Repeated "do_distribute" actions from Web interface generate backscatter emails to sympa-request alias.

[dpc22]

Version

6.2.72

Installation method

My own rpm, derived from the official rpm for RHEL 7

Expected behavior

If a list has multiple moderators/editors, then several different people may end up clicking on the link which is quoted:

To distribute the attached message in list test-dpc22:
https://test.lists.cam.ac.uk/sympa/distribute/test-dpc22/27b3d4060d27cde48be65c41039b3f86

The second and any further person to click on the link sees an error popup of the form:

ERROR (distribute) - Unable to access the message on list test-dpc22 with key 27b3d4060d27cde48be65c41039b3f86.
Warning: this message may already have been sent by one of the list's moderators.

which would work nicely if that was all that happened.

Actual behavior

Each time that someone clicks on the link after the message has been approved or rejected, sympa-request receives an email of the form:

Date: Thu, 16 Nov 2023 10:45:14 +0000
To: sympa-request@test.lists.cam.ac.uk
From: "SYMPA" <sympa-request@test.lists.cam.ac.uk>

This is an automatic response sent by Sympa Mailing Lists Manager.
Impossible to distribute your message for list '[sympa@test.lists.cam.ac.uk](mailto:sympa@test.lists.cam.ac.uk)'
for the following reason:

No command found in message.

We run a site with 8000 Sympa lists and see at least a dozen of these messages each day.

Steps to reproduce

Click on the "sympa/distribute" link in a moderation email several times. The second and subsequent clicks log:

Nov 16 10:45:11 lists-2 wwsympa[12679]: err main::#1562 > main::do_distribute#7740 [robot test.lists.cam.ac.uk] [session 71904242148240] [client 172.16.56.50] [user dpc22@cam.ac.uk] [list test-dpc22] Unable to find message with <27b3d4060d27cde48be65c41039b3f86> for list Sympa::List <test-dpc22@test.lists.cam.ac.uk>

Nov 16 10:45:14 lists-2 sympa_msg[8261]: info Sympa::Spindle::DoCommand::_twist() No command found in message Sympa::Message <sympa@test.lists.cam.ac.uk.1700131511.12679,5912/shelved:arc_cv=none>

Additional information

I'm pretty sure that this is because wwsympa.fcgi do_distribute() translates each click within the Web interface into an internal email message with zero or more "QUIET DISTRIBUTE" commands:

sub do_distribute {
    [...]
    # Load message list.
    my @mail_command = ();
    foreach my $id (@ids) {    # QUIET DISTRIBUTE
       [...]
       unless ($message) {
            add_stash('user', 'already_moderated', {key => $id});
            wwslog('err', 'Unable to find message with <%s> for list %s',
                $id, $list);
            web_db_log(
                {   'parameters' => $id,
                    'status'     => 'error',
                    'error_type' => 'internal'
                }
            );
            next;
        }
        push @mail_command,
            sprintf('QUIET DISTRIBUTE %s %s', $list->{'name'}, $id);
       [...]
   }
   [...]

   # Commands are injected into incoming spool directly with "md5"
    # authentication level.
    my $cmd_message = Sympa::Message->new(
        sprintf("\n\n%s\n", join("\n", @mail_command)),
        context         => $robot,
        envelope_sender => Sympa::get_address($robot, 'owner'),
        sender          => $param->{'user'}{'email'},
        md5_check       => 1,
        message_id      => Sympa::unique_message_id($robot)
    );

It looks like there should be a trivial fix where we only run Sympa::Message->new() when @mail_command is a non-empty list.

[dpc22]

I ended up redirecting sympa-request@lists.cam.ac.uk to /dev/null, as I don't think that is actually used for anything real.

I'm happy to put together a one line patch as a git pull request if that helps.

[dpc22]

Here's the patch that I propose though:

sympa-6.2.72-dpc_do_distribute.patch

[ikedas]

Hi @dpc22, Thanks for reporting bug and suggesting fix! Could you please submit PR including your fix?

[dpc22]

Okay, I think that I have done this, although it took me some time to remember how pull requests work.

https://github.com/sympa-community/sympa/pull/1818

I'm not a developer and I don't do this very often.