Blame SOURCES/mailman-2_1-xss_vulnerability.patch

7812c9
diff --git a/Mailman/Cgi/options.py b/Mailman/Cgi/options.py
7812c9
index 9a2389a..ae701a7 100644
7812c9
--- a/Mailman/Cgi/options.py
7812c9
+++ b/Mailman/Cgi/options.py
7812c9
@@ -18,6 +18,7 @@
7812c9
 """Produce and handle the member options."""
7812c9
 
7812c9
 import sys
7812c9
+import re
7812c9
 import os
7812c9
 import cgi
7812c9
 import signal
7812c9
@@ -149,19 +150,6 @@ def main():
7812c9
     doc.set_language(userlang)
7812c9
     i18n.set_language(userlang)
7812c9
 
7812c9
-    # See if this is VARHELP on topics.
7812c9
-    varhelp = None
7812c9
-    if cgidata.has_key('VARHELP'):
7812c9
-        varhelp = cgidata['VARHELP'].value
7812c9
-    elif os.environ.get('QUERY_STRING'):
7812c9
-        # POST methods, even if their actions have a query string, don't get
7812c9
-        # put into FieldStorage's keys :-(
7812c9
-        qs = cgi.parse_qs(os.environ['QUERY_STRING']).get('VARHELP')
7812c9
-        if qs and type(qs) == types.ListType:
7812c9
-            varhelp = qs[0]
7812c9
-    if varhelp:
7812c9
-        topic_details(mlist, doc, user, cpuser, userlang, varhelp)
7812c9
-        return
7812c9
 
7812c9
     # Are we processing an unsubscription request from the login screen?
7812c9
     if cgidata.has_key('login-unsub'):
7812c9
@@ -261,6 +249,22 @@ def main():
7812c9
         print doc.Format()
7812c9
         return
7812c9
 
7812c9
+    # See if this is VARHELP on topics.
7812c9
+    varhelp = None
7812c9
+    if cgidata.has_key('VARHELP'):
7812c9
+        varhelp = cgidata['VARHELP'].value
7812c9
+    elif os.environ.get('QUERY_STRING'):
7812c9
+        # POST methods, even if their actions have a query string, don't get
7812c9
+        # put into FieldStorage's keys :-(
7812c9
+        qs = cgi.parse_qs(os.environ['QUERY_STRING']).get('VARHELP')
7812c9
+        if qs and type(qs) == types.ListType:
7812c9
+            varhelp = qs[0]
7812c9
+    if varhelp:
7812c9
+        # Sanitize the topic name.
7812c9
+        varhelp = re.sub('<.*', '', varhelp)
7812c9
+        topic_details(mlist, doc, user, cpuser, userlang, varhelp)
7812c9
+        return
7812c9
+
7812c9
     # From here on out, the user is okay to view and modify their membership
7812c9
     # options.  The first set of checks does not require the list to be
7812c9
     # locked.