contained a :port. Bug # 597741. - Fixed bin/genaliases to not throw TypeError when MTA = None. Bug #587657. - Provided the ability to specify in mm_cfg.py a local domain (e.g. 'localhost') for the local addresses in the generated virtual-mailman when MTA = 'Postfix'. See VIRTUAL_MAILMAN_LOCAL_DOMAIN in Defaults.py. Bug #328907. - Made a minor change to the removal of an Approved: pseudo-header from a text/html alternative to allow for an inserted '\xA0' before the password. - Fixed Content Filtering collapse_alternatives to work on deeply nested multipart/alternative parts. Bug #576675. - We now accept/remove X-Approved: and X-Approve: headers in addition to Approved: and Approve: for pre-approving posts. Bug #557750. - Reordered the 'cancel' and 'subscribe' buttons on the subscription confirmation web page so the default action upon 'enter' will be the subscribe button in browsers that pick the first button. Bug #530654. - Fixed a bug in the admindb interface that could apply a moderator action to a message not displayed. Bug #533468. - Added a traceback to the log message produced when processing the digest.mbox throws an exception. - Added a urlhost argument to the MailList.MailList.Create() method to allow bin/newlist and the the create CGI to pass urlhost so the host will be correct in the listinfo link on the emptyarchive page. Bug #529100. - Added the List-Post header to the default list of headers retained in messages in the MIME digest. Bug #526143. - When daemonizing mailmanctl, we now ensure terminal files are closed. - Fixed a bug in pipermail archiving that caused fallback threading by subject to fail. Bug #266572. - We now give an HTTP 401 status for authentication failures from admin, admindb, private, options and roster CGIs, and an HTTP 404 status from all the CGIs for an invalid list name. - Backported the listinfo template change from the 2.2 branch to fix Bug #514050. - Fixed a bug where going to an archives/private/list.mbox/list.mbox URL would result in a munged URL if authentication was required. Bug #266164. - Fixed a bug where check_perms would throw an OSError if an entry in Mailman's lists/ directory was not a directory. Bug #265613. - Fixed a bug where a message with an Approved: header held by a handler that precedes Approve (SpamDetect by default) would not have the Approved: header removed if the held message was approved. Bug #501739. 2.1.13 (22-Dec-2009) i18n - Updated Dutch message catalog from Jan Veuger. - Added Asturian translation from Marcos Costales and the Asturian Language Team. Bug Fixes and other patches - Added "white-space: pre-wrap" style for <pre> tag in archives. Bug #266467. - Added vette logging for rejected and discarded (un)subscribe requests. - Fixed a bug in admindb.py that could erroneously discard an unsubscribe request as a duplicate. - Decoded RFC 2047 encoded message subjects for a few reports. Bug #266428. - Fixed the French, Spanish and Hebrew translations which improperly translated the 'coding:' line in bin/config_list output. - Fixed the auto-responder to treat messages to -confirm, -join, -leave, -subscribe and -unsubscribe as requests rather than posts. Bug #427962. - Configure/make no longer builds Japanese and Korean codecs in pythonlib if Python already has them. - Inadvertently setting a null site or list password allowed access to a list's web admin interface without authentication. Fixed by not accepting null passwords. - Changed VERP_CONFIRM_REGEXP in Defaults.py to work if the replying MUA folds the To: header and in cases where the list name includes '+'. - Fixed some paths in contrib/check_perms_grsecurity.py. Bug #411192. - Replies to commands sent to list-request now come From: list-owner instead of list-bounces. - Mailman no longer folds long sub-part headers in multipart messages. In addition, Mailman no longer escapes From_ lines in the body of messages sent to regular list members, although MTA's may do it anyway. This is to avoid breaking signatures per Bug #265967. - XSS protection in the web interface went too far in escaping HTML entities. Fixed. - Removed or anonymized additional headers in posts to anonymous lists. - Fixed a bug that could cause incorrect threading of replies to archived messages that arrive with timestamps in the same second. - Scrubbed HTML attachments containing tab characters would get the tabs replaced by a string of '&nbsp' without a semicolon. Fixed. - Caught a TypeError in content filtering, collapse alternatives that occurred with a malformed message if a multipart/alternative part wasn't multi-part. Reported in comments to bug #266230. - Fixed a few things in bin/update: - Changed some old messages for more current meaning. - Fixed qfiles update to not lose metadata from 2.1.5+ format entries. - Fixed 2.0.x template migration to not die if the templates/ tree contains subdirectories from a version control system. - Fixed a bug that would show a list on the admin and listinfo overview pages if its web_page_url host contained the current host as a substring. Bug #342162. - Fixed a bug in Utils.canonstr() that would throw a UnicodeDecodeError if the string contained an HTML entity > 255 and also characters in the 128-255 range. Bug #341594. - Added recognition for more bounces. - Updated contrib/mmdsr to report preserved messages and to use mktemp to create temp files.
