pkgsrc as patches/patch-ai):
Security
- Added the ability for Mailman generated passwords (both member and list
admin) to be more cryptographically secure. See new configuration
variables USER_FRIENDLY_PASSWORDS, MEMBER_PASSWORD_LENGTH, and
ADMIN_PASSWORD_LENGTH. Also added a new bin/withlist script called
reset_pw.py which can be used to reset all member passwords. Passwords
generated by Mailman are now 8 characters by default for members, and 10
characters for list administrators.
- A potential cross-site scripting hole in the driver script has been
closed. Thanks to Florian Weimer for its discovery. Also, turn
STEALTH_MODE on by default.
Internationalization
- Chinese languages are now supported. They have been moved from 'big5'
and 'gb' to 'zh_TW' and 'zh_CN' respectively for compliance to the IANA
spec. Note, however, that the character sets were changed from 'Big5'
or 'GB2312' to 'UTF-8' to cope with the insufficient codecs support in
Python 2.3 and earlier. You may have to install Chinese capable codecs
(like CJKCodecs) separately to handle the incoming messages which are in
local charsets, or upgrade your Python to 2.4 or newer.
Behavior or defaults changes
- VERP_PROBES is disabled by default.
- bin/withlist can be run without a list name, but only if -i is given.
Also, withlist puts the directory it's found in at the end of sys.path,
making it easier to run withlist scripts that live in $prefix/bin.
- bin/newlist grew two new options: -u/--urlhost and -e/--emailhost which
lets the user provide the web and email hostnames for the new mailing
list. This is a better way to specify the domain for the list, rather
than the old 'mylist@hostname' syntax (which is still supported for
backward compatibility, but deprecated).
Compatibility
- Python 2.4 compatibility issue: time.strftime() became strict about the
'day of year' range. (1078482)
New Features
- New feature: automatic discards of held messages. List owners can now
set how many days to hold the messages in the moderator request queue.
cron/checkdb will automatically discard old messages. See the
max_days_to_hold variable in the General Options and
DEFAULT_MAX_DAYS_TO_HOLD in Defaults.py. This defaults to 0
(i.e. disabled). (790494)
- New feature: subject_prefix can be configured to include a sequence
number which is taken from the post_id variable. Also, the prefix is
always put at the start of the subject, i.e. "[list-name] Re: original
subject", if mm_cfg.OLD_STYLE_PREFIXING is set No. The default style
is "Re: [list-name]" if numbering is not set, for backward compatibility.
If the list owner is using numbering feature by "%d" directive, the new
style, "[list-name 123] Re:", is always used.
- List owners can now cusomize the non-member rejection notice from
admin/<listname>/privacy/sender page. (1107169)
- Allow editing of the welcome message from the admin page (1085501).
- List owners can now use Scrubber to get the attachments scrubbed (held
in the web archive), if the site admin permits it in mm_cfg.py. New
variables introduced are SCRUBBER_DONT_USE_ATTACHMENT_FILENAME and
SCRUBBER_USE_ATTACHMENT_FILENAME_EXTENSION in Defaults.py for scrubber
behavior. (904850)
Documentation
- Most of the installation instructions have been moved to a latex
document. See admin/www/mailman-install/index.html for details.
Bug fixes and other patches
- Mail-to-news gateway now strips subject prefix off from a response
by a mail user if news_prefix_subject_too is not set.
- Date and Message-Id headers are added for digests. (1116952)
- Improved mail address sanity check. (1030228)
- SpamDetect.py now checks attachment header. (1026977)
- Filter attachments by filename extensions. (1027882)
- Bugs and patches: 955381 (older Python compatibility), 1020102/1013079/
1020013 (fix spam filter removed), 665569 (newer Postfix bounce
detection), 970383 (moderator -1 admin requests pending), 873035
(subject handling in -request mail), 799166/946554 (makefile
compatibility), 872068 (add header/footer via unicode), 1032434
(KNOWN_SPAMMERS check for multi-header), 1025372 (empty Cc:), 789015
(fix pipermail URL), 948152 (Out of date link on Docs), 1099138
(Scrubber.py breaks on None part), 1099840/1099840 (deprecated %
insertion), 880073/933762 (List-ID RFC compliance), 1090439 (passwd
reminder shunted), 1112349 (case insensitivity in acceptable_aliases),
1117618 (Don't Cc for personalized anonymous list), 1190404 (wrong
permission after editing html)
And always is defined as share/examples/rc.d
which was the default before.
This rc.d scripts are not automatically added to PLISTs now also.
