[Mailman-Developers] email address validation

[Barry Warsaw]

On Fri, 2003-06-06 at 12:55, Hubbard, Matthew R W wrote:
> Dear All,
> 
> I had a quick search and couldn't find much about this. I'm using Mailman
> 2.1.2.
> 
> I've been looking through the add member code, specifically the
> InviteNewMember, AddMember and ApprovedAddMember functions.
> 
> It has struck me as odd that there is a lot more effort in validating email
> addresses in the AddMember function than in the ApprovedAddMember and the
> InviteNewMember doesn't even call Utils.ValidateEmail.

The latter is a bug.  Note that InviteNewMember is (currently) only
called through the admin pages, so it's primary effect should be to
prevent bogus addresses from getting into the pending database.  Note
though that any bogus address wouldn't be confirmable so it should never
get into the real member database.  Certainly the code in
change_options() in admin.py expects ValidateEmail() to be called.  I'll
check in a fix for that.

> Could / should this be consolidated in some fashion? I don't especially
> trust a vast list of address supplied by an administrator anymore than a
> user filling in the subscribe form.

The intent of ApprovedAddMember() is to really add the address after
it's been approved and validated.  But note that it does call
Utils.ValidateEmail() which ought to be the sole interface to email
address validation.

-Barry