[Mailman-Users] Posting-Filter is broken in 1.1 !?

[Ted Cabeen]

In message <200001061532.PAA02605 at wivenhoe.demon.co.uk>, Chris Fox writes:
>On Mon, 03 Jan 2000 09:08:17 PST, J C Lawrence wrote:
>>On Mon, 3 Jan 2000 10:30:03 +0100 
>>Aaron Optimizer Digulla <digulla at hepe.com> wrote:
>>> 2. Some posts are held because Mailman uses the "Sender:" header
>>> item added by Netscape (Mailman should ignore it).
>>
>>MailMan pays no attention to the Sender: header.  It does by default
>>read the message envelope and does ignore the From: header however,
>
>I also experience the reported problem, and requested help on this 
>list--subject: How to make Mailman more trusting of subscriber 
>supplied addresses--with no response (at least, none that reached 
>me).  This is with USE_ENVELOPE_SENDER = 0, and it even when faking 
>the envelope from by piping through formail.  At times, Mailman seems 
>to behave as if it uses the return-path: header.

Since Barry doesn't seem to be around to respond to this, I'm going to 
attempt an answer.  The relevant code that you're looking for is in 
Message.py at line 110 where Mailman checks the sender then the from:
def GetSender(self):
        # Look for a Sender field.
        sender = self.getheader('sender')
        if sender: 
            realname, mail_address = self.getaddr('sender')
        else:
            try:
                realname, mail_address = self.getaddr('from')
            except:
                real_name = mail_address = None

Switching the sender and the from will check the From address first, then the 
sender.  Here's a patch to do so.  To use it, patch the two files and set 
USE_FROM_FIRST to 1 in your mm_cfg.py

*** Message.py  Sun Nov  7 10:48:54 1999
--- Message.py.new      Thu Jan  6 10:42:50 2000
***************
*** 104,118 ****
        return self.file_data[self.file_count-1] + '\n'
  
      def GetSender(self):
!       # Look for a Sender field.
!       sender = self.getheader('sender')
!       if sender:
!           realname, mail_address = self.getaddr('sender')
!       else:
            try:
!               realname, mail_address = self.getaddr('from')
!           except:
                  real_name = mail_address = None
  
          # We can't trust that any of the headers really contained an address
          if mail_address and type(mail_address) == type(""):
--- 104,127 ----
        return self.file_data[self.file_count-1] + '\n'
  
      def GetSender(self):
!       if mm_cfg.USE_FROM_FIRST:
            try:
!               realname, mail_address = self.getaddr('from')
!             except:
                  real_name = mail_address = None
+                 sender = self.getheader('sender')
+                 if sender:
+                     realname, mail_address = self.getaddr('sender')
+         else:
+           # Look for a Sender field.
+           sender = self.getheader('sender')
+           if sender:
+               realname, mail_address = self.getaddr('sender')
+           else:
+               try:
+                  realname, mail_address = self.getaddr('from')
+               except:
+                     real_name = mail_address = None
  
          # We can't trust that any of the headers really contained an address
          if mail_address and type(mail_address) == type(""):
*** Defaults.py Sun Nov  7 10:48:51 1999
--- Defaults.py.new     Thu Jan  6 10:45:11 2000
***************
*** 120,125 ****
--- 120,128 ----
  # spoofed messages may get through.
  USE_ENVELOPE_SENDER = 0
  
+ # When true, mailman will check the from field before it checks the sender
+ # field, as sender is not set correctly by a number of MUAs
+ USE_FROM_FIRST = 0
  # When true, mailman will consider user at host.domain to be the same address
  # as user at domain.  If set to 0, mailman will consider user at host.domain to 
  # be the same address as user at Host.DoMain, but different than user at domain.


--
Ted Cabeen           http://www.pobox.com/~secabeen         secabeen at pobox.com
Check Website or finger for PGP Public Key        secabeen at midway.uchicago.edu
"I have taken all knowledge to be my province." -F. Bacon   cococabeen at aol.com
"Human kind cannot bear very much reality."-T.S.Eliot 73126.626 at compuserve.com