0005123: default httpd config for Mailman offers directory listings for lists with disabled but public archives

CentOS Bug Tracker

View Issue Details [ Jump to Notes ]

[ Issue History ] [ Print ]

Project

Category

View Status

Date Submitted

Last Update

0005123

CentOS-5

mailman

public

2011-09-19 15:49

2013-03-23 13:16

Reporter

qha

Priority

normal

Severity

major

Reproducibility

always

Status

closed

Resolution

won't fix

Platform

x86_64

Centos

OS Version

5.7

Product Version

Target Version

Fixed in Version

Summary

0005123: default httpd config for Mailman offers directory listings for lists with disabled but public archives

Description

If you ask Mailman to not archive a list but fail to ask it to keep the (disabled) archives private the attachments sent to that list will be placed in a public archive.

This problem is made worse by the default httpd config included in the rpm which turns on directory listings for the public archives:

    ...
    <Directory /var/lib/mailman/archives/public>
        Options Indexes MultiViews FollowSymLinks
    ...

Mailman maintains an index of all messages that belong in the archive including links to their attachments so it would make a lot more sense to disable Options Indexes for /var/lib/mailman/archives/public.

Steps To Reproduce

* Create a test list with settings:
archive = 0
archive_private = 0

* Send a message to the list with an attachment.

* Go to: http://SITE.ADDRESS/pipermail/TEST-LIST/attachments/ [^]

* Follow the directory listings to your attachment.

Additional Information

% yum info mailman
Loaded plugins: fastestmirror
base 3566/3566
rpmforge 10775/10775
unit 38/38
unit-extras 3/3
Excluding Packages from RHEL 5 - RPMforge.net - dag
Finished
Installed Packages
Name : mailman
Arch : x86_64
Epoch : 3
Version : 2.1.9
Release : 6.el5_6.1
Size : 34 M
Repo : installed
Summary : Mailing list manager with built in Web access.
URL : http://www.list.org/ [^]
License : GPL
Description: Mailman is software to help manage email discussion lists, much
           : like Majordomo and Smartmail. Unlike most similar products, Mailman
           : gives each mailing list a webpage, and allows users to subscribe,
           : unsubscribe, etc. over the Web. Even the list manager can
           : administer his or her list entirely from the Web. Mailman also
           : integrates most things people want to do with mailing lists,
           : including archiving, mail <-> news gateways, and so on.
           :
           : Documentation can be found in: /usr/share/doc/mailman-2.1.9
           :
           : When the package has finished installing, you will need to perform
           : some additional installation steps, these are described in:
           : /usr/share/doc/mailman-2.1.9/INSTALL.REDHAT

Tags

No tags attached.

Attached Files

Relationships

Notes
(0013321) range (administrator) 2011-09-19 21:19	This needs to be fixed upstream. A quick check didn't reveal any bugreport concerning this problem at https://bugzilla.redhat.com/ [^] so I don't think they are aware of that problem.

(0013516) qha (reporter) 2011-10-11 07:38	Submitted to Red hat: https://bugzilla.redhat.com/show_bug.cgi?id=745012 [^]

(0016836) tigalch (qa_team) 2013-03-23 13:16	upstream marked this as WONTFIX due to RHEL5 (and therefore CentOS5) entering production phase 2.

Issue History
Date Modified	Username	Field	Change
2011-09-19 15:49	qha	New Issue
2011-09-19 21:19	range	Note Added: 0013321
2011-09-19 21:20	range	Status	new => feedback
2011-10-11 07:38	qha	Note Added: 0013516
2011-10-11 07:38	qha	Status	feedback => assigned
2013-03-23 13:16	tigalch	Note Added: 0016836
2013-03-23 13:16	tigalch	Status	assigned => closed
2013-03-23 13:16	tigalch	Resolution	open => won't fix