2011-04-07 17:45:37 +02:00
SHA1 (mailman-2.1.14-1.tgz) = 390874c1059878b33be9ab4cf57fdb719eac1819
RMD160 (mailman-2.1.14-1.tgz) = 0d86e766e28aaab9703bfe530b72316a5b02beda
Size (mailman-2.1.14-1.tgz) = 8201308 bytes
SHA1 (patch-aa) = 9684b1caeb52f31ee6967eae3f9a464de214879e
SHA1 (patch-ab) = 39f6294e53110bd1fd09b1e90ab46820f4d48e3f
SHA1 (patch-ad) = 665884b9dd1789e4abd430c762bdbfd707d48d30
SHA1 (patch-ae) = 6c17de398014217be8f1c7a3b3a6f8d379fc0fb2
SHA1 (patch-af) = 985a619a055151d998cefd0c1b7280a0d55f889e
Update Mailman to 2.1.14.1 Partly addresses pkg/25165. From the package's NEWS file: 2.1.14 (20-Sep-2010) Security - Two potential XSS vulnerabilities have been identified and fixed. New Features - A new feature for controlling the addition/replacement of the Sender: header in outgoing mail has been implemented. This allows a list owner to set include_sender_header on the list's General Options page in the admin GUI. The default for this setting is Yes which preserves the prior behavior of removing any pre-existing Sender: and setting it to the list's -bounces address. Setting this to No stops Mailman from adding or modifying the Sender: at all. Additionally, there is a new Defaults.py/mm_cfg.py setting ALLOW_SENDER_OVERRIDES which defaults to Yes but which can be set to No to remove the include_sender_header setting from General Options, and thus preserve the prior behavior completely. - Bounce processing has been enhanced so that if a bounce is returned to a list from a non-member who is a member of a regular_include_list, the bounce will be processed as a bounce for the included list. i18n - Fixed a missing format character in the German bin/mailmanctl docstring. - Updated Dutch translation from Jan Veuger. - Updated Japanese Translation from Tokio Kikuchi. - Updated Finnish translation from Joni Töyrylä. - Made a few corrections to some Polish templates. Bug #566731. - Made a minor change to the Chinese (China) message catalog. Bug #545772. - Changed a few DOCTYPE directives in templates for compliance. Bug #500952 and Bug #500955. Bug Fixes and other patches - Made minor wording improvements and typo corrections in some messages. Bug #426979. - Fixed i18n._() to catch exceptions due to bad formats. Bug #632660. - Fixed admindb interface to decode base64 and quoted-printable encoded message body excerpts for display. Bug #629738. - Fixed web CGI tracebacks to properly report sys.path. Bug #615114. - Changed the member options login page unsubscribe request to include the requesters IP address in the confirmation request. Bug #610527. - Changed fix_url to lock the list if not locked. Bug #610364. - Made a minor change to the English subscribeack.txt (welcome message) template to emphasize that a password is only required to unsubscribe *without confirmation*. - Fixed an issue in admindb that could result in a KeyError and "we hit a bug" response when a moderator acts on a post that had been handled by someone else after the first moderator had retrieved it. Bug #598671. - Fixed a bug which would fail to show a list on the admin and listinfo overview pages if its web_page_url contained a :port. Bug # 597741. - Fixed bin/genaliases to not throw TypeError when MTA = None. Bug #587657. - Provided the ability to specify in mm_cfg.py a local domain (e.g. 'localhost') for the local addresses in the generated virtual-mailman when MTA = 'Postfix'. See VIRTUAL_MAILMAN_LOCAL_DOMAIN in Defaults.py. Bug #328907. - Made a minor change to the removal of an Approved: pseudo-header from a text/html alternative to allow for an inserted '\xA0' before the password. - Fixed Content Filtering collapse_alternatives to work on deeply nested multipart/alternative parts. Bug #576675. - We now accept/remove X-Approved: and X-Approve: headers in addition to Approved: and Approve: for pre-approving posts. Bug #557750. - Reordered the 'cancel' and 'subscribe' buttons on the subscription confirmation web page so the default action upon 'enter' will be the subscribe button in browsers that pick the first button. Bug #530654. - Fixed a bug in the admindb interface that could apply a moderator action to a message not displayed. Bug #533468. - Added a traceback to the log message produced when processing the