Search results for "Postorius" - Mailman-users

Re: One-click unsubscribe?

by Stephen J. Turnbull

Jered Floyd writes: > > As I discovered (to my chagrin) Mailman's current simple RFC > > 2369 List-Unsubscribe field doesn't, even for personalized lists where > > there might be a personalized link in the footer. > > My understanding from up-thread is that the RFC 2369 headers are > added pre-personalization. They are. It would also be trivial to personalize them; they just aren't. > If we add a timestamp to the encrypted token I suggest there should > be a pretty broad window allowed (i.e. several months). I guess it would be a matter of keeping 2 tokens in the database. > > Safety would suggest adding a random nonce and that would need to > > be saved in the database.) > > Do you just mean a salt? Or are you suggesting adding a > per-subscription nonce stored in the DB? (In which case, that could > simply be the URI token...) Per-subscription and it would be the URI token. > I agree with your analysis, but this would be a very specialized > attack, especially if we don't provide direct feedback on if the > request was successful (which we are not required to do). I think we do need to provide feedback, at least when the request fails due to an expired token. > I have trouble constructing a practical threat here I don't know if there's a practical threat. I don't think the known plaintext attack on the key is practical if we use a key dedicated to this purpose. You'd need at least a large university's collection of tokens, and what could you do with it that would be worth the effort? The DOS attack is practical if encryption is expensive enough. But storing the token would make that a single database lookup. > and I think the encrypted tuple, or a plaintext tuple and truncated > HMAC (like how SRS works) would be sufficient. Checking the encrypted tuple is cheaper and simpler. > The real risk without a per-subscription random unique identifier > would be a replay attack -- the user is unsubscribed multiple > times? That feels outside of the threat model. The identifier has to be unique to the subscription. If there are multiple valid unsubscriptions, the later ones won't have an existing subscription to unsubscribe. That does argue for the nonce -- that would stop the attack in the case where the user resubscribes. > > And you could combine the two strategies which would allow sites that > > don't use Postorius to configure the reverse proxy, while sites that > > do would get it for "free" since we'd configure Postorius to do it. > > I hadn't considered this -- I definitely like this approach because it > means the same function need not be implemented twice, differently. OK, that's part of the design we'll start with. > guess the big question is now just what the simplest content of the URI > should be. I think there should be just an opaque token plus an optional expiration date for sites paranoid enough to have a rotation policy for the keys. We need to do some thinking about how to implement "several months validity" in case of a sudden key change. The expiration date is irrelevant to the implementation of 8058, it's just for the benefit of the user (and data collection for how old the token is, I guess). This is shaping up pretty well, I think. > The Internet is an increasingly hostile place. True enough. > Regardless, not something we can do much about. There's hope. When Yahoo! and AOL broke the Internet in 2014 by setting p=reject DMARC policies, the Ministry of Education issued "administrative guidance" that *yahoo.* addresses should not be used for school business, and my university sent them all to spam. ;-) Including yahoo.jp which did not have a p=reject policy. -- GNU Mailman consultant (installation, migration, customization) Sirius Open Source https://www.siriusopensource.com/ Software systems consulting in Europe, North America, and Japan

1 week, 1 day

Re: mailman-suite: Error 500 on Lists /setting/ pages

by Mark Sapiro

On 11/18/20 8:43 AM, ljsbw-it(a)riseup.net wrote: > I just installed Mailman3 (mailman-suite) on my Server following these instructions: https://lab.uberspace.de/guide_mailman-3.html Please see <https://wiki.list.org/x/12812344> > and everything works fine so far. I can create lists, subscribe people and send mails through lists but when I click the settings button and get redirected to /postorius/lists/listname/settings/ i get an Error 500 message. I couldn't find anything in the logs except the uwsgi log: > [pid: 20568|app: 0|req: 62/62] 100.64.115.1 () {48 vars in 1052 bytes} [Wed Nov 18 16:27:59 2020] GET /postorius/lists/listname/settings/ => generated 1102 bytes in 1438 msecs (HTTP/1.1 500) 6 headers in 209 bytes (1 switches on core 0) I think that uwsgi log message just refers to the delivery of the error page to your browser. What other logs are you looking at? There should be something in Mailman core's mailman.log or the Django log whose location is defined in settings(-local).py, probably mailman-suite/logs/mailmansuite.log. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

