July 2022 - Mailman-users - lists.mailman3.org

invalid parameter response of the rest-api
by Jacob Sievert Sept. 22, 2022

Sept. 22, 2022

Hello, Since a few days we get an error response from our automated membership script. We use the following code to control the membership for some lists: ``` def mailinglist_manage(list_address, members): """ make sure all 'members' are present on the list and no remove everyone else list_address : mail address of mailing list to manage addresses : mail address that are supposed to be on the list """ print("[*] update subscriptions for {}".format(list_address)) ml = mmc.get_list(list_address) # make sure we dont spam users ml.settings['send_welcome_message'] = False ml.settings.save() addresses = set(members.keys()) ml_members = ml.members ml_addresses = set((x.address.__str__() for x in ml_members)) for addr in ml_addresses - addresses: print("unsubscribe {} from {}".format(addr, list_address)) ml.unsubscribe(addr) for addr in addresses - ml_addresses: print("subscribe {} to {}".format(addr, list_address)) ml.subscribe(addr, members[addr], pre_verified=True, pre_confirmed=True, pre_approved=True) ``` Since Tuesday without any update performed by us we get the following error from the script when it's running: ``` Traceback (most recent call last): File "./mail_user_control.py", line 423, in <module> mailinglist_manage("XXX(a)EXAMPLE.COM", members) File "./mail_user_control.py", line 412, in mailinglist_manage pre_verified=True, pre_confirmed=True, pre_approved=True) File "/root/.local/lib/python3.6/site-packages/mailmanclient/restobjects/mailinglist.py", line 339, in subscribe response, content = self._connection.call('members', data) File "/root/.local/lib/python3.6/site-packages/mailmanclient/restbase/connection.py", line 112, in call error_msg, response, None) urllib.error.HTTPError: HTTP Error 400: Invalid Parameter "subscriber": . ``` If you have an idea why that code now returns this. I would be thankful. regards Jacob Sievert

4 7

Message-Footer after migrating to Mailman3
by christopher.claus＠tgcamberg1848.de Sept. 13, 2022

Sept. 13, 2022

Hello together, I migrated a number of lists from mailman2 to mailman3 using the import functionality. Everthing works fine and the new lists are in use. Currently I´m using the maxking-docker-images with postorius: Mailman Core Version GNU Mailman 3.3.3 (Tom Sawyer) Mailman Core API Version 3.1 Mailman Core Python Version 3.8.5 (default, Feb 19 2021, 09:27:16) [GCC 9.3.0] After this migration I started a refactoring with the list-styles specially with message-footers. Already the old lists in mailman2 were confused in some configuration details an I was clear to import this "misconfiguration" and clean it up afterwards. But this was much more difficult than expected: some lists are using a footer (from the mailman2-config) and there is no record in the template-section visible. Further I found no configuration item which points to this "old" footer. I found the file [code] /usr/lib/python3.8/site-packages/mailman/templates/de/list:member:generic:footer.txt [/code] which includes the old footer: [code] _______________________________________________ $display_name Mailingliste -- $listname Zur Abmeldung von dieser Mailingliste senden Sie eine Nachricht an ${short_listname}-leave@${domain} [/code] but no configuration item to disable this behaviour. I created a new template list:member:regular:footer for the list to override the footer. But the old footer is still used - in detail: the resulting message sent to all subcribers of the list contains only the footer and the content sent to the list is an attachement of that "footer-message". This is the basic reason why I want to change it. In the logfiles I found an error and a warning: [code] ERROR 2021-05-24 16:22:22,895 1648 django.security.DisallowedHost Invalid HTTP_HOST header: 'tgc_mailman_web:8000'. The domain name provided is not valid according to RFC 1034/1035. WARNING 2021-05-24 16:22:22,896 1648 django.request Bad Request: /postorius/api/templates/list/homepage.gruppe.tgcamberg1848.de/list:member:regular:footer [/code] Obviously I have a problem with the hostname. I set [code] POSTORIUS_TEMPLATE_BASE_URL=http://tgc_mailman_web:8000 [/code] where tgc_mailman_web is my container name. This URL ist stored in the DB-table "template" for the name=list:member:regular:footer. A call to my fqdn or to localhost [code] wget http://localhost:8000/postorius/api/templates/list/homepage.gruppe.tgcamber… [/code] will return the footer itself - this works fine. Therefore, should i set POSTORIUS_TEMPLATE_BASE_URL to http://localhost:8000? I think, resolving this issue will use the newly configured footer. But I started with the intention to remove alle footers due to the attachement situation described above. Does anybody have an idea how to change the configuration of my list? Are these problems probably related to the import? Currently we are using more then 25 lists with a lot of users. Manually recreating all lists is not possible an could only be a test for a single list. Best regards, chrclaus

