please bump net-mail/mailman
2.1.15 finally fixes a long standing (minor but annoying) issue setting the focus to the password field for the admin login pages... Would really like to see this updated in portage... Thanks guys!
From the NEWS file ------------------ 2.1.15 (13-Jun-2012) Security - Strengthened the validation of email addresses. - An XSS vulnerability, CVE-2011-0707, has been fixed. - The web admin interface has been hardened against CSRF attacks by adding a hidden, encrypted token with a time stamp to form submissions and not accepting authentication by cookie if the token is missing, invalid or older than the new mm_cfg.py setting FORM_LIFETIME which defaults to one hour. Posthumous thanks go to Tokio Kikuchi for this implementation which is only one of his many contributions to Mailman prior to his death from cancer on 14 January 2012. New Features - Added a password reminder button to the private archive login page. Backported from the 2.2 branch. - There is a new list attribute regular_exclude_ignore set from mm_cfg.py DEFAULT_REGULAR_EXCLUDE_IGNORE. This defaults to True even though the prior behavior is equivalent to False. A True setting will ignore an exclude list if the poster is not a member of that list. The False setting can result in list members not receiving posts if the nonmember post is not accepted by the exclude list. Backported from 2.2 branch. - Eliminated the list cache from the qrunners. Indirect self-references caused lists to never be dropped from the cache which in turn caused the qrunners to grow very large in installations with many lists or multiple large lists. Bug #862683. - The user options 'list my other subscriptions' page now indicates for each list if the subscription is 'nomail' or 'digest'. Bug #793669. - A new list poster password has been implemented. This password may only be used in Approved: or X-Approved: headers for pre-approving posts. Using this password for that purpose precludes compromise of a more valuable password sent in plain text email. Bug #770581. - A new mm_cfg.py setting AUTHENTICATION_COOKIE_LIFETIME has been added. If this is set to a non-zero value, web authentication cookies will expire that many seconds following their last use. Its default value is zero to preserve current behavior. - A new mm_cfg.py setting RESPONSE_INCLUDE_LEVEL has been added to control how much of the original message is included in automatic responses to email commands. The default is 2 to preserve the prior behavior of including the full message. Setting this to 1 in mm_cfg.py will include only the original headers, and 0 will include none of the original. It is recommended to set this to 0 in mm_cfg.py to minimize the effects of backscatter. Bug #265835. - A new mm_cfg.py setting DEFAULT_RESPOND_TO_POST_REQUESTS has been added to control the default for respond_to_post_requests for new lists. It is set to Yes for backwards compatibility, but it is recommended that serious consideration be given to setting it to No. Bug #266051. - A new mm_cfg.py setting DISCARD_MESSAGE_WITH_NO_COMMAND has been added to control whether a message to the -request address without any commands or a message to -confirm whose To: address doesn't match VERP_CONFIRM_REGEXP is responded to or just logged. It defaults to Yes which is different from prior behavior. Bug #410236. - Two new mm_cfg.py settings, BROKEN_BROWSER_WORKAROUND and BROKEN_BROWSER_REPLACEMENTS, have been added to control escaping of additional characters beyond the standard <, >, &, and " in the web UI. See the documentation of these settings in Defaults.py. The default values for these settings result in no change from the prior release. Bug #774588. i18n - Added some missing German templates from Egon Frerich. - Added Greek translation from Antonis Limperis. - A few errors in the Basque translation are fixed. Bug #836861. - Fixed a misspelling in the German invite.txt template. Bug #815444. - Fixed a missing format character in the Spanish translation. Bug #670988. - Thanks go to the following for updating translations for the changes in this release. Thijs Kinkhorst Stefan Förster Fabian Wenk Bug Fixes and other patches - Fixed a bug that could send an admin notice of a held subscription with the subject in the user's preferred language instead of the list's preferred language and possibly not properly RFC 2047 encoded. (LP: #998949) - Fixed a possible CPU bound loop in OutgoingRunner if the attempt to Connect to the SMTP server throws a socket.error. (LP: #966531) - Fixed a potential crash in the web UI if a language is removed from the LC_DESCRIPTIONS dictionary. (LP: #966565) - Added an Auto-Submitted: header to invitations and (un)subscription confirmation requests to reduce the possibility of an autoresponder confirming the request. (LP: #265831) - Added javascript to the private.html and admlogin.html templates to focus the cursor on the entry field. (LP: #266054) - Added CPPFLAGS and LDFLAGS to src/Makefile to support their use. (LP: #637652) - Stopped removing the trailing slash from the List-Archive: header URL. (LP: #964190) - A configured version of contrib/courier-to-mailman.py is now created in build/contrib/courier-to-mailman.py. (LP: #999250) - Subscription disabled warnings are now sent without a Precedence: header. Bug #808821. - Backported 2.2 branch fix for a problem in SpamDetect.py that could cause header_filter_rules to fail to match RFC 2047 encoded headers. - Fix for bug #629738 could cause a crash in the admindb