digest.mbox throws an exception. - Added a urlhost argument to the MailList.MailList.Create() method to allow bin/newlist and the the create CGI to pass urlhost so the host will be correct in the listinfo link on the emptyarchive page. Bug #529100. - Added the List-Post header to the default list of headers retained in messages in the MIME digest. Bug #526143. - When daemonizing mailmanctl, we now ensure terminal files are closed. - Fixed a bug in pipermail archiving that caused fallback threading by subject to fail. Bug #266572. - We now give an HTTP 401 status for authentication failures from admin, admindb, private, options and roster CGIs, and an HTTP 404 status from all the CGIs for an invalid list name. - Backported the listinfo template change from the 2.2 branch to fix Bug #514050. - Fixed a bug where going to an archives/private/list.mbox/list.mbox URL would result in a munged URL if authentication was required. Bug #266164. - Fixed a bug where check_perms would throw an OSError if an entry in Mailman's lists/ directory was not a directory. Bug #265613. - Fixed a bug where a message with an Approved: header held by a handler that precedes Approve (SpamDetect by default) would not have the Approved: header removed if the held message was approved. Bug #501739. 2.1.13 (22-Dec-2009) i18n - Updated Dutch message catalog from Jan Veuger. - Added Asturian translation from Marcos Costales and the Asturian Language Team. Bug Fixes and other patches - Added "white-space: pre-wrap" style for <pre> tag in archives. Bug #266467. - Added vette logging for rejected and discarded (un)subscribe requests. - Fixed a bug in admindb.py that could erroneously discard an unsubscribe request as a duplicate. - Decoded RFC 2047 encoded message subjects for a few reports. Bug #266428. - Fixed the French, Spanish and Hebrew translations which improperly translated the 'coding:' line in bin/config_list output. - Fixed the auto-responder to treat messages to -confirm, -join, -leave, -subscribe and -unsubscribe as requests rather than posts. Bug #427962. - Configure/make no longer builds Japanese and Korean codecs in pythonlib if Python already has them. - Inadvertently setting a null site or list password allowed access to a list's web admin interface without authentication. Fixed by not accepting null passwords. - Changed VERP_CONFIRM_REGEXP in Defaults.py to work if the replying MUA folds the To: header and in cases where the list name includes '+'. - Fixed some paths in contrib/check_perms_grsecurity.py. Bug #411192. - Replies to commands sent to list-request now come From: list-owner instead of list-bounces. - Mailman no longer folds long sub-part headers in multipart messages. In addition, Mailman no longer escapes From_ lines in the body of messages sent to regular list members, although MTA's may do it anyway. This is to avoid breaking signatures per Bug #265967. - XSS protection in the web interface went too far in escaping HTML entities. Fixed. - Removed or anonymized additional headers in posts to anonymous lists. - Fixed a bug that could cause incorrect threading of replies to archived messages that arrive with timestamps in the same second. - Scrubbed HTML attachments containing tab characters would get the tabs replaced by a string of '&nbsp' without a semicolon. Fixed. - Caught a TypeError in content filtering, collapse alternatives that occurred with a malformed message if a multipart/alternative part wasn't multi-part. Reported in comments to bug #266230. - Fixed a few things in bin/update: - Changed some old messages for more current meaning. - Fixed qfiles update to not lose metadata from 2.1.5+ format entries. - Fixed 2.0.x template migration to not die if the templates/ tree contains subdirectories from a version control system. - Fixed a bug that would show a list on the admin and listinfo overview pages if its web_page_url host contained the current host as a substring. Bug #342162. - Fixed a bug in Utils.canonstr() that would throw a UnicodeDecodeError if the string contained an HTML entity > 255 and also characters in the 128-255 range. Bug #341594. - Added recognition for more bounces. - Updated contrib/mmdsr to report preserved messages and to use mktemp to create temp files.
