svn commit: r534109 - in branches/2020Q2/mail/mailman: . files

[Matthias Andree]

Author: mandree
Date: Tue May  5 22:57:42 2020
New Revision: 534109
URL: https://svnweb.freebsd.org/changeset/ports/534109

Log:
  2020Q2 specific mail/mailman minimal security fix
  
  Backporting 2.1.31 needs more consideration and more than just MFH r534101,
  so forgo that and for the nonce, plug this information leak quickly with the
  one-line fix by upstream, and hack additional translations to match into the
  .po files with REINPLACE_CMD.
  
  Approved by:	ports-secteam@ (blanket, trivial security fix)
  Security:	88760f4d-8ef7-11ea-a66d-4b2ef158be83

Added:
  branches/2020Q2/mail/mailman/files/patch-0-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83   (contents, props changed)
Modified:
  branches/2020Q2/mail/mailman/Makefile

Modified: branches/2020Q2/mail/mailman/Makefile
==============================================================================
--- branches/2020Q2/mail/mailman/Makefile	Tue May  5 22:55:43 2020	(r534108)
+++ branches/2020Q2/mail/mailman/Makefile	Tue May  5 22:57:42 2020	(r534109)
@@ -3,7 +3,7 @@
 
 PORTNAME=	mailman
 DISTVERSION=	2.1.30
-PORTREVISION=	0
+PORTREVISION=	3
 CATEGORIES=	mail
 MASTER_SITES=	GNU \
 		SF/${PORTNAME}/Mailman%202.1%20%28stable%29/${PORTVERSION} \
@@ -178,6 +178,11 @@ post-patch:
 	${REINPLACE_CMD} -e 's/messages//' ${WRKSRC}/Makefile.in
 .endif
 	${MV} ${WRKSRC}/configure.in ${WRKSRC}/configure.ac # suppress warning
+	# Fix up translations for patch-0-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83.
+	# Note it's not just search & replace, the pattern needs to be unedited for
+	# admin.py and edited for options.py.
+	${REINPLACE_CMD} -Ee '/Illegal Email Address: %\(safeuser\)/,+1H;$${p;x;s/ *. %\(safeuser\)s//g;}' \
+		${WRKSRC}/messages/*/LC_MESSAGES/mailman.po
 
 # post-patch-HTDIG-on is to fix https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=238508
 post-patch-HTDIG-on:

Added: branches/2020Q2/mail/mailman/files/patch-0-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ branches/2020Q2/mail/mailman/files/patch-0-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83	Tue May  5 22:57:42 2020	(r534109)
@@ -0,0 +1,17 @@
+This is to fix vulnerability 88760f4d-8ef7-11ea-a66d-4b2ef158be83,
+and was provided by Mark Sapiro, the upstream maintainer.
+
+Source: https://bugs.launchpad.net/mailman/+bug/1873722
+
+--- Mailman/Cgi/options.py	2019-03-06 17:48:32 +0000
++++ Mailman/Cgi/options.py	2020-04-20 03:10:16 +0000
+@@ -173,7 +173,7 @@
+     try:
+         Utils.ValidateEmail(user)
+     except Errors.EmailAddressError:
+-        doc.addError(_('Illegal Email Address: %(safeuser)s'))
++        doc.addError(_('Illegal Email Address'))
+         loginpage(mlist, doc, None, language)
+         print doc.Format()
+         return
+