So add to each corresponding PLIST as required.
This was discussed on tech-pkg in late January and late April.
Todo: remove the RCD_SCRIPTS_EXAMPLEDIR uses in MESSAGES and elsewhere
and remove the RCD_SCRIPTS_EXAMPLEDIR itself.
python*-pth packages into meta-packages which will install the non-pth
packages. Bump PKGREVISIONs on the non-pth versions to propagate the
thread change, but leave the *-pth versions untouched to not affect
existing installations.
Sync all PYTHON_VERSIONS_AFFECTED lines in package Makefiles.
under share/examples/rc.d. The variable name already was named
RCD_SCRIPTS_EXAMPLEDIR.
This is from ideas from Greg Woods and others.
Also bumped PKGREVISION for all packages using RCD_SCRIPTS mechanism
(as requested by wiz).
the software to work. Run "check_perms -f" to make sure permissions
are correct (it still fixes a setgid problem with "mail/mailman").
Remove mm_cfg.pyc (compiled copy of mm_cfg.py) always, so the package
can be deinstalled cleanly.
Closes PR pkg/24041.
Changes:
- Close some cross-site scripting vulnerabilities in the admin pages
(CAN-2003-0965).
- New languages: Catalan, Croatian, Romanian, Slovenian.
- New mm_cfg.py/Defaults.py variable PUBLIC_MBOX which allows the site
administrator to disable public access to all the raw list mbox files
(this is not a per-list configuration).
- Expanded header filter rules under Privacy -> Spam Filters. Now you can
specify regular expression matches against any header, with specific
actions tied to those matches.
- Rework the SMTP error handling in SMTPDirect.py to avoid scoring bounces
for all recipients when a permanent error code is returned by the mail
server (e.g. because of content restrictions).
- Promoted SYNC_AFTER_WRITE to a Default.py/mm_cfg.py variable and
make it control syncing on the config.pck file. Also, we always flush
and sync message files.
- Reduce archive bloat by not storing the HTML body of Article objects in
the Pipermail database. A new script bin/rb-archfix was added to clean
up older archives.
- Proper RFC quoting for List-ID descriptions.
- PKGDIR can be passed to the make command in order to specify a different
directory to unpack the distutils packages in misc. (SF bug 784700).
- Improved logging of the origin of subscription requests.
- Misc bugfixes.
Allow for not using a CGI extension (no extension was the pkgsrc default
for the previous mailman version, and forcing to add one seems like just
a gratuitous change).
Record BUILD_DEFS. (XXX: All these should be documented, too.)
PR pkg/22820.
Changes:
- Closed a cross-site scripting exploit in the create cgi script.
- Improvements in the performance of the bounce processor.
Now, instead of processing each bounce immediately (which
can cause severe lock contention), bounce events are queued.
Every 15 minutes by default, the queued bounce events are
processed en masse, on a list-per-list basis, so that each
list only needs to be locked once.
- When some or all of a message's recipients have temporary
delivery failures, the message is moved to a "retry" queue.
This queue wakes up occasionally and moves the file back to
the outgoing queue for attempted redelivery. This should
fix most observed OutgoingRunner 100% cpu consumption,
especially for bounces to local recipients when using the
Postfix MTA.
- Optional support for fsync()'ing qfile data after writing.
Under some catastrophic system failures (e.g. power lose),
it would be possible to lose messages because the data
wasn't sync'd to disk. By setting SYNC_AFTER_WRITE to True
in Mailman/Queue/Switchboard.py, you can force Mailman to
fsync() queue files after flushing them. The benefits are
debatable for most operating environments, and you must
ensure that your Python has the os.fsync() function defined
before enabling this feature (it isn't, even on all
Unix-like operating systems).
And more... please review Changelog to see a complete list of changes.
directories too, and having both will cause the directories to be created with
the wrong owner/mode.
Thanks to Marc Recht for giving me details on this.
have it be automatically included by bsd.pkg.mk if USE_PKGINSTALL is set
to "YES". This enforces the requirement that bsd.pkg.install.mk be
included at the end of a package Makefile. Idea suggested by Julio M.
Merino Vidal <jmmv at menta.net>.
extension Makefile fragments, because they really don't have anything to
do with the buildlink[12] frameworks. Change all the Makefiles that use
application.buildlink.mk and extension.buildlink.mk to use application.mk
and extension.mk instead.
Maiman is a e-mail list manager. It includes a web interface for
management from a user (subscribe/unsuscribe) and administrator point
of view, as well as the traditionnal command-though-emails management.
It also offers web-browsable mailing-list archives.