6 18

FYI: Django security releases issued: 4.0.6 and 3.2.14
by Guillermo Hernandez (Oldno7) Aug. 29, 2022

Aug. 29, 2022

https://www.djangoproject.com/weblog/2022/jul/04/security-releases/ Django security releases issued: 4.0.6 and 3.2.14 Posted by *Mariusz Felisiak* on Julio 4, 2022 In accordance with our security release policy <https://docs.djangoproject.com/en/dev/internals/security/>, the Django team is issuing Django 4.0.6 <https://docs.djangoproject.com/en/dev/releases/4.0.6/> and Django 3.2.14 <https://docs.djangoproject.com/en/dev/releases/3.2.14/>. These release addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2022-34265: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments Trunc() and Extract() database functions were subject to SQL injection if untrusted data was used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected. This security release mitigates the issue, but we have identified improvements to the Database API methods related to date extract and truncate that would be beneficial to add to Django 4.1 before it's final release. This will impact 3rd party database backends using Django 4.1 release candidate 1 or newer, until they are able to update to the API changes. We apologize for the inconvenience. Thanks Takuto Yoshikai (Aeye Security Lab) for the report. This issue has severity "high" according to the Django security policy. -- ___________________________________________ Mailman's content filtering has removed the following MIME parts from this message. Content-Type: image/png Name: firma-GHP-emails.png Replaced multipart/alternative part with first alternative.

5 18

Using REST with CLI using curl .... help needed
by Krešimir Mihalj Aug. 27, 2022

Aug. 27, 2022

Hi ! I need simple add/delete member to list using rest ..... but all documentation is for python and not helpfull for me, .... and I need these in CLI using curl command .... To add member using CLI i tried this command: curl -d "{'list_id' : 'list.domain.com', 'subscriber' : 'user(a)email.com'}" -H 'Content-Type: application/json' --user restadmin:restpass http://localhost:8001/3.0/members and I got this response: Missing parameters: list_id, subscriber What is wrong in above command here ? ..... I need to add user: user(a)email.com to list: list(a)domain.com Also, if someone is willing to give example: delete user: user(a)email.com from list: list(a)domain.com I actually create PHP application .... but CLI example is easy to reproduce in PHP function AddUserToList($user,$lista) { $url = 'http://llocalhost:8001/3.0'; $request_url = $url . '/members'; $data = array("list_id" => $lista,"subscriber" => $user ); $postdata = json_encode($data); $ch = curl_init($request_url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_USERPWD, "restadmin:restpass"); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json')); $result = curl_exec($ch); curl_close($ch); print_r ($result); } AddUserToList('user(a)email.com','list.domain.com');

6 8

Mailman 3 questions (purge archives, list metrics, and auto discard held messages)
by bob B Aug. 2, 2022

Aug. 2, 2022

Some quick mailman3 questions --Just wanted to check that there is still no way for mailman3 to automatically purge archived emails after a set amount of time? it looks like you have to export the database, purge the messages, then re-import, is this still the only/best way to purge old archived messages? --I noticed on the list info page you have metrics, which is straightforward except for "volume" My volume number is not increasing? What is that counting exactly? --Is there any way to auto discard held messages after x amount of time? I assume not but had a user ask if that was an option. Thanks for the assistance in advance.