5 years

Re: Module Not Found Error after update

by Abhilash Raj

On Thu, Feb 4, 2021, at 8:52 AM, Brian Carpenter wrote: > > On 2/4/21 11:46 AM, Mark Sapiro wrote: > > You need django-mailman3 1.3.5 > > > > > > While all are not required in this case, when you upgrade like this with > > pip, you should upgrade all of django-mailman3, hyperkitty, mailman, > > mailmanclient, mailman-hyperkitty and postorius. > > Thanks Mark. Perhaps Abhilash can include that in the instructions on > the following page for future releases: > > https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/thread/… I was hoping pip would actually upgrade django-mailman3 given that P requires ‘django-mailman3>=1.3.5’ [1] but looks like it didn’t :( [1]: https://gitlab.com/mailman/postorius/-/blob/master/setup.py#L56 > I will make a note of this in my own personal documentation and the > Debian 10 How-to guide that I am currently working on. > > -- > Brian Carpenter > Harmonylists.com > Emwd.com > _______________________________________________ > Mailman-users mailing list -- mailman-users(a)mailman3.org > To unsubscribe send an email to mailman-users-leave(a)mailman3.org > https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/ > -- thanks, Abhilash Raj (maxking)

4 years, 10 months

Could not locate column in row for column 'user.id'

by Shashikanth Komandoor

Hi Team, I am currently running Mailman 3 with version 3.3.1 and in built postfix version 2.10.1-6 on RHEL 7.5 in production environment from the past 2 months almost. From the past few days, I found my server is responding to the users very slowly and throwing the Server Error page (of course getting the required page after multiple refreshes) for almost every click on the postorius pages (not yet observed on hyperkitty front end which in fact is not so important for me as of now). During that time, I observed in the mailman.log an error message saying "Could not locate column in row for column 'user.id'". The complete traceback log is attached with the mail. The error message is generated for almost all the lists and all the clicks. And despite this error message, I don't know how the required page is loaded after a few refreshes of the webpage. I don't know how to resolve this issue. Please advise. Also, please let me know if anything I need to share with you. -- Thanks & Regards, Shashi Kanth.K 9052671936

5 years, 4 months

Re: Mailman 3 installation documentation

by Terri Oda

Hurrah! I'm very excited about these updates. :) On October 6, 2019 8:17:15 p.m. PDT, Abhilash Raj <maxking(a)asynchronous.in> wrote: >Hi All, > >I have been trying to work on revamping the documentation site we have >at https://docs.mailman3.org. It is on https:// but I am not sure why >the http->https redirect doesn't work in Readthedocs. I have set it to >"serve always from https". > >Anyway, it might not look too different right now, but there are some >small re-organizations. I have been learning some new ReST and Sphinx >tricks and been trying to cross-reference and link various sections and >settings. The docs site shows up Mailman's logo now (I didn't even know >we could do that ;-). > >There is a place[1] for all supported Django settings that Postorius >and Hyperkitty have. I am also planning to add some common Django >settings that often people have to lookup and is not fun for people >from non-python backgrounds. Hopefully, it will make lives easier for >administrators. > >I have reverted my own stupid decision to use "sudo pip3 install" in >the docs to instead use virtualenv. The installation docs are going to >grow to be more comprehensive. > >I am also working on mailman-web project[3], which should simply >installation process for all the web components using a single project >and provide better guidance on Django's settings file management and >howto run manage.py commands. > >I have added a `mailman-web` command, which, for those of you familiar >with internal details of Django, is going to be our custom manage.py >script. It sets up settings correctly and would hopefully reduce the >pain of using `django-admin` and/or finding out the right path for >`manage.py` script. It is still not ready for prime time, but it is >usable. Early adopters can play with it if they like! > > >I would really appreciate if people who have tried to manually install >Mailman 3 in the past would share their experiences about what they >think could be documented better. You can reply here or open an >issue[2]. > >The user documentation are going to follow, hopefully soon :) > > >[1]: >https://docs.mailman3.org/en/latest/config-web.html#configure-postorius-hyp… >[2]: https://gitlab.com/mailman/mailman-suite-doc/issues >[3]: https://gitlab.com/mailman/mailman-web > >-- > thanks, > Abhilash Raj (maxking) >_______________________________________________ >Mailman-users mailing list -- mailman-users(a)mailman3.org >To unsubscribe send an email to mailman-users-leave(a)mailman3.org >https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/