2011-04-07 17:45:37 +02:00
SHA1 (patch-ag) = fac40640db483c2e9db3a79ec0696dc60596e453
Changes 2.1.12: * Fix compatibility with Python 2.6. * Fixed a bug in admin.py which would result in chunked pages of the membership list for members whose address begins with a non-alphanumeric character to not be visible or retrievable. * Changed ListAdmin.py to make rejected post messages From: the -owner address instead of the -bounces address. * With MTA = 'Postfix', if the STANZA END for a list being removed is missing or munged, the remainder of the aliases and/or virtual-mailman file is lost. Fixed. * Since Mailman 2.1.1, 2.0.x outstanding subscription and held message requests have not been migrated properly. This is fixed. * Changed cron/gate_news to continue processing the remaining lists on certain errors that can be caused by configuration of a particular list. * Fixed a bug in AvoidDuplicates.py that caused it to fail if the address in the To: or Cc: header differed in case from the case-preserved member address. * Fixed a problem in SecurityManager that caused it to not find the cookie when CheckCookie was not given a user and the user in the cookie had a %xx encoded character. * Fixed a minor fromusenet reporting issue in the contributed mmdsr script. * Fixed a minor issue in cron/gate_news that could cause a list's watermark to not be completely updated. * Fixed an issue that prevented editing the options.html template from the web admin interface. * Fixed a problem in Decorate which could throw a TypeError on conversion to unicode of a header/footer that was already unicode because of interpolating a unicode value. * Fixed an issue where list creation would report bad owner email instead of bad listname when the list name had non-ascii characters. * Updated Dutch, Catalan and Polish translations.
2009-06-03 08:55:07 +02:00
SHA1 (patch-ah) = c7cde35f787c003ace550a98d8d5e166ba2d48dc
Update Mailman to 2.1.14.1 Partly addresses pkg/25165. From the package's NEWS file: 2.1.14 (20-Sep-2010) Security - Two potential XSS vulnerabilities have been identified and fixed. New Features - A new feature for controlling the addition/replacement of the Sender: header in outgoing mail has been implemented. This allows a list owner to set include_sender_header on the list's General Options page in the admin GUI. The default for this setting is Yes which preserves the prior behavior of removing any pre-existing Sender: and setting it to the list's -bounces address. Setting this to No stops Mailman from adding or modifying the Sender: at all. Additionally, there is a new Defaults.py/mm_cfg.py setting ALLOW_SENDER_OVERRIDES which defaults to Yes but which can be set to No to remove the include_sender_header setting from General Options, and thus preserve the prior behavior completely. - Bounce processing has been enhanced so that if a bounce is returned to a list from a non-member who is a member of a regular_include_list, the bounce will be processed as a bounce for the included list. i18n - Fixed a missing format character in the German bin/mailmanctl docstring. - Updated Dutch translation from Jan Veuger. - Updated Japanese Translation from Tokio Kikuchi. - Updated Finnish translation from Joni Töyrylä. - Made a few corrections to some Polish templates. Bug #566731. - Made a minor change to the Chinese (China) message catalog. Bug #545772. - Changed a few DOCTYPE directives in templates for compliance. Bug #500952 and Bug #500955. Bug Fixes and other patches - Made minor wording improvements and typo corrections in some messages. Bug #426979. - Fixed i18n._() to catch exceptions due to bad formats. Bug #632660. - Fixed admindb interface to decode base64 and quoted-printable encoded message body excerpts for display. Bug #629738. - Fixed web CGI tracebacks to properly report sys.path. Bug #615114. - Changed the member options login page unsubscribe request to include the requesters IP address in the confirmation request. Bug #610527. - Changed fix_url to lock the list if not locked. Bug #610364. - Made a minor change to the English subscribeack.txt (welcome message) template to emphasize that a password is only required to unsubscribe *without confirmation*. - Fixed an issue in admindb that could result in a KeyError and "we hit a bug" response when a moderator acts on a post that had been handled by someone else after the first moderator had retrieved it. Bug #598671. - Fixed a bug which would fail to show a list on the admin and listinfo overview pages if its web_page_url contained a :port. Bug # 597741. - Fixed bin/genaliases to not throw TypeError when MTA = None. Bug #587657. - Provided the ability to specify in mm_cfg.py a local domain (e.g. 