Hello everyone, v11.17.0 has been released! Download and install: https://dadamailproject.com/d/install_dada_mail.pod.html Changelog (and below): https://dadamailproject.com/d/changes_11_x.pod.html#pod11.17.0 Focus This version of Dada Mail has been released with some new features and a few small bug fixes. Features Only one mailing list? The default screen is now that list screen Dada Mail supports an arbitrary number of lists, but many people just run one mailing list. If this is the case, Dada Mail will show what i ...Continue Reading

Hello Everyone, v11.16.3 has been released (as well as v11.16.2 and 11.16.1). These small releases are just fix bugs dealing with the CSRF vulnerability - some of the functionality of Dada Mail broke (which are now fixed). If you’re running v11.16.0 to 11.16.2, you can just use this dada_mail.js file, https://raw.githubusercontent.com/justingit/dada-mail/v11_16_3-stable_2021_09_27/dada/static/javascripts/dada_mail.jsThis file goes into your dada_mail_support_files directory at,  dada_mail_support_files/static/ ...Continue Reading

Here’s the CVE report: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41083-- Justin J: Lead Dadaist*url:         dadamailproject.comemail:    justin@PROTECTEDtwitter:  @dadamailDada Mail Announcements: http://dadamailproject.com/cgi-bin/dada/mail.cgi/list/dada_announce/  On Sep 20, 2021, at 1:56 PM, Justin John justin@PROTECTED [Dada Mail Developers] <dadadev@PROTECTED> wrote: From: justin@PROTECTEDHello everyone, v11.16.0 h ...Continue Reading

Hello everyone, v11.16.0 has been released! Download and install: https://dadamailproject.com/d/install_dada_mail.pod.html A CSRF Vulnerability has been found in Dada Mail and this release is primarily put out to fix it. All versions of Dada Mail below v11.16.0 are vulnerable and it’s another upgrade that I would suggest for absolutely everyone. Changelog (and below): https://dadamailproject.com/d/changes_11_x.pod.html#pod11.16.0 Focus This version of Dada Mail has been released primarily to fix a security vulnerabil ...Continue Reading

Hello everyone, v11.15.1 has been released! Download and install: https://dadamailproject.com/d/install_dada_mail.pod.html This release includes a few bug fixes dealing with potential security issues. The biggest one is the reCAPTCHA v2 problem - it’s very easy to circumvent its protection completely, so if you’re relying on reCAPTCHA v2, upgrade. Changelog (and below): https://dadamailproject.com/d/changes_11_x.pod.html#pod11.15.1 Focus This is a bugfix release, with changes to close up some potential security hole ...Continue Reading

Howdy everyone, how’s v11.15.0 working for everyone? While finishing up work on getting the GET requests found in email messages - things like confirming your subscriptions, it dawned on me that Dada Mail has no checks for other GET requests, that should be POSTs. Here’s a scenario: you want to log into your mailing list, so you fill out the password in the login form. Works a peach. The login form uses a POST request, as it’s sending pretty sensitive information through the pipes (your password), but there’s ...Continue Reading

It is working now    Richard Mourino ------ Original Message ------ From: "Mourino richard.mourino@PROTECTED [Dada Mail Developers]" <dadadev@PROTECTED> To: "Dada Mail Developers Subscriber" <richard.mourino@PROTECTED> Sent: 8/31/2021 6:03:15 PM Subject: Re: [dadadev] v11.15.0 Released!   From: richard.mourino@PROTECTED Check the link for the uncompress file   got a 404    Richard Mourino ...Continue Reading

Thanks - Fixed, https://raw.githubusercontent.com/justingit/dada-mail/v11_15_0-stable_2021_08_30/uncompress_dada.cgi -- Justin J: Lead Dadaist*url:         dadamailproject.comemail:    justin@PROTECTEDtwitter:  @dadamailDada Mail Announcements: http://dadamailproject.com/cgi-bin/dada/mail.cgi/list/dada_announce/  On Aug 31, 2021, at 4:02 PM, Mourino richard.mourino@PROTECTED [Dada Mail Developers] <dadadev@PROTECTED> wrote: From: richard.m ...Continue Reading

Check the link for the uncompress file   got a 404    Richard Mourino ...Continue Reading

Hello everyone, v11.15.0 has been released! Download and install: https://dadamailproject.com/d/install_dada_mail.pod.html This version has protection from link prefetching, which can cause havoc on a mailing list’s functions. I’m not even kidding. Here’s a blog post showing an example of how this can happen in something as widely used as Apple’s Mail app: https://blog.dadamailproject.com/2021/08/31/link-prefetching-protection-in-dada-mail-v11-15-0-and-other-security-enhancements/ I’m suggesting this is one of those, ...Continue Reading