6 years, 2 months

Re: very few moderation capabilities for moderators

by Guillermo Hernandez (Oldno7)

On 16/9/21 16:40, Mark Sapiro wrote: > On 9/16/21 2:39 AM, Guillermo Hernandez (Oldno7) via Mailman-users wrote: >> Hi all: >> >> I need to provide the list moderators a way to change the moderation >> flag for users from whichever it is (normally "list default >> processing") to "hold for moderation" and viceversa (to "list >> default" or to "accept") >> >> I understand that it could be done via console script (That's the way >> I did on mailman2: I made two commands using "withlist", one to hold, >> moderar.py, and other one to accept, desmoderar.py. I show you below) > > > Are you asking what the equivalent MM 3 scripts would be? > More or less: I'm asking for a general direction here. I think I cannot use tthe "withlist" method as before, inside a python script, and I'm not sure how to do it. I've been reviewing all the command docs that I've found, but I have no clear way. I need a shell or a python script that I can pass the list and the mail address to put on hold/hold (that way the moderators can log in a special account thhat asks for the address to hold/unhold). I did it in mailman2 whith the bin/withlist command, but now whithlist seems to be an alias for shell and is interactive.Thats not my goal) > >> But I think I'm not the only one that could use as an improvement a >> way to do this on postorius/web. > > > Postorius allows a list owner or site admin to set Moderation for list > members and non members at e.g. > https://www.example.com/mailman3/lists/list.example.com/members/(non)member/. Yes, I know that. But the owner cannot be 24/7 attending the lists (as we all know), and could need a help hand from moderators. Not just from accepting mails on hold, but to put on hold a member (and be capable of reversing it) when the netiquete dissapears completely and some thread becomes a flame and all goes south. I'ts the admin capability I miss the most for moderators in mailman. > Currently, a list moderator who is not an owner cannot do this, but a > moderator can set Moderation for the sender of a held post when > handling the post. But I'm talking about a moderator can put a member mails in hold when it is marked to accept. To prevent putting more gas in the fire. > >

4 years, 2 months

Modify approval email

by Stephen J. Turnbull

pau.baiges(a)csuc.cat writes: > Is there a way to modify the email that is sent by default to list > owners when a non-list member sends email to the list? Yes. As list owner (or site admin) in Postorius go to Templates, and click on "New Template". Select list:admin:action:post from the drop-down menu to the right of "Name". Copy the current message (site-packages/mailman/templates/en/list:admin:action:post.txt is the original, but do not edit this -- it will be overwritten on upgrades) to the text box and edit to taste. Unfortunately there is no "web site" variable but typically that is the same for all lists, so adding https://your.host.here/mailman3/lists/$list_id/held_messages in some appropriate place probably does what you want. There is no way to indicate that this is a link because these messages are plain text. However, most mail clients will turn a URL into a link. If your moderators are not so lucky, try wrapping it with <URL:https://your.host.here/mailman3/lists/$list_id/held_messages> or even the usual HTML: <a href="https://your.host.here/mailman3/lists/$list_id/held_messages"> Moderation Page </a> One of those may help. Steve

2 years, 2 months

Re: Issue with Held Messages

by Mark Sapiro

On 08/17/2016 09:17 PM, Jean-Luc Wasmer wrote: > > No matter what action I set for member posts (Hold for moderator, > Reject) they are always delivered. I don't know why this would be. Perhaps the member's moderation is set to Accept immediately - you can see this on ther member's options page in Postorius when logged in as a list owner. When the message is delivered, what are the X-Mailman-Rule-Hits: and X-Mailman-Rule-Misses: headers? > When I tried from a non-member email address, the message got held but > when I try to see it I get a Server Error (500) page. The log files shows: > > ERROR 2016-08-18 01:04:30,231 base 21026 34722993152 Internal Server > Error: /mailman3/lists/test.mydomain.com/held_messages > Traceback (most recent call last): ... > File > "/usr/local/mailman/mailman-bundler/eggs/mailmanclient-1.0.1-py2.7.egg/mailmanclient/_client.py", > line 443, in held > moderation_reasons=entry['moderation_reasons'], > KeyError: u'moderation_reasons' This is apparently <https://gitlab.com/mailman/mailmanclient/issues/10> fixed by <https://gitlab.com/mailman/mailmanclient/merge_requests/16> -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

