I recently posted a patch to majordomo-users for 1.94.4 that would add
subscribe/nosubscribe regexp arrays to the config:
Addresses matched in the "subscribe" array would be treated as an
automatic subscribe approval, overriding whatever the current policy
may be. This gives an easy way to (eg) allow users in your domain to
auto-subscribe, letting everyone else hit the default policy.
Addresses matched in the "nosubscribe" array would be bounced to the
owner for approval, even if the list policy was "auto". This gives an
easy way to establish a "ban" list.
Both were relatively easy to add, and they were made almost identical
to the advertise/noadvertise checks, so there should be no big
risks. But there is one shortcoming:
The "ban" function would be really cool if it allowed negated regexps.
"Ban if thisdomain or thatdomain" can get messy when all you want to
say is "ban if NOT mydomain.com".
I know Jason has this worked out in 2.0 (!/regexp/), and I was
considering backfilling that feature into 1.94. I've looked at the
regexp validation in config_parse.pl and that should be pretty
easy to add there.
What I was wondering was, given the potential security problems we
had earlier with the regexp eval for advertise/noadvertise (subsequently
fixed by Oliver & Dave), what would be the safest way to code this
negation feature into the eval loops?
--bill
Follow-Ups:
|
|
