lp:~ralfjung-e/mailman/csrf-injective

Branch merges

Propose for merging

No branches dependent on this one.

Merged into lp:mailman/2.1 at revision 1759

Mark Sapiro: Approve on 2018-06-03

Diff: 33 lines (+6/-6)

2 files modified

Mailman/Cgi/listinfo.py (+3/-3)
Mailman/Cgi/subscribe.py (+3/-3)

api

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

1759. By Ralf Jung <email address hidden> on 2018-06-03

Separate data in CSRF token by colon to avoid collisions.

This makes the data-to-token function injective. Previously, for example, the
list called "list1" and the IP "10.0.0.0" would have the same hash as the list
called "list" and the IP "110.0.0.0", as the strings were just concatenated.

1758. By Mark Sapiro on 2018-05-26

Updated Japanese translation.

1757. By Mark Sapiro on 2018-05-26

Internationalize the noscript note added to reCAPTCHA.

1756. By Mark Sapiro on 2018-05-25

Update i18n for recent changes.

1755. By Mark Sapiro on 2018-05-25

Add an option to add_members to issue invitations.

1754. By Mark Sapiro on 2018-05-21

A few more error messages have had their values HTML escaped.

1753. By Mark Sapiro on 2018-05-05

Add <noscript> note to listinfo reCAPTCHA that JavaScript is required.

1752. By Mark Sapiro on 2018-05-03

bin/arch now uses i18n.C_ for progress messages.

1751. By Mark Sapiro on 2018-04-13

Give a better message from scripts/driver on SyntaxError in mm_cfg.py.

1750. By Mark Sapiro on 2018-04-11

Improve DELIVERY_RETRY_WAIT reimplementation.