From 9e479e3e6e1c53117be43889ac6b68fa270e8fa3 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Mar 13 2018 15:19:34 +0000
Subject: import mailman-2.1.15-26.el7_4.1


---

diff --git a/SOURCES/mailman-2_1-xss_vulnerability.patch b/SOURCES/mailman-2_1-xss_vulnerability.patch
new file mode 100644
index 0000000..94b89aa
--- /dev/null
+++ b/SOURCES/mailman-2_1-xss_vulnerability.patch
@@ -0,0 +1,55 @@
+diff --git a/Mailman/Cgi/options.py b/Mailman/Cgi/options.py
+index 9a2389a..ae701a7 100644
+--- a/Mailman/Cgi/options.py
++++ b/Mailman/Cgi/options.py
+@@ -18,6 +18,7 @@
+ """Produce and handle the member options."""
+ 
+ import sys
++import re
+ import os
+ import cgi
+ import signal
+@@ -149,19 +150,6 @@ def main():
+     doc.set_language(userlang)
+     i18n.set_language(userlang)
+ 
+-    # See if this is VARHELP on topics.
+-    varhelp = None
+-    if cgidata.has_key('VARHELP'):
+-        varhelp = cgidata['VARHELP'].value
+-    elif os.environ.get('QUERY_STRING'):
+-        # POST methods, even if their actions have a query string, don't get
+-        # put into FieldStorage's keys :-(
+-        qs = cgi.parse_qs(os.environ['QUERY_STRING']).get('VARHELP')
+-        if qs and type(qs) == types.ListType:
+-            varhelp = qs[0]
+-    if varhelp:
+-        topic_details(mlist, doc, user, cpuser, userlang, varhelp)
+-        return
+ 
+     # Are we processing an unsubscription request from the login screen?
+     if cgidata.has_key('login-unsub'):
+@@ -261,6 +249,22 @@ def main():
+         print doc.Format()
+         return
+ 
++    # See if this is VARHELP on topics.
++    varhelp = None
++    if cgidata.has_key('VARHELP'):
++        varhelp = cgidata['VARHELP'].value
++    elif os.environ.get('QUERY_STRING'):
++        # POST methods, even if their actions have a query string, don't get
++        # put into FieldStorage's keys :-(
++        qs = cgi.parse_qs(os.environ['QUERY_STRING']).get('VARHELP')
++        if qs and type(qs) == types.ListType:
++            varhelp = qs[0]
++    if varhelp:
++        # Sanitize the topic name.
++        varhelp = re.sub('<.*', '', varhelp)
++        topic_details(mlist, doc, user, cpuser, userlang, varhelp)
++        return
++
+     # From here on out, the user is okay to view and modify their membership
+     # options.  The first set of checks does not require the list to be
+     # locked.
diff --git a/SPECS/mailman.spec b/SPECS/mailman.spec
index 0b921c7..e9f4066 100644
--- a/SPECS/mailman.spec
+++ b/SPECS/mailman.spec
@@ -4,7 +4,7 @@
 Summary: Mailing list manager with built in Web access
 Name: mailman
 Version: 2.1.15
-Release: 24%{?dist}
+Release: 26%{?dist}.1
 Epoch: 3
 Group: Applications/Internet
 Source0: ftp://ftp.gnu.org/pub/gnu/mailman/mailman-%{version}.tgz
@@ -44,6 +44,8 @@ Patch24: mailman-2.1.15-CVE-2015-2775.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1351939
 Patch25: mailman-2.1.15-rh1351939.patch
 Patch26: mailman-2.1.12-newlist-ja.patch
+Patch27: mailman-2_1-xss_vulnerability.patch
+
 
 License: GPLv2+
 URL: http://www.list.org/
@@ -142,6 +144,7 @@ additional installation steps, these are described in:
 %patch24 -p1
 %patch25 -p0
 %patch26 -p1
+%patch27 -p1 -b .xss
 
 # Change `#!/usr/bin/env python` shebang to `#!/usr/bin/python`
 sed -i '1s|^#! */usr/bin/env python$|#!/usr/bin/python|' `find -iname '*.py'`
@@ -597,6 +600,18 @@ exit 0
 %dir %attr(775,root,%{mmgroup}) %{lockdir}
 
 %changelog
+* Fri Mar 02 2018 Pavel Zhukov <pzhukov@redhat.com> - 3:2.1.15-26.1
+- Related: #1545974 - Add import regular expression module
+
+* Fri Mar 02 2018 Pavel Zhukov <pzhukov@redhat.com> - 3:2.1.15-26
+- Related: #1545974 - Bump release to make it higher than 7.5
+
+* Fri Mar 02 2018 Pavel Zhukov <pzhukov@redhat.com> - 3:2.1.15-24.2
+- Resolves: #1545974 -  Add sanitizer to mitigate XSS injection
+
+* Fri Feb 16 2018 Pavel Zhukov <pzhukov@redhat.com> - 3:2.1.15-24.1
+- Resolves: #1545974 -  Fix XSS vulnerability in web UI
+
 * Wed Feb 22 2017 Pavel Šimerda <psimerda@redhat.com> - 3:2.1.15-24
 - Resolves: #1232737 - Fix instances of #!/usr/bin/env python in mailman