[Mailman-Users] Bad Confirmation String to cancel Message that was too large.

[Mark Sapiro]

On 04/03/2017 07:18 AM, Bryan Carbonnell wrote:
> 
> too big, and when they click the link to cancel the post, the link
> returns a page with a "Bad Confirmation String" error.
> 
> The latest was this morning. A user sent an email that was too big,
> and almost immediately click the link in the email they received and
> got the bad confirmation string.
> 
> I tried sending a large email to test and the confirmation string worked for me.
> 
> Looking in the vette log, I can see where the email was held, but I'm
> not sure where the confirmation string is coming from. This is the
> entry:
> 
> Apr 03 04:42:48 2017 (548) dba-OT post from USER at gmail.com held,
> message-id=<CAEkqQpXMAvPkOXK-3O1Y16CFF8cVVs-Ry850nYBpcy73U2nsxA at mail.gmail.com>:
> Message body is too big: 27563 bytes with a limit of 20 KB
> 
> The confirmation string from the email is:
> 93321f4b6ef46ce0148f5da147bda4c02a63f5c7


The confirmation string is the token in the pending database for the
entry for this held message. There is a script at
<https://www.msapiro.net/scripts/list_pending> (mirrored at
<https://fog.ccsf.edu/~msapiro/scripts/list_pending>) that can be used
to dump the pending database.


> Any ideas what to look at next to try and figure out why this is happening?
> 
> This isn't the first time that users have reported that the
> confirmation strings didn't work.


One possibility is the user's MUA which is rendering the confirmation
URL as 'clickable' is not linking to the correct URL.

E.g. a url like

http://example.net/mailman/confirm/list1/dc2cf48d519423a7ff9d96d138317fb4a57be2cd

might get folded so when clicked, it actually goes to something like

http://example.net/mailman/confirm/list1/dc2cf48d519423a7ff9d96d138317f

One thing to check is when the user gets the

Bad confirmation string
Invalid confirmation string: ...

response that the string is actually the exact 40 character string from
the email. What happens if the user clicks "re-enter" in the "Otherwise,
re-enter your confirmation string." line and enters the exact 40
character string from the email?

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan