[mlmmj] ezmlm-like single command to subscribe an user?

[mlmmj] ezmlm-like single command to subscribe an user?

[Mark Alan]

Hello list,

I am not being able to find info about the proper command to
subscribe an user like ezmlm does:
listname+subscribe-some.user=example.com@domain.tld

Meaning: subscribe user some.user@example.com to list
listname@domain.tld

We would like to migrate from ezmlm to mlmmj, but keeping in place the
Drupal ezmlm module <http://drupal.org/project/ezmlm> to let our users
subscribe to our mailing lists.
Given an user email address that module changes the @ in the user's
address into a = , then adds prefix 'listname+subscribe-' and then
adds a trailing '@domain.tld', producing the canonical ezmlm/qmail format:
listname+subscribe-some.user=example.com@domain.tld


Regards,

M.

Re: [mlmmj] ezmlm-like single command to subscribe an user?

[Ben Schmidt]

On 22/01/11 8:08 AM, Mark Alan wrote:
> Hello list,
>
> I am not being able to find info about the proper command to
> subscribe an user like ezmlm does:
> listname+subscribe-some.user=example.com@domain.tld
>
> Meaning: subscribe user some.user@example.com to list
> listname@domain.tld

I'm fairly new to Mlmmj myself, so I'm not sure about this...but...I
don't think Mlmmj does this. Can somebody else confirm it?

I wouldn't mind adding this functionality, though it would probably not
make it into the next release but only the one after.

Ben.

Re: [mlmmj] ezmlm-like single command to subscribe an user?

[Thomas Goirand]

On 01/27/2011 06:32 PM, Ben Schmidt wrote:
> On 22/01/11 8:08 AM, Mark Alan wrote:
>> Hello list,
>>
>> I am not being able to find info about the proper command to
>> subscribe an user like ezmlm does:
>> listname+subscribe-some.user=example.com@domain.tld
>>
>> Meaning: subscribe user some.user@example.com to list
>> listname@domain.tld
> 
> I'm fairly new to Mlmmj myself, so I'm not sure about this...but...I
> don't think Mlmmj does this. Can somebody else confirm it?
> 
> I wouldn't mind adding this functionality, though it would probably not
> make it into the next release but only the one after.
> 
> Ben.

I see this as a way to get spams... Let's say somebody that doesn't like
me sends 1000 messages to this address, then I might receive 1000
requests to register to the list.

I don't want this feature on my servers. Only the legitimate owner of
example.com@domain.tld should be able to register, and the others should
be filtered with something like DKIM or spf, or whatever you like that
can provide a kind of auth. So if you want to add such a dangerous
feature, make sure it's disabled by default.

Thomas

Re: [mlmmj] ezmlm-like single command to subscribe an user?

[Mads Martin Jørgensen]

On Thu, Jan 27, 2011 at 6:14 PM, Thomas Goirand <thomas@goirand.fr> wrote:
>>> I am not being able to find info about the proper command to
>>> subscribe an user like ezmlm does:
>>> listname+subscribe-some.user=example.com@domain.tld
>>>
>>> Meaning: subscribe user some.user@example.com to list
>>> listname@domain.tld
>>
>> I'm fairly new to Mlmmj myself, so I'm not sure about this...but...I
>> don't think Mlmmj does this. Can somebody else confirm it?
>>
>> I wouldn't mind adding this functionality, though it would probably not
>> make it into the next release but only the one after.
>
> I see this as a way to get spams... Let's say somebody that doesn't like
> me sends 1000 messages to this address, then I might receive 1000
> requests to register to the list.
>
> I don't want this feature on my servers. Only the legitimate owner of
> example.com@domain.tld should be able to register, and the others should
> be filtered with something like DKIM or spf, or whatever you like that
> can provide a kind of auth. So if you want to add such a dangerous
> feature, make sure it's disabled by default.

And systems wanting to automate this can just send a mail with the
envelope from being email in question. It's dead simple, actually. If
you don't know what I mean, let me know and I'll explain.

