Robot listmasters can edit site templates

[svenseeberg]

A robot listmaster is able to copy a template and set scope to "site".

Version

6.2.40~dfsg-1+deb10u1

Installation method

Debian Buster package

Expected behavior

Robot listmasters should only be able to copy & edit templates in the robot and lists scope, not site scope. Only the Super listmasters should be able to change site (global) templates.

Actual behavior

A robot listmaster is able to copy a template and set scope to "site". The changes are then visible in all robots, even if they're not managed by the same robot listmaster.

Workaround

Remove write permissions to /etc/sympa/web_tt2. This will prevent robot listmaster from writing files to this directory. As the global listmaster is probably also the server admin, the server admin can write files to this directory.

[ikedas]

Hi @svenseeberg ,

Could you please this patch to confirm it will fix the problem?

[svenseeberg]

Thanks a lot. I did not have a test server at hand so quickly and the production server is hard to patch as it is running with the Debian Buster package.

[ikedas]

@svenseeberg , it's ok. The patch was included in the recent beta release, and we will try testing it. Thank you for reporting bug!