GitLab Commit is coming up on August 3-4. Learn how to innovate together using GitLab, the DevOps platform. Register for free:

Commit 90253245 authored by legoktm's avatar legoktm
Browse files

Ensure private archives stay private during import (CVE-2021-33038)

hyperkitty keeps state of whether a mailing list's archives should be
public or private in the hyperkitty_mailinglist table. However during
the import process, it would create a row using the default settings
(archive_policy="public") instead of getting the correct values from
Mailman. It would only sync with Mailman at the end of the import

This patch explicitly creates the hyperkitty_mailinglist row/object at
the beginning of the import process, so the visiblity will be correctly
obtained from Mailman, before any messages can be accidentally leaked.

Closes #380.
parent 344c4ba9
......@@ -30,6 +30,15 @@ News / Changelog
- Selecting threads by month now works on non-English mobile devices.
(Closes #384)
- Importing a private mailing list with ``hyperkitty_import`` will enforce
the visibility of the archives for the duration of the import. This fixes
a bug where the private archives would have public visibility during imports
which could lead to temporary information leakage.
(CVE-2021-33038, Closes #380)
.. _news-1.3.4:
......@@ -49,7 +49,7 @@ from hyperkitty.lib.incoming import DuplicateMessage, add_to_list
from hyperkitty.lib.mailman import sync_with_mailman
from hyperkitty.lib.utils import get_message_id
from import setup_logging
from hyperkitty.models import Email, Thread
from hyperkitty.models import Email, MailingList, Thread
# Allow all wierd line endings.
......@@ -338,6 +338,11 @@ class Command(BaseCommand):
# if (settings.DATABASES["default"]["ENGINE"]
# != "django.db.backends.sqlite3":
# transaction.set_autocommit(False)
# Sync list settings with Mailman before importing messages:
if not options["no_sync_mailman"]:
mlist = MailingList.objects.get_or_create(name=list_address)[0]
# Only import emails newer than the latest email in the DB
latest_email_date = Email.objects.filter(
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment