revision bump to resolve 77524

(Portage version: 2.0.51-r12)

2 files changed, 74 insertions, 0 deletions

diff --git a/net-mail/mailman/files/digest-mailman-2.1.5-r3 b/net-mail/mailman/files/digest-mailman-2.1.5-r3
new file mode 100644
index 000000000000..1e43ecb04e52
--- /dev/null
+++ b/net-mail/mailman/files/digest-mailman-2.1.5-r3
@@ -0,0 +1 @@
+MD5 f5f56f04747cd4aff67427e7a45631af mailman-2.1.5.tgz 5745912
diff --git a/net-mail/mailman/files/mailman-2.1.5-driver.cvs.patch b/net-mail/mailman/files/mailman-2.1.5-driver.cvs.patch
new file mode 100644
index 000000000000..0e286f9e351c
--- /dev/null
+++ b/net-mail/mailman/files/mailman-2.1.5-driver.cvs.patch
@@ -0,0 +1,73 @@
+--- scripts/driver.orig	2003-04-19 21:52:55.000000000 -0700
++++ scripts/driver	2005-01-13 20:45:30.432695194 -0800
+@@ -1,6 +1,6 @@
+ # -*- python -*-
+ 
+-# Copyright (C) 1998-2003 by the Free Software Foundation, Inc.
++# Copyright (C) 1998-2004 by the Free Software Foundation, Inc.
+ #
+ # This program is free software; you can redistribute it and/or
+ # modify it under the terms of the GNU General Public License
+@@ -28,7 +28,11 @@
+ # comfortable with.  By setting STEALTH_MODE to 1, you disable the printing of
+ # this information to the web pages.  This information is still, and always,
+ # printed in the error logs.
+-STEALTH_MODE = 0
++STEALTH_MODE = 1
++
++# This will be set to the entity escaper.
++def websafe(s):
++    return s
+ 
+ 
+ 
+@@ -53,12 +57,22 @@
+ 
+ 
+ def run_main():
++    global STEALTH_MODE, websafe
++
+     # These will ensure that even if something between now and the
+     # creation of the real logger below fails, we can still get
+     # *something* meaningful.
+     logger = None
+     try:
+         import paths
++        # When running in non-stealth mode, we need to escape entities,
++        # otherwise we're vulnerable to cross-site scripting attacks.
++        try:
++            if not STEALTH_MODE:
++                from Mailman.Utils import websafe
++        except:
++            STEALTH_MODE = 1
++            raise
+         # Map stderr to a logger, if possible.
+         from Mailman.Logging.StampedLogger import StampedLogger
+         logger = StampedLogger('error',
+@@ -140,11 +154,13 @@
+ a description of what happened.  Thanks!
+ 
+ <h4>Traceback:</h4><p><pre>'''
++        exc_info = sys.exc_info()
+         if traceback:
+-            traceback.print_exc(file=sys.stdout)
++            for line in traceback.format_exception(*exc_info):
++                print websafe(line),
+         else:
+             print '[failed to import module traceback]'
+-            print '[exc: %s, var: %s]' % sys.exc_info()[0:2]
++            print '[exc: %s, var: %s]' % [websafe(x) for x in exc_info[0:2]]
+         print '\n\n</pre></body>'
+     else:
+         print '''<p>Please inform the webmaster for this site of this
+@@ -212,7 +228,9 @@
+ '''
+         if os:
+             for k, v in os.environ.items():
+-                print '<tr><td><tt>', k, '</tt></td><td>', v, '</td></tr>'
++                print '<tr><td><tt>', websafe(k), \
++                      '</tt></td><td>', websafe(v), \
++                      '</td></tr>'
+             print '</table>'
+         else:
+             print '<p><hr>[failed to import module os]'