cvs-syncmail-talk — User & developer discussions for the "syncmail" CVS checkin notification tool

[Cvs-syncmail] security patch commited

[Zooko <zo...@zo...>]

I committed a patch to prevent any dangerous values from being execed in the 
popen call to `cvs'.

http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/cvs-syncmail/syncmail/syncmail

Curiously, the commit hasn't been mailed to cvs-syncmail-talk by syncmail 
yet...  :-)

Regards,

Zooko

---
                 zooko.com
Security and Distributed Systems Engineering
---

[Cvs-syncmail] CVSROOT syncmail,1.5,1.6

[<bw...@lo...>]

Update of /cvsroot/cvs-syncmail/CVSROOT
In directory usw-pr-cvs1:/tmp/cvs-serv12536

Modified Files:
	syncmail 
Log Message:
getdomain(): Use byaddr[0] instead of aliases[0] ;)


Index: syncmail
===================================================================
RCS file: /cvsroot/cvs-syncmail/CVSROOT/syncmail,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -d -r1.5 -r1.6
--- syncmail	3 Apr 2002 19:25:00 -0000	1.5
+++ syncmail	3 Apr 2002 19:56:24 -0000	1.6
@@ -164,7 +164,7 @@
         hostname = socket.gethostname()
         byaddr = socket.gethostbyaddr(socket.gethostbyname(hostname))
         aliases = byaddr[1]
-        aliases.insert(0, aliases[0])
+        aliases.insert(0, byaddr[0])
         aliases.insert(0, hostname)
         for fqdn in aliases:
             if '.' in fqdn:

[Cvs-syncmail] syncmail syncmail,1.5,1.6

[<bw...@lo...>]

Update of /cvsroot/cvs-syncmail/syncmail
In directory usw-pr-cvs1:/tmp/cvs-serv1072

Modified Files:
	syncmail 
Log Message:
More Python 2.x eradication


Index: syncmail
===================================================================
RCS file: /cvsroot/cvs-syncmail/syncmail/syncmail,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -d -r1.5 -r1.6
--- syncmail	3 Apr 2002 19:15:54 -0000	1.5
+++ syncmail	3 Apr 2002 19:25:58 -0000	1.6
@@ -71,9 +71,9 @@
 import getopt
 import smtplib
 import pwd
+import socket
 
 from cStringIO import StringIO
-from socket import gethostname
 
 # Which SMTP server to do we connect to?  Empty string means localhost.
 MAILHOST = ''
@@ -156,6 +156,26 @@
 
 
 
+def getdomain():
+    try:
+        fqdn = socket.getfqdn()
+    except AttributeError:
+        # Python 1.5.2 :(
+        hostname = socket.gethostname()
+        byaddr = socket.gethostbyaddr(socket.gethostbyname(hostname))
+        aliases = byaddr[1]
+        aliases.insert(0, aliases[0])
+        aliases.insert(0, hostname)
+        for fqdn in aliases:
+            if '.' in fqdn:
+                break
+        else:
+            fqdn = 'localhost.localdomain'
+    parts = string.split(fqdn, DOT)
+    return string.join(parts[1:], DOT)
+
+
+
 def blast_mail(subject, people, filestodiff, contextlines):
     # cannot wait for child process or that will cause parent to retain cvs
     # lock for too long.  Urg!
@@ -167,7 +187,7 @@
         conn = smtplib.SMTP()
         conn.connect(MAILHOST, MAILPORT)
         user = pwd.getpwuid(os.getuid())[0]
-        domain = string.join(string.split(gethostname(), DOT)[1:], DOT)
+        domain = getdomain()
         author = '%s@%s' % (user, domain)
         s = StringIO()
         sys.stdout = s

[Cvs-syncmail] CVS: CVSROOT loginfo,1.2,1.3 syncmail,1.1,1.2

[Barry W. <bw...@us...>]

Update of /cvsroot/cvs-syncmail/CVSROOT
In directory usw-pr-cvs1:/tmp/cvs-serv23986

Modified Files:
	loginfo syncmail 
Log Message:
Switch to using unified diffs.  Also, use the new -q/--quiet flag.
Install the sync'd syncmail script.  This merges in features used in
the pydotorg project, namely, it uses string methods (Python 2.0 at
least, required), and uses a direct smtplib connection instead of
mucking about with /bin/mail.