3 4

Programmatic Creation of Users
by jciesla＠techsupportme.com July 30, 2022

July 30, 2022

I am returning to Mailman after being away for a LONG time and I need to create 40 lists with ~350 subscribers spread across those lists. After a lot of testing I am now able to create users from the Core Shell and set (most of) the necessary values. Having jumped that hurdle I have hit a roadblock and I am hoping that the list can provide some insight and/or solutions. After a lot of research I now understand that what I am doing in the Core Shell is creating a User entity which has one or more email addresses as well as one or more roles and preferences that exist at the global level. This user entity can Subscribe to zero or more lists. If I am incorrect in the summation please let me know! Assuming that the previous information is correct that brings us to my current dilemma. Specifically, the User entity can Subscribe and interact with lists using the email commands, but they can't Login using the Postorius web interface. If I understand correctly the reason that they can't login is that the underlying Django system does not recognize their account because the account that was created in Core isn't accessible by Django. Instead the user needs to create a Django-specific account at which point the information from Core becomes available in the user's web UI. If that is in fact accurate then I want to take the next logical leap: is it possible to programmatically create an account in Django that is tied to the account that was created in Core? Any information is greatly appreciated! -John

2 1

User display name entry field input ignored
by Christian July 27, 2022

July 27, 2022

Whether I try and add users using mass subscribe, or individually, it seems the display name field entry is ignored. The default is then "none" for the user. Please advise. Thank you!

2 3

Shorted Subjects in Mailman
by Stephan Krinetzki July 27, 2022

July 27, 2022

Hello all, We have been experiencing the following problem lately: When a user sends a mail with an unusually long subject to a mailing list, this subject is shortened. Here are the two examples: Original subject: "[SAV-LINUX] Notice from Sophos Anti-Virus on lx1bcms-storage.physik.rwth-aachen.de" (82 characters long) Subject in Mailman: "[edv-support][SAV-LINUX] Notice from Sophos Anti-Virus on" (57 characters long) Is there a rule that Mailman truncates the subject or why does this happen? Is there any way to work around this? In the Mailman Topic Header, however, the full subject is always readable. Translated with www.DeepL.com/Translator (free version)

4 13

Problem replying via Hyperkitty
by Jeff July 27, 2022

July 27, 2022

Hello Everyone, A few of my users read our mailing list through Hyperkitty. Whenever they reply through the web, their replies simply disappear. One example from today was logged as follows: [pid: 2287|app: 0|req: 116007/153551] xxx.xx.xx.xx () {72 vars in 1992 bytes} [Thu Jun 30 11:26:16 2022] POST /archives/list/listname(a)domainname.org/message/46WUOPZITVMKJN4TXR6CP3WMFUEAVJKD/reply => generated 3213 bytes in 70 msecs (HTTP/1.1 200) 6 headers in 188 bytes (3 switches on core 0) A couple of basic questions: 1) when a users replies in this manner, does their response go to the list or to the subscriber to whom they are replying? 2) what log files could I check to see what — if anything — happens to these emails? 3) Are there any settings that need to be set to make this work? Thanks much. Any help will be appreciated. Jeff

2 3

Apache Configuration for Subdomain
by Mail Person July 26, 2022

July 26, 2022

I'm trying to move my mailman3 web interface from example.com/mailman3 to just lists.example.com like this site. I am not having luck with the apache configuration. I've tried below but I just get a 403: <VirtualHost *:80> ServerAdmin admin(a)example.com ServerName lists.example.com ServerAlias www.lists.example.com <Directory "/var/lib/mailman3/web/static"> Require all granted </Directory> <IfModule mod_proxy_uwsgi.c> ProxyPass /favicon.ico ! ProxyPass /static ! ProxyPass / unix:/run/mailman3-web/uwsgi.sock|uwsgi://localhost </IfModule> </VirtualHost> Alias /favicon.ico /var/lib/mailman3/web/static/postorius/img/favicon.ico Alias /static /var/lib/mailman3/web/static

3 9