'localhost') for the local addresses in the generated virtual-mailman when MTA = 'Postfix'. See VIRTUAL_MAILMAN_LOCAL_DOMAIN in Defaults.py. Bug #328907. - Made a minor change to the removal of an Approved: pseudo-header from a text/html alternative to allow for an inserted '\xA0' before the password. - Fixed Content Filtering collapse_alternatives to work on deeply nested multipart/alternative parts. Bug #576675. - We now accept/remove X-Approved: and X-Approve: headers in addition to Approved: and Approve: for pre-approving posts. Bug #557750. - Reordered the 'cancel' and 'subscribe' buttons on the subscription confirmation web page so the default action upon 'enter' will be the subscribe button in browsers that pick the first button. Bug #530654. - Fixed a bug in the admindb interface that could apply a moderator action to a message not displayed. Bug #533468. - Added a traceback to the log message produced when processing the digest.mbox throws an exception. - Added a urlhost argument to the MailList.MailList.Create() method to allow bin/newlist and the the create CGI to pass urlhost so the host will be correct in the listinfo link on the emptyarchive page. Bug #529100. - Added the List-Post header to the default list of headers retained in messages in the MIME digest. Bug #526143. - When daemonizing mailmanctl, we now ensure terminal files are closed. - Fixed a bug in pipermail archiving that caused fallback threading by subject to fail. Bug #266572. - We now give an HTTP 401 status for authentication failures from admin, admindb, private, options and roster CGIs, and an HTTP 404 status from all the CGIs for an invalid list name. - Backported the listinfo template change from the 2.2 branch to fix Bug #514050. - Fixed a bug where going to an archives/private/list.mbox/list.mbox URL would result in a munged URL if authentication was required. Bug #266164. - Fixed a bug where check_perms would throw an OSError if an entry in Mailman's lists/ directory was not a directory. Bug #265613. - Fixed a bug where a message with an Approved: header held by a handler that precedes Approve (SpamDetect by default) would not have the Approved: header removed if the held message was approved. Bug #501739. 2.1.13 (22-Dec-2009) i18n - Updated Dutch message catalog from Jan Veuger. - Added Asturian translation from Marcos Costales and the Asturian Language Team. Bug Fixes and other patches - Added "white-space: pre-wrap" style for <pre> tag in archives. Bug #266467. - Added vette logging for rejected and discarded (un)subscribe requests. - Fixed a bug in admindb.py that could erroneously discard an unsubscribe request as a duplicate. - Decoded RFC 2047 encoded message subjects for a few reports. Bug #266428. - Fixed the French, Spanish and Hebrew translations which improperly translated the 'coding:' line in bin/config_list output. - Fixed the auto-responder to treat messages to -confirm, -join, -leave, -subscribe and -unsubscribe as requests rather than posts. Bug #427962. - Configure/make no longer builds Japanese and Korean codecs in pythonlib if Python already has them. - Inadvertently setting a null site or list password allowed access to a list's web admin interface without authentication. Fixed by not accepting null passwords. - Changed VERP_CONFIRM_REGEXP in Defaults.py to work if the replying MUA folds the To: header and in cases where the list name includes '+'. - Fixed some paths in contrib/check_perms_grsecurity.py. Bug #411192. - Replies to commands sent to list-request now come From: list-owner instead of list-bounces. - Mailman no longer folds long sub-part headers in multipart messages. In addition, Mailman no longer escapes From_ lines in the body of messages sent to regular list members, although MTA's may do it anyway. This is to avoid breaking signatures per Bug #265967. - XSS protection in the web interface went too far in escaping HTML entities. Fixed. - Removed or anonymized additional headers in posts to anonymous lists. - Fixed a bug that could cause incorrect threading of replies to archived messages that arrive with timestamps in the same second. - Scrubbed HTML attachments containing tab characters would get the tabs replaced by a string of '&nbsp' without a semicolon. Fixed. - Caught a TypeError in content filtering, collapse alternatives that occurred with a malformed message if a multipart/alternative part wasn't multi-part. Reported in comments to bug #266230. - Fixed a few things in bin/update: - Changed some old messages for more current meaning. - Fixed qfiles update to not lose metadata from 2.1.5+ format entries. - Fixed 2.0.x template migration to not die if the templates/ tree contains subdirectories from a version control system. - Fixed a bug that would show a list on the admin and listinfo overview pages if its web_page_url host contained the current host as a substring. Bug #342162. - Fixed a bug in Utils.canonstr() that would throw a UnicodeDecodeError if the string contained an HTML entity > 255 and also characters in the 128-255 range. Bug #341594. - Added recognition for more bounces. - Updated contrib/mmdsr to report preserved messages and to use mktemp to create temp files.
2011-04-07 17:45:37 +02:00
SHA1 (patch-ai) = f3afeba664b0cca27f160fde3b94c7b7f8498e57
SHA1 (patch-configure) = 3a2b3aeee266762664268d4abf5769e17e6b1fe1