Index: loginfo
===================================================================
RCS file: /cvsroot/cvs-syncmail/CVSROOT/loginfo,v
retrieving revision 1.2
retrieving revision 1.3
diff -C2 -d -r1.2 -r1.3
*** loginfo	25 Mar 2002 21:57:12 -0000	1.2
--- loginfo	3 Apr 2002 18:56:38 -0000	1.3
***************
*** 1,2 ****
--- 1,3 ----
+ # -*- ksh -*-
  # The "loginfo" file controls where "cvs commit" log information
  # is sent.  The first entry on a line is a regular expression which must match
***************
*** 26,28 ****
  #DEFAULT (echo ""; id; echo %{sVv}; date; cat) >> $CVSROOT/CVSROOT/commitlog
  
! DEFAULT $CVSROOT/CVSROOT/syncmail %{sVv} cvs...@li...
--- 27,29 ----
  #DEFAULT (echo ""; id; echo %{sVv}; date; cat) >> $CVSROOT/CVSROOT/commitlog
  
! DEFAULT $CVSROOT/CVSROOT/syncmail -q -u %{sVv} cvs...@li...

Index: syncmail
===================================================================
RCS file: /cvsroot/cvs-syncmail/CVSROOT/syncmail,v
retrieving revision 1.1
retrieving revision 1.2
diff -C2 -d -r1.1 -r1.2
*** syncmail	25 Mar 2002 21:59:19 -0000	1.1
--- syncmail	3 Apr 2002 18:56:38 -0000	1.2
***************
*** 1,4 ****
  #! /usr/bin/python
- #  -*- Python -*-
  
  """Complicated notification for CVS checkins.
--- 1,3 ----
***************
*** 36,41 ****
      	variable must exist in the environment.
  
!     --help
!     -h
          Print this text.
  
--- 35,39 ----
      	variable must exist in the environment.
  
!     --help / -h
          Print this text.
  
***************
*** 48,52 ****
  
      -u
!         Produce a unified diff (smaller, but harder to read).
  
      <%%S>
--- 46,53 ----
  
      -u
!         Produce a unified diff (smaller).
! 
!     --quiet/-q
!         Don't print as much status to stdout.
  
      <%%S>
***************
*** 59,73 ****
      email-addrs
          At least one email address.
- 
  """
  
  import os
  import sys
- import string
  import time
  import getopt
  
! # Notification command
! MAILCMD = '/bin/mail -s "CVS: %(SUBJECT)s" %(PEOPLE)s 2>&1 > /dev/null'
  
  # Diff trimming stuff
--- 60,78 ----
      email-addrs
          At least one email address.
  """
  
  import os
  import sys
  import time
  import getopt
+ import smtplib
+ import pwd
  
! from cStringIO import StringIO
! from socket import gethostname
! 
! # Which SMTP server to do we connect to?  Empty string means localhost.
! MAILHOST = ''
! MAILPORT = 25
  
  # Diff trimming stuff
***************
*** 76,79 ****
--- 81,89 ----
  DIFF_TRUNCATE_IF_LARGER = 1000
  
+ EMPTYSTRING = ''
+ SPACE = ' '
+ DOT = '.'
+ COMMASPACE = ', '
+ 
  PROGRAM = sys.argv[0]
  
***************
*** 93,97 ****
  def calculate_diff(filespec, contextlines):
      try:
!         file, oldrev, newrev = string.split(filespec, ',')
      except ValueError:
          # No diff to report
--- 103,107 ----
  def calculate_diff(filespec, contextlines):
      try:
!         file, oldrev, newrev = filespec.split(',')
      except ValueError:
          # No diff to report
***************
*** 109,113 ****
              # lines to figure it out:
              for line in lines[:5]:
!                 for c in string.rstrip(line):
                      if c < ' ' or c > chr(127):
                          lines = BINARY_EXPLANATION_LINES[:]
--- 119,123 ----
              # lines to figure it out:
              for line in lines[:5]:
!                 for c in line.rstrip():
                      if c < ' ' or c > chr(127):
                          lines = BINARY_EXPLANATION_LINES[:]
***************
*** 139,147 ****
          lines.insert(DIFF_HEAD_LINES,
                       '[...%d lines suppressed...]\n' % removedlines)
!     return string.join(lines, '')
  
  
  
! def blast_mail(mailcmd, filestodiff, contextlines):
      # cannot wait for child process or that will cause parent to retain cvs
      # lock for too long.  Urg!
--- 149,157 ----
          lines.insert(DIFF_HEAD_LINES,
                       '[...%d lines suppressed...]\n' % removedlines)
!     return EMPTYSTRING.join(lines)
  
  
  
! def blast_mail(subject, people, filestodiff, contextlines):
      # cannot wait for child process or that will cause parent to retain cvs
      # lock for too long.  Urg!
***************
*** 150,162 ****
          # give up the lock you cvs thang!
          time.sleep(2)
!         fp = os.popen(mailcmd, 'w')
!         fp.write(sys.stdin.read())
!         fp.write('\n')
          # append the diffs if available
          for file in filestodiff:
!             fp.write(calculate_diff(file, contextlines))
!             fp.write('\n')
!         fp.close()
!         # doesn't matter what code we return, it isn't waited on
          os._exit(0)
  
--- 160,185 ----
          # give up the lock you cvs thang!
          time.sleep(2)
!         # Create the smtp connection to the localhost
!         conn = smtplib.SMTP()
!         conn.connect(MAILHOST, MAILPORT)
!         user = pwd.getpwuid(os.getuid())[0]
!         domain = DOT.join(gethostname().split(DOT)[1:])
!         author = '%s@%s' % (user, domain)
!         s = StringIO()
!         print >> s, '''\
! From: %(author)s
! To: %(people)s
! Subject: %(subject)s
! ''' % {'author' : author,
!        'people' : COMMASPACE.join(people),
!        'subject': subject,
!        }
!         s.write(sys.stdin.read())
          # append the diffs if available
+         print >> s
          for file in filestodiff:
!             print >> s, calculate_diff(file, contextlines)
!         resp = conn.sendmail(author, people, s.getvalue())
!         conn.close()
          os._exit(0)
  
***************
*** 165,176 ****
  # scan args for options
  def main():
-     contextlines = 2
      try:
!         opts, args = getopt.getopt(sys.argv[1:], 'hC:cu',
!                                    ['context=', 'cvsroot=', 'help'])
      except getopt.error, msg:
          usage(1, msg)
  
      # parse the options
      for opt, arg in opts:
          if opt in ('-h', '--help'):
--- 188,200 ----
  # scan args for options
  def main():
      try:
!         opts, args = getopt.getopt(sys.argv[1:], 'hC:cuq',
!                                    ['context=', 'cvsroot=', 'help', 'quiet'])
      except getopt.error, msg:
          usage(1, msg)
  
      # parse the options
+     contextlines = 2
+     verbose = 1
      for opt, arg in opts:
          if opt in ('-h', '--help'):
***************
*** 185,188 ****
--- 209,214 ----
          elif opt == '-u':
              contextlines = 0
+         elif opt in ('-q', '--quiet'):
+             verbose = 0
  
      # What follows is the specification containing the files that were
***************
*** 192,197 ****
      if not args:
          usage(1, 'No CVS module specified')
!     SUBJECT = args[0]
!     specs = string.split(args[0])
      del args[0]
  
--- 218,223 ----
      if not args:
          usage(1, 'No CVS module specified')
!     subject = args[0]
!     specs = args[0].split()
      del args[0]
  
***************
*** 201,208 ****
  
      # Now do the mail command
!     PEOPLE = string.join(args)
!     mailcmd = MAILCMD % vars()
  
-     print 'Mailing %s...' % PEOPLE
      if specs == ['-', 'Imported', 'sources']:
          return
--- 227,235 ----
  
      # Now do the mail command
!     people = args
! 
!     if verbose:
!         print 'Mailing %s...' % COMMASPACE.join(people)
  
      if specs == ['-', 'Imported', 'sources']:
          return
***************
*** 213,224 ****
          for s in specs[2:]:
              prev = L[-1]
!             if string.count(prev, ",") < 2:
                  L[-1] = "%s %s" % (prev, s)
              else:
                  L.append(s)
          specs = L
!     print 'Generating notification message...'
!     blast_mail(mailcmd, specs[1:], contextlines)
!     print 'Generating notification message... done.'
  
  
--- 240,254 ----
          for s in specs[2:]:
              prev = L[-1]
!             if prev.count(',') < 2:
                  L[-1] = "%s %s" % (prev, s)
              else:
                  L.append(s)
          specs = L
! 
!     if verbose:
!         print 'Generating notification message...'
!     blast_mail(subject, people, specs[1:], contextlines)
!     if verbose:
!         print 'Generating notification message... done.'
  
  

[Cvs-syncmail] security patch for syncmail

[Zooko <zo...@zo...>]

[Cc: ro...@sf..., ro...@cv..., because I can't find an e-mail address 
@sf.net to which I should report this.]

Folks:

I experimented a bit and confirmed that with current HEAD version of syncmail it 
is indeed possible to invoke arbitrary shell commands like this:

$ mkdir test\"\;eval
$ touch test\"\;eval\ /whoami\;\"echo\
$ cvs add test\"\;eval\ /whoami\;\"echo\
$ cvs commit -m " Don't look -- it's too awful."

I was able to run "whoami" on cvs.pyutil.sourceforge.net as user `zooko', 
despite the fact that the `zooko' account on that machine is a restricted shell 
which is disallowed from all actions other than invoking cvs.

Here is a patch appended, named "Patch 3", which fixes this hole.  You should 
also consider the prophylactic clean-up patch, "Patch 1":

[1] http://sourceforge.net/mailarchive/forum.php?thread_id=561598&forum_id=8207

If you apply Patch 2:

[2] http://sourceforge.net/mailarchive/forum.php?thread_id=561512&forum_id=8207

then it supercedes the appended Patch 3 (but you should still apply Patch 1).

Please let me know if I should use patch manager for this.  Feel free to give me 
cvs write access (account name: zooko) if you want me to commit these myself.

Regards,

Zooko

---
                 zooko.com
Security and Distributed Systems Engineering
---

[3] Patch 3:

Index: syncmail
===================================================================
RCS file: /cvsroot/pyutil/CVSROOT/syncmail,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- syncmail	27 Mar 2002 11:28:01 -0000	1.3
+++ syncmail	27 Mar 2002 11:59:44 -0000	1.4
@@ -68,7 +68,7 @@
 import getopt
 
 # Notification command
-MAILCMD = '/bin/mail -s "CVS: %(SUBJECT)s" %(PEOPLE)s 2>&1 > /dev/null'
+MAILCMD = "/bin/mail -s 'CVS: %(SUBJECT)s' %(PEOPLE)s 2>&1 > /dev/null"
 
 # Diff trimming stuff
 DIFF_HEAD_LINES = 20
@@ -191,7 +191,7 @@
     # $CVSROOT, followed by the list of files that are changing.
     if not args:
         usage(1, 'No CVS module specified')
-    SUBJECT = args[0]
+    SUBJECT = string.replace(args[0], "'", '"')
     specs = string.split(args[0])
     del args[0]
 

[Cvs-syncmail] patch: no "CVS: " in subject line

[Zooko <zo...@zo...>]

My subject lines look this:

[Mnet-cvs] CVS: add ``safe_zlib_decompress_spool_to_file()"

The "CVS: " is redundant with the more informative "[Mnet-cvs] ", so this patch 
removes it:

Index: syncmail
===================================================================
RCS file: /cvsroot/mnet/CVSROOT/syncmail,v
retrieving revision 1.18
diff -u -d -r1.18 syncmail
--- syncmail	17 Mar 2002 15:33:27 -0000	1.18
+++ syncmail	21 Mar 2002 16:53:57 -0000
@@ -70,7 +70,7 @@
 import time
 
 # Notification command
-MAILCMD = "/bin/mail -s 'CVS: %(SUBJECT)s' %(PEOPLE)s 2>&1 > /dev/null"
+MAILCMD = "/bin/mail -s '%(SUBJECT)s' %(PEOPLE)s 2>&1 > /dev/null"
 
 # Diff trimming stuff
 DIFF_HEAD_LINES = 20

Re: [Cvs-syncmail] patch: security fix

[Zooko <zo...@zo...>]

Whoops.  The security patch was strict on what a legitimate revision number 
looks like.  Here's a patch that fixes that.

Regards,

Zooko

---
                 zooko.com
Security and Distributed Systems Engineering
---
Index: syncmail
===================================================================
RCS file: /cvsroot/mnet/CVSROOT/syncmail,v
retrieving revision 1.17
diff -u -d -r1.17 syncmail
--- syncmail    17 Mar 2002 15:17:03 -0000      1.17
+++ syncmail    17 Mar 2002 15:32:21 -0000
@@ -92,7 +92,7 @@
 
 
 ^L
-REV_RE=re.compile("^[0-9.]+$")
+REV_RE=re.compile("^(NONE|[0-9.]+)$")
 def calculate_diff(filespec, contextlines):
     try:
         file, oldrev, newrev = string.split(filespec, ',')

[Cvs-syncmail] patch: security fix

[Zooko <zo...@zo...>]

The shell command invoked for sending mail is:

/bin/mail -s "CVS: %(SUBJECT)s" %(PEOPLE)s 2>&1 > /dev/null

SUBJECT is determined from the file name, version number, and tags.

Are you entirely sure that the file name, version number, and tags, couldn't 
contain a string like:

`rm -rf /`

or:

";cat /etc/passwd

?

I'm not entirely sure of that.  Anyway, with my patch for subject lines derived 
from log entries (in another message), it is *definitely* possible that the 
SUBJECT string could have such stuff.  My fix is to change the command to:

/bin/mail -s 'CVS: %(SUBJECT)s' %(PEOPLE)s 2>&1 > /dev/null

And to run SUBJECT through:

SUBJECT = string.replace(SUBJECT, "'", '"')

My reading of the bash 2.05 man page tells me that this should render the 
contents of SUBJECT inert when used in that command.  I hope the same applies to 
Bourne shell.

This much was already in the "subject lines from log entries" patch that 
I already submitted, but I subsequently went hunting for similar problems and 
appended is a patch which ensures that no other such sneakiness could get in 
to the other commands that syncmail invokes.  As a bonus, it also makes syncmail 
handle filenames with spaces (and all other kinds of weird character, except 
for '\').

Regards,

Zooko

---
                 zooko.com
Security and Distributed Systems Engineering
---

Index: syncmail
===================================================================
RCS file: /cvsroot/mnet/CVSROOT/syncmail,v
retrieving revision 1.14
retrieving revision 1.17
diff -u -r1.14 -r1.17
--- syncmail	17 Mar 2002 14:26:25 -0000	1.14
+++ syncmail	17 Mar 2002 15:17:03 -0000	1.17
@@ -61,11 +61,13 @@
 
 """
 
+# standard Python modules
+import getopt
 import os
-import sys
+import re
 import string
+import sys
 import time
-import getopt
 
 # Notification command
 MAILCMD = "/bin/mail -s 'CVS: %(SUBJECT)s' %(PEOPLE)s 2>&1 > /dev/null"
@@ -90,9 +92,29 @@
 
 
 
+REV_RE=re.compile("^[0-9.]+$")
 def calculate_diff(filespec, contextlines):
     try:
         file, oldrev, newrev = string.split(filespec, ',')
+        if not REV_RE.match(oldrev):
+            raise ValueError
+        if not REV_RE.match(newrev):
+            raise ValueError
+        if string.find(file, '\\') != -1:
+            # I'm sorry, a file name that contains a backslash is just too much.
+            # XXX if someone wants to figure out how to escape the backslashes in a safe way to allow filenames containing backslashes, this is the place to do it.  --Zooko 2002-03-17
+            raise ValueError
+        if string.find(file, "'") != -1:
+            # Those crazy users put single-quotes in their file names!
+            # Now we have to escape everything that is meaningful inside double-quotes.
+            filestr = string.replace(file, '`', '\`')
+            filestr = string.replace(filestr, '"', '\"')
+            filestr = string.replace(filestr, '$', '\$')
+            # and quote it with double-quotes.
+            filestr = '"' + filestr + '"'
+        else:
+            # quote it with single-quotes.
+            filestr = "'" + file + "'"
     except ValueError:
         # No diff to report
         return '***** Bogus filespec: %s' % filespec
@@ -101,7 +123,7 @@
             if os.path.exists(file):
                 fp = open(file)
             else:
-                update_cmd = 'cvs -fn update -r %s -p %s' % (newrev, file)
+                update_cmd = "cvs -fn update -r %s -p %s" % (newrev, filestr)
                 fp = os.popen(update_cmd)
             lines = fp.readlines()
             fp.close()
@@ -125,8 +147,7 @@
             difftype = "-C " + str(contextlines)
         else:
             difftype = "-u"
-        diffcmd = "/usr/bin/cvs -f diff -kk %s --minimal -r %s -r %s '%s'" % (
-            difftype, oldrev, newrev, file)
+        diffcmd = "/usr/bin/cvs -f diff -kk %s --minimal -r %s -r %s %s" % (difftype, oldrev, newrev, filestr)
         fp = os.popen(diffcmd)
         lines = fp.readlines()
         sts = fp.close()

[Cvs-syncmail] patch: subject lines from log entries

[Zooko <zo...@zo...>]

This patch makes the subject lines reflect the log entry and not the file name
and version number.

