+++ This bug was initially created as a clone of Bug #745012 +++
Description of problem:
If you ask Mailman to not archive a list but fail to ask it to keep the (disabled) archives private the attachments sent to that list will be placed in a public archive.
This problem is made worse by the default httpd config included in the rpm which turns on directory listings for the public archives:
Options Indexes MultiViews FollowSymLinks
Mailman maintains an index of all messages that belong in the archive including links to their attachments so it would make a lot more sense to disable Options Indexes for /var/lib/mailman/archives/public.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
* Create a test list with settings:
archive = 0
archive_private = 0
* Send a message to the list with an attachment.
* Go to: http://SITE.ADDRESS/pipermail/TEST-LIST/attachments/ [^]
* Follow the directory listings to your attachment.
Attachment for unarchived list can be found by guessing a constant directory component and then following the directory indexes.
Nothing is archived for unarchived list.
% yum info mailman
Loaded plugins: fastestmirror
Excluding Packages from RHEL 5 - RPMforge.net - dag
Name : mailman
Arch : x86_64
Epoch : 3
Version : 2.1.9
Release : 6.el5_6.1
Size : 34 M
Repo : installed
Summary : Mailing list manager with built in Web access.
URL : http://www.list.org/ [^]
License : GPL
Description: Mailman is software to help manage email discussion lists, much
: like Majordomo and Smartmail. Unlike most similar products, Mailman
: gives each mailing list a webpage, and allows users to subscribe,
: unsubscribe, etc. over the Web. Even the list manager can
: administer his or her list entirely from the Web. Mailman also
: integrates most things people want to do with mailing lists,
: including archiving, mail <-> news gateways, and so on.
: Documentation can be found in: /usr/share/doc/mailman-2.1.9
: When the package has finished installing, you will need to perform
: some additional installation steps, these are described in:
I've already submitted this as Centos bug 0005123 but they referred to upstream.
--- Additional comment from email@example.com on 2011-10-11 05:13:30 EDT ---
So is it only about disabling indexes in httpd conf, or mailman stores private attachments in public directory for you?
--- Additional comment from firstname.lastname@example.org on 2011-10-11 07:01:08 EDT ---
I've intended for this bug to be about disabling indexes in httpd.conf as it exposes this problem and is not suggested in the Mailman installation documentation.
The root cause of the problem is of course that Mailman stores these attachments in the archive when archiving is disabled so no list admin will think about marking the archive private, but it seems a bigger issue and just disabling the indexes will be a big help.
There is already a bug in the vicinity of the root cause in Mailmans bug tracker:
Note that the test case We'll be using slightly differs from the OP:
1. Create test list,
2. send mail with *binary* attachment to the list
3. set `archive = 0` and `archive_private = 0` for the list,
4. and check http://site.example.com/pipermail/listname/attachments/,
while OP sends the mail *after* changing the settings, which in our settings resulted in empty archive in both cases (before and after fix).
Verified on x86_64, and scheduled tests for the rest of architectures.
Verified on all architectures now.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.