Skip to content

Commit 2e75130

Browse files
jaredmauchjaredmauch
committed
cgi fixes
1 parent 525db7e commit 2e75130

11 files changed

Lines changed: 23 additions & 51 deletions

File tree

‎Mailman/Cgi/admin.py‎

Lines changed: 13 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ def main():
6868
if os.environ.get('REQUEST_METHOD') == 'POST':
6969
content_length = int(os.environ.get('CONTENT_LENGTH', 0))
7070
if content_length > 0:
71-
form_data = sys.stdin.read(content_length)
71+
form_data = sys.stdin.buffer.read(content_length).decode('utf-8')
7272
cgidata = urllib.parse.parse_qs(form_data, keep_blank_values=True)
7373
else:
7474
cgidata = {}
@@ -111,47 +111,19 @@ def main():
111111
# If the user is not authenticated, we're done.
112112
try:
113113
mailman_log('debug', 'Checking authentication')
114-
if os.environ.get('REQUEST_METHOD') == 'POST':
115-
content_length = int(os.environ.get('CONTENT_LENGTH', 0))
116-
if content_length > 0:
117-
form_data = sys.stdin.buffer.read(content_length).decode('latin-1')
118-
cgidata = urllib.parse.parse_qs(form_data, keep_blank_values=True)
119-
for key in cgidata:
120-
cgidata[key] = [v.decode('latin-1') if isinstance(v, bytes) else v for v in cgidata[key]]
121-
else:
122-
cgidata = {}
114+
# CSRF check
115+
safe_params = ['VARHELP', 'adminpw', 'admlogin',
116+
'letter', 'chunk', 'findmember',
117+
'legend']
118+
params = list(cgidata.keys())
119+
if set(params) - set(safe_params):
120+
csrf_checked = csrf_check(mlist, cgidata.get('csrf_token', [''])[0],
121+
'admin')
123122
else:
124-
query_string = os.environ.get('QUERY_STRING', '')
125-
cgidata = urllib.parse.parse_qs(query_string, keep_blank_values=True)
126-
for key in cgidata:
127-
cgidata[key] = [v.decode('latin-1') if isinstance(v, bytes) else v for v in cgidata[key]]
128-
mailman_log('debug', 'cgidata before auth: %s', str(cgidata))
129-
except Exception as e:
130-
doc = Document()
131-
doc.set_language(mm_cfg.DEFAULT_SERVER_LANGUAGE)
132-
doc.AddItem(Header(2, _("Error")))
133-
doc.AddItem(Bold(_('Invalid options to CGI script.')))
134-
doc.AddItem(Preformatted(Utils.websafe(str(e))))
135-
doc.AddItem(Preformatted(Utils.websafe(traceback.format_exc())))
136-
print('Status: 400 Bad Request')
137-
print(doc.Format())
138-
mailman_log('error', 'admin: Invalid options: %s\n%s', str(e), traceback.format_exc())
139-
return
140-
# CSRF check
141-
safe_params = ['VARHELP', 'adminpw', 'admlogin',
142-
'letter', 'chunk', 'findmember',
143-
'legend']
144-
params = list(cgidata.keys())
145-
if set(params) - set(safe_params):
146-
csrf_checked = csrf_check(mlist, cgidata.get('csrf_token', [''])[0],
147-
'admin')
148-
else:
149-
csrf_checked = True
150-
if cgidata.get('adminpw', [''])[0]:
151-
os.environ['HTTP_COOKIE'] = ''
152-
csrf_checked = True
153-
try:
154-
mailman_log('debug', 'Calling WebAuthenticate')
123+
csrf_checked = True
124+
if cgidata.get('adminpw', [''])[0]:
125+
os.environ['HTTP_COOKIE'] = ''
126+
csrf_checked = True
155127
mailman_log('debug', 'Authentication contexts: %s', str((mm_cfg.AuthListAdmin, mm_cfg.AuthSiteAdmin)))
156128
mailman_log('debug', 'Password provided: %s', 'Yes' if cgidata.get('adminpw', [''])[0] else 'No')
157129
mailman_log('debug', 'Cookie present: %s', 'Yes' if os.environ.get('HTTP_COOKIE') else 'No')

‎Mailman/Cgi/admindb.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ def main():
138138
if os.environ.get('REQUEST_METHOD') == 'POST':
139139
content_length = int(os.environ.get('CONTENT_LENGTH', 0))
140140
if content_length > 0:
141-
form_data = sys.stdin.read(content_length)
141+
form_data = sys.stdin.buffer.read(content_length).decode('utf-8')
142142
cgidata = urllib.parse.parse_qs(form_data, keep_blank_values=True)
143143
else:
144144
cgidata = {}

‎Mailman/Cgi/confirm.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ def main():
7272
if os.environ.get('REQUEST_METHOD') == 'POST':
7373
content_length = int(os.environ.get('CONTENT_LENGTH', 0))
7474
if content_length > 0:
75-
form_data = sys.stdin.read(content_length)
75+
form_data = sys.stdin.buffer.read(content_length).decode('utf-8')
7676
cgidata = urllib.parse.parse_qs(form_data, keep_blank_values=True)
7777
else:
7878
cgidata = {}

‎Mailman/Cgi/create.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ def main():
4646
if os.environ.get('REQUEST_METHOD') == 'POST':
4747
content_length = int(os.environ.get('CONTENT_LENGTH', 0))
4848
if content_length > 0:
49-
form_data = sys.stdin.read(content_length)
49+
form_data = sys.stdin.buffer.read(content_length).decode('utf-8')
5050
cgidata = urllib.parse.parse_qs(form_data, keep_blank_values=True)
5151
else:
5252
cgidata = {}

‎Mailman/Cgi/edithtml.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ def _(s):
100100
if os.environ.get('REQUEST_METHOD') == 'POST':
101101
content_length = int(os.environ.get('CONTENT_LENGTH', 0))
102102
if content_length > 0:
103-
form_data = sys.stdin.read(content_length)
103+
form_data = sys.stdin.buffer.read(content_length).decode('utf-8')
104104
cgidata = urllib.parse.parse_qs(form_data, keep_blank_values=True)
105105
else:
106106
cgidata = {}

‎Mailman/Cgi/listinfo.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ def main():
6565
if os.environ.get('REQUEST_METHOD') == 'POST':
6666
content_length = int(os.environ.get('CONTENT_LENGTH', 0))
6767
if content_length > 0:
68-
form_data = sys.stdin.read(content_length)
68+
form_data = sys.stdin.buffer.read(content_length).decode('utf-8')
6969
cgidata = urllib.parse.parse_qs(form_data, keep_blank_values=True)
7070
else:
7171
cgidata = {}

‎Mailman/Cgi/options.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ def main():
106106
if os.environ.get('REQUEST_METHOD') == 'POST':
107107
content_length = int(os.environ.get('CONTENT_LENGTH', 0))
108108
if content_length > 0:
109-
form_data = sys.stdin.read(content_length)
109+
form_data = sys.stdin.buffer.read(content_length).decode('utf-8')
110110
cgidata = urllib.parse.parse_qs(form_data, keep_blank_values=True)
111111
else:
112112
cgidata = {}

‎Mailman/Cgi/private.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ def main():
120120
if os.environ.get('REQUEST_METHOD') == 'POST':
121121
content_length = int(os.environ.get('CONTENT_LENGTH', 0))
122122
if content_length > 0:
123-
form_data = sys.stdin.read(content_length)
123+
form_data = sys.stdin.buffer.read(content_length).decode('utf-8')
124124
cgidata = urllib.parse.parse_qs(form_data, keep_blank_values=True)
125125
else:
126126
cgidata = {}

‎Mailman/Cgi/rmlist.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ def main():
4444
if os.environ.get('REQUEST_METHOD') == 'POST':
4545
content_length = int(os.environ.get('CONTENT_LENGTH', 0))
4646
if content_length > 0:
47-
form_data = sys.stdin.read(content_length)
47+
form_data = sys.stdin.buffer.read(content_length).decode('utf-8')
4848
cgidata = urllib.parse.parse_qs(form_data, keep_blank_values=True)
4949
else:
5050
cgidata = {}

‎Mailman/Cgi/roster.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ def main():
6565
if os.environ.get('REQUEST_METHOD') == 'POST':
6666
content_length = int(os.environ.get('CONTENT_LENGTH', 0))
6767
if content_length > 0:
68-
form_data = sys.stdin.read(content_length)
68+
form_data = sys.stdin.buffer.read(content_length).decode('utf-8')
6969
cgidata = urllib.parse.parse_qs(form_data, keep_blank_values=True)
7070
else:
7171
cgidata = {}

0 commit comments

Comments
 (0)