details display if the decoded message body contained characters not in the character set of the list's preferred language. Fixed. Bug #910440. - Added recognition for another Qmail bounce format. - Fixed an erroneous seek in the Mailman.Mailbox.Mailbox.AppendMessage method that could cause a corrupt mailbox for files opened 'w+'. Bug #901957. - A held message with a null sender caused a crash in the admindb interface. This is fixed by changing the sender to <missing>. Bug #897103. - Changed subject prefixing to allow for possible whitespace between an 'Re' and the following colon when determining how to add the prefix. Bug #893290. - Fixed a problem where topics regexps would not match RFC 2047 encoded Keywords: and/or Subject: headers. Bug #891676. - Fixed misleading response to an email approval of a held message. Bug #889968. - Added masthead.txt to the list of templates that can be edited via the web admin interface. Bug #266805. - Changed the way digest_footer is added to the RFC 1153 (plain) format digest for RFC compliance. Bug #887610. - Fixed cron/checkdbs to report unsubscriptions waiting approval. Bug #873821. - The fix for BUG #266220 (sf1181161) has been enhanced so that if there is a pathological HTML part such that the Approved: password text isn't found, but it is found after stripping out HTML tags, the post is rejected with an informative message. - A bug that would cause reset of any new_member_options bits other than the four displayed as checkboxes on the list admin General Options page whenever the page was updated or bin/config_list attempted to update new_member_options has been fixed. Bug #865825. - A problem with the logic avoiding unnecessarily reloading a current list object from the config.pck arises if the list is updated by another process within the same second that it was last read/written. That can cause the reading of latest version of the list to be skipped. This has been fixed. Bug #862675. - Fixed bin/export.py to accept case insensitive password schemes. Bug #833134. - Added Tokio Kikuchi's icons to the misc/ and installed icons/ directories. Bug #782474. - Fixed a problem which could result in raw, undecoded message bodies appearing in plain digests and archives. Bug #787790. - Fixed a problem in admindb.py where the character set for the display of the message body excerpt was not correctly determined. Bug #779751. - Prevented setting user passwords with leading/trailing whitespace. Bug #778088. - Mailman now sets the 'secure' flag in cookies set via https URLs. Bug #770377. - Added a logout link to the admindb interface and made both admin and admindb logout effective for a site admin cookie if allowed. Bug #769318. - Replaced the old Mailman logos and icon that install to Mailman's icons directory with the new ones. If you copy these elsewhere on your server, please copy these new ones. - Changed bin/genaliases to only call the POSTFIX_*_CMD commands once when MTA = 'Postfix'. Bug #266408. - Added a report of the affected members to the warnings issued when setting a list with digest members digestable=No and when setting a list with non-digest members nondigestable=no. Bug #761232. - Fixed a problem where content filtering could remove the headers from an attached message/rfc822 part if the message in that part is multipart/alternative and collapse_alternatives is Yes. Bug #757062. - Changed the subscribe CGI to strip leading and trailing whitespace from the supplied email address. Bug #745432. - Changed the maximum number of arguments for the who command to be considered administrivia from 2 to 1 to help avoid false positives. Bug #739524. - Added the list name as 'display-name' in added Sender: headers to help mitigate Outlook et al 'on behalf of' displays. Bug #736849. - Fixed a typo in the usage() definition cron/gate_news. Bug #721015. - Fixed an uncaught KeyError when poster tries to cancel a post which was already handled. Bug #266224. - Held message user notifications now come From: list-owner instead of list-bounces. Bug #714424. - Issue an HTTP 404 status for private archive file not found. - @listname entries in *_these_nonmembers are no longer case sensitive. Bug #705715. - Changed bin/rmlist to also remove heldmsg files for the removed list and fixed a problem with removal of stale locks for the list. Bug #700528. - Fixed a bug where content filtering could leave a multipart message or part with just one sub-part. These should be recast to just the sub-part. Bug #701558. - Fixed a bug that could erroneously handle posts from addresses in *_these_nonmembers and send held/rejected notices to bogus addresses when The From or other sender header is RFC 2047 encoded. Bug #702516. - Updated contrib/mm-handler-2.1.10 to better handle lists with names that look like admin addresses. Bug #697161. - Added bounce recognition for a bogus Dovecot MDN. Bug #693134. - Fixed a problem where an emailed command in the Subject: header with a non-ascii l10n of an 'Re:' prefix is ignored. Bug #685261. - Fixed a problem with approving a post by email when the body of the approval mail is base64 encoded. Bug #677115. - Fixed the host name in the From: address of the owner notification from bin/add_members. Bug #666181.
This bug was fixed: https://bugs.launchpad.net/mailman/+bug/637652 So we can drop mailman-2.1.13-ldflags.patch. Otherwise, it builds after renaming the ebuild. I'm going to set up a clean installation on a new server and import two small lists.
done, security issue is handled in #372901