See the difference between these two mail archives:

http://www.geocrawler.com/archives/3/7495/2001/10/0/
http://www.geocrawler.com/archives/3/7495/2001/11/0/

Regards,

Zooko

---
                 zooko.com
Security and Distributed Systems Engineering
---

Index: syncmail
===================================================================
RCS file: /cvsroot/mnet/CVSROOT/syncmail,v
retrieving revision 1.9
retrieving revision 1.14
diff -u -r1.9 -r1.14
--- syncmail	16 Mar 2002 14:25:15 -0000	1.9
+++ syncmail	17 Mar 2002 14:26:25 -0000	1.14
@@ -68,7 +68,7 @@
 import getopt
 
 # Notification command
-MAILCMD = '/bin/mail -s "CVS: %(SUBJECT)s" %(PEOPLE)s 2>&1 > /dev/null'
+MAILCMD = "/bin/mail -s 'CVS: %(SUBJECT)s' %(PEOPLE)s 2>&1 > /dev/null"
 
 # Diff trimming stuff
 DIFF_HEAD_LINES = 20
@@ -142,7 +142,7 @@
 
 
 
-def blast_mail(mailcmd, filestodiff, contextlines):
+def blast_mail(mailcmd, filestodiff, contextlines, logentry):
     # cannot wait for child process or that will cause parent to retain cvs
     # lock for too long.  Urg!
     if not os.fork():
@@ -150,7 +150,7 @@
         # give up the lock you cvs thang!
         time.sleep(2)
         fp = os.popen(mailcmd, 'w')
-        fp.write(sys.stdin.read())
+        fp.write(logentry)
         fp.write('\n')
         # append the diffs if available
         for file in filestodiff:
@@ -160,6 +160,33 @@
         # doesn't matter what code we return, it isn't waited on
         os._exit(0)
 
+
+def abbreviate_logentry_for_subject(logentry):
+    WIDTHLIMIT = 80
+    SUBJECTSIZE = len('Subject: ')
+    LMstr='Log Message:'
+    i = string.find(logentry, LMstr)
+    if i == -1:
+        # Whoops.  Whatever.
+        # the caller will fallback to old-style when it sees `None'
+        return None
+    subject = logentry[i+len(LMstr):]
+    while (len(subject) > 0) and (subject[0] not in string.letters+string.digits):
+        subject = subject[1:] # I have the feeling that there's a nicer way to do this...
+    subject = string.replace(subject, "'", '"')
+    # Now break at the first line break
+    i = string.find(subject, '\n')
+    if i == -1:
+        i = len(subject)
+    j = string.find(subject, '\r')
+    if j == -1:
+        j = len(subject)
+    subject = subject[:min(i,j)]
+
+    if len(subject) < (WIDTHLIMIT - SUBJECTSIZE):
+        return subject
+    else:
+        return subject[:(WIDTHLIMIT - SUBJECTSIZE - 3)] + "..."
 
 
 # scan args for options
@@ -185,13 +212,18 @@
         elif opt == '-u':
             contextlines = 0
 
+    # The log entry is on stdin.  --Zooko 2001-11-21
+    logentry = sys.stdin.read()
+    SUBJECT = abbreviate_logentry_for_subject(logentry)
+    if SUBJECT is None:
+        SUBJECT = args[0]
+
     # What follows is the specification containing the files that were
     # modified.  The argument actually must be split, with the first component
     # containing the directory the checkin is being made in, relative to
     # $CVSROOT, followed by the list of files that are changing.
     if not args:
         usage(1, 'No CVS module specified')
-    SUBJECT = args[0]
     specs = string.split(args[0])
     del args[0]
 
@@ -218,7 +250,8 @@
                 L.append(s)
         specs = L
     print 'Generating notification message...'
-    blast_mail(mailcmd, specs[1:], contextlines)
+
+    blast_mail(mailcmd, specs[1:], contextlines, logentry)
     print 'Generating notification message... done.'