Applied patch for CVE-2006-5875.

[eoc.git] / eoc.py

diff --git a/eoc.py b/eoc.py
index 16dae19b889ddafb101824f55077caa49420316e..f855b36333737e77f1599a551ba107f9732ded1c 100644 (file)
--- a/eoc.py
+++ b/eoc.py
@@ -4,7 +4,7 @@ This is a simple mailing list manager that mimicks the ezmlm-idx mail
 address commands. See manual page for more information.
 """
 
-VERSION = "1.2.1"
+VERSION = "1.2.4"
 PLUGIN_INTERFACE_VERSION = "1"
 
 import getopt
@@ -80,6 +80,34 @@ COMMANDS = SIMPLE_COMMANDS + SUB_COMMANDS + HASH_COMMANDS
 def md5sum_as_hex(s):
     return md5.new(s).hexdigest()
 
+
+def forkexec(argv, text):
+    """Run a command (given as argv array) and write text to its stdin"""
+    (r, w) = os.pipe()
+    pid = os.fork()
+    if pid == -1:
+        raise Exception("fork failed")
+    elif pid == 0:
+        os.dup2(r, 0)
+        os.close(r)
+        os.close(w)
+        fd = os.open("/dev/null", os.O_RDWR)
+        os.dup2(fd, 1)
+        os.dup2(fd, 2)
+        os.execvp(argv[0], argv)
+        sys.exit(1)
+    else:
+        os.close(r)
+        os.write(w, text)
+        os.close(w)
+        (pid2, exit) = os.waitpid(pid, 0)
+        if pid != pid2:
+            raise Exception("os.waitpid for %d returned for %d" % (pid, pid2))
+        if exit != 0:
+            raise Exception("subprocess failed, exit=0x%x" % exit)
+        return exit
+
+
 environ = None
 
 def set_environ(new_environ):
@@ -395,22 +423,28 @@ class MailingListManager:
                "\n    ".join(text[:text.find("\n\n")].split("\n"))))
         if recipients:
             if self.smtp_server:
-                smtp = smtplib.SMTP(self.smtp_server)
-                smtp.sendmail(envelope_sender, recipients, text)
-                smtp.quit()
+                try:
+                    smtp = smtplib.SMTP(self.smtp_server)
+                    smtp.sendmail(envelope_sender, recipients, text)
+                    smtp.quit()
+                except:
+                    error("Error sending SMTP mail, mail probably not sent")
+                    sys.exit(1)
             elif self.qmqp_server:
-                q = qmqp.QMQP(self.qmqp_server)
-                q.sendmail(envelope_sender, recipients, text)
-                q.quit()
+                try:
+                    q = qmqp.QMQP(self.qmqp_server)
+                    q.sendmail(envelope_sender, recipients, text)
+                    q.quit()
+                except:
+                    error("Error sending QMQP mail, mail probably not sent")
+                    sys.exit(1)
             else:
-                recipients = string.join(recipients, " ")
-                f = os.popen("%s -oi -f '%s' %s" % 
-                                 (self.sendmail, 
-                                  envelope_sender, 
-                                  recipients),
-                             "w")
-                f.write(text)
-                f.close()
+                status = forkexec([self.sendmail, "-oi", "-f", 
+                                   envelope_sender] + recipienients, text)
+                if status:
+                    error("%s returned %s, mail sending probably failed" %
+                           (self.sendmail, status))
+                    sys.exit((status >> 8) & 0xff)
         else:
             debug("send_mail: no recipients, not sending")
 
@@ -463,6 +497,8 @@ class MailingList:
 
     def read_stdin(self):
         data = sys.stdin.read()
+        # Convert CRLF to plain LF
+        data = "\n".join(data.split("\r\n"))
         # Skip Unix mbox "From " mail start indicator
         if data[:5] == "From ":
             data = string.split(data, "\n", 1)[1]
@@ -515,7 +551,7 @@ class MailingList:
         
             return "\n".join(headers) + "\n\n" + body
         except:
-            error("Cannot MIME encode header, using original ones, sorry")
+            warning("Cannot MIME encode header, using original ones, sorry")
             return text
 
     def template(self, template_name, dict):
@@ -850,15 +886,23 @@ class MailingList:
                 return mail
         headers = mail[:endpos].split("\n")
         body = mail[endpos:]
+        
+        headers_to_remove = [x.lower() for x in headers_to_remove]
     
         remaining = []
         add_continuation_lines = 0
+
         for header in headers:
-            pos = header.find(":")
-            if pos == -1:
+            if header[0] in [' ','\t']:
+                # this is a continuation line
                 if add_continuation_lines:
                     remaining.append(header)
             else:
+                pos = header.find(":")
+                if pos == -1:
+                    # malformed message, try to remove the junk
+                    add_continuation_lines = 0
+                    continue
                 name = header[:pos].lower()
                 if name in headers_to_remove:
                     add_continuation_lines = 0
@@ -884,6 +928,10 @@ class MailingList:
         return text + self.template("footer", {})
 
     def send_mail_to_subscribers(self, text):
+        text = self.remove_some_headers(text, ["list-id", "list-help",
+                                               "list-unsubscribe",
+                                               "list-subscribe", "list-post",
+                                               "list-owner", "precedence"])
         text = self.headers_to_add() + self.list_headers() + \
                self.headers_to_remove(text)
         text = self.append_footer(text)