9 years, 3 months

Unable to download attachments from HyperKitty

by Derek Lambert

I’m having an issue downloading attachments from HyperKitty. The download begins as expected, but never progresses. Eventually it times out. I imagine the browser is expecting data matching the content-length header, but never receives it. Inspecting the contents of the download file reveals (address varies): <memory at 0x7f148fcb9588> I’ve been able to work around the issue with the following patch: --- env/lib/python3.7/site-packages/hyperkitty/models/email.py.orig 2018-12-06 21:38:39.544448735 +0000 +++ env/lib/python3.7/site-packages/hyperkitty/models/email.py 2018-12-06 23:01:39.923239421 +0000 @@ -309,7 +309,7 @@ def get_content(self): folder = self._get_folder() if folder is None: - return self.content + return self.content.tobytes() filepath = os.path.join(folder, str(self.counter)) if not os.path.exists(filepath): logger.error("Could not find local attachment %s for email %s", I haven't been able to replicate the issue with the HyperKitty tests, presumably the issue is somewhere in the Django <-> uwsgi <-> nginx stack. My configs are based on mailman-suite and maxking/docker-mailman. I've tried stripping out all the performance tweaks from my uwsgi and nginx configs, but no change. Versions: HyperKitty 1.2.1 Postorius 1.2.3 Django 2.1.7 nginx 1.14.1 uwsgi 2.0.18 Python 3.7.2 Has anyone come across this before? Derek Lambert

6 years, 9 months

Re: How to store additional information about lists?

by Stephen J. Turnbull

Andreas Barth writes: > public: anyone can subscribe and read the archive. This is already possible, more or less the default list configuration. "Subscribe and read archive" involves multiple separate list attributes, enforced by three separate applications. Subscription policy is controlled by whether you need approval of an admin or not, and whether you need to verify your email or not, plus the ban lists. Archive access (assuming you have one at all) is contrlled by a different list attribute, archive_policy. Core has final say on subscriptions, but Postorius could do it if email subscriptions are disabled. HyperKitty handles the archive permissions. These various aspects are currently quite loosely coupled. > restricted: for employees (or members - or whatever) only. So they > could subscribe themself. The archive and posting may be restricted > to subscribers or to anyone in that group - both would be working > for me. I think this can be implemented with the controls we already have. The basic idea is to handle the "anyone in that group" case by mass subscribing and setting the subscription to no-mail. Obviously, this is most practical with a fairly static membership (eg, students at a school). A fluid membership (for example, a volunteer organization) would be made easier to manage with a "member adapter" to an external database to handle the "do I know this person" questions. ("Member adapter" is Mailman 2 terminology, I don't know if it's exactly the same in Mailman 3; it does or *should* exist in Mailman 3, though.) It's possible that we could make this easier to configure with some changes to core. However, if this is as close to what you need as I think it is, I would advise against vendoring Mailman, and instead writing some scripts to help manage mass subscription, or create the member adapter. > (How to know who is allowed to subscribe is another question - having > an internal mailing list which contains all the members just for this > purpose would be ok for me.) That's helpful to know. This sounds very similar to the Systers approach, where the Mailman core User database is the authoritative membership database for the organization. > private: hand-selected people, think about e.g. board or steering > committees internal discussions. Of course, the archive (if there is > any) should be restricted to the actual members. Posting to these > lists is currently not restricted, so no derivation needed from the > current set in postorius. This is already possible by requiring admin approval, or by setting the ban list to something that matches everything like "^.".

4 years, 6 months

Mailman-users search results for query "Postorius"