Member options page broken

Bug #265185 reported by Dmick
2
Affects Status Importance Assigned to Milestone
GNU Mailman
Fix Released
High
Barry Warsaw

Bug Description

My list URL is http://www.socal-raves.org/mailman/listinfo/scr/

When I go there, and enter my address in the
'scr Subscribers' box, I get sent to
http://www.socal-raves.org/mailman/subscribe/scr,
and the form has an ACTION= set to
../../<email address hidden>

This is incorrect; there's one too many '..' on that
path.

I think the problem is that Utils.GetNestingLevel
uses PATH_INFO to set the nesting level (counting
'/' after prepending '/' if necessary). PATH_INFO
for the submission from listinfo/scr is set to
"<email address hidden>", which ends up with
_nesting_level set to 2; however, that assumes
that <email address hidden> is an actual script name, and
it's not; it's another argument to listinfo.

I think the problem is the hack inside subscribe.py,
which sets PATH_INFO to <email address hidden>;
that confuses GetNestingLevel into doing the wrong
URL.

I think setting PATH_INFO like that is wrong.

[http://sourceforge.net/tracker/index.php?func=detail&aid=210753&group_id=103&atid=100103]

Tags: web-cgi
Revision history for this message
Dmick (dmick) wrote :

Actually, what's wrong is that PATH_INFO is used
to infer anything about script level; it's completely
arbitrary. I think GetNestingLevel should be doing
something like:

1) take SCRIPT_NAME and remove any base_url from
it

2) resolve any ../ stuff

3) count path elements in the result

Revision history for this message
Barry Warsaw (barry) wrote :

The basic approach ought to be to take REQUEST_URI (or SCRIPT_NAME +
PATH_INFO if that isn't defined), calculate the relative path in ../'s from
there to /mailman/ (or actually the path component of web_page_url or
DEFAULT_URL), then tack on the target url.

I have a suite of patches that seems to clean all this up for me. I'll
check them in and then it would be good if you could double check for me.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.