-- 
Mads Martin Joergensen, http://mmj.dk
"Why make things difficult, when it is possible to make them cryptic
 and totally illogical, with just a little bit more effort?"
                                 -- A. P. J.

Re: [mlmmj] ezmlm-like single command to subscribe an user?

[Mads Martin Jørgensen]

On Fri, Jan 28, 2011 at 12:28 AM, Ben Schmidt
<mail_ben_schmidt@yahoo.com.au> wrote:
>> Those risks simply do not exist if one forwards an empty email to
>> some_list+subscribe-any.user=example.com@domain.tld , using the
>> system's mail server.
>
> Some of the web interfaces bundled with Mlmmj make use of similar
> workarounds already, too.

Why all the commandline stuff? I still fail to see what the problem
with sending an empty mail through the system mail server, where the
envelope from is set to any.user@example.com.

mlmmj uses the envelope from to determine who sent the subscription request.

-- 
Mads Martin Joergensen, http://mmj.dk
"Why make things difficult, when it is possible to make them cryptic
 and totally illogical, with just a little bit more effort?"
                                 -- A. P. J.

Re: [mlmmj] ezmlm-like single command to subscribe an user?

[Ben Schmidt]

On 28/01/11 4:13 PM, Mads Martin Jørgensen wrote:
> On Fri, Jan 28, 2011 at 12:28 AM, Ben Schmidt
> <mail_ben_schmidt@yahoo.com.au>  wrote:
>>> Those risks simply do not exist if one forwards an empty email to
>>> some_list+subscribe-any.user=example.com@domain.tld , using the
>>> system's mail server.
>>
>> Some of the web interfaces bundled with Mlmmj make use of similar
>> workarounds already, too.
>
> Why all the commandline stuff? I still fail to see what the problem
> with sending an empty mail through the system mail server, where the
> envelope from is set to any.user@example.com.

I expect that's what the current mlmmj web interface does. All I was
referring to was the use of the mail system rather than the commandline
to avoid having to deal with permissions etc..

As far as I can tell, the only real benefit to the Ezmlm way rather than
the current Mlmmj way is that it leverages the support of existing Ezmlm
plugins for CMSes, as the OP mentioned.

Ben.



> mlmmj uses the envelope from to determine who sent the subscription
> request.

Re: [mlmmj] ezmlm-like single command to subscribe an user?

[Mark Alan]

On Fri, 28 Jan 2011 06:13:50 +0100, Mads Martin Jørgensen <mmj@mmj.dk>
wrote:

> Why all the commandline stuff? I still fail to see what the problem
> with sending an empty mail through the system mail server, where the
> envelope from is set to any.user@example.com.
> 
> mlmmj uses the envelope from to determine who sent the subscription
> request.

Changing the envelope, that's what we need to do now in order to make
it work. But that is fundamentally wrong. It is hardly good practice to
let the system itself act as a spammer, i.e., faking 'From:' envelopes.

In the Drupal CMS code that I mentioned in the first post, at the file
sites/all/modules/ezmlm/ezmlm.module,

we REPLACE the original:
  // subscribe address for list formatted below
  $to = trim($list_name) . '-subscribe-' . trim($user_name) .
'=' . trim($user_domain) . '@' . trim($list_domain);
  $lang = language_default();
  drupal_mail('ezmlm', 'subscribe', $to, $lang);

FOR this code:
  // subscribe address for list formatted below
  $to = trim($list_name) . '+subscribe' .'@' . trim($list_domain);
  $from = trim($user_name) . '@' . trim($user_domain);
  $lang = language_default();
  drupal_mail('ezmlm', 'subscribe', $to, $lang, '', $from);

I am not talking of quick fixes "to just make it working for now", I am
talking of fundamentally sound decisions involving best practices.

Why should we have to fake envelopes or, for that matter, have users
that own a mailing list and at the same time need to members of the
web server group and of the mail server group,
if we could have the much simpler and system/application agnostic:
listname+subscribe-some.user=example.com@domain.tld


Regards,

M.