On Mon, 22 Nov 2004 14:23:59 -0500, Douglas Palmer <[log in to unmask]> wrote: >When users as for a list of all lists from "Subscriber's Corner" they only >see the lists they are subscribed to. At least one listowner is swearing >that this worked (ie, all lists showed up) two weeks ago and now they do >not. Nothing has changed in the past month other than a few new lists >bringing the total to about 60 lists. Subscriber's Corner was designed and is intended as a page from which a Subscriber (to one or more lists on a server, usually to many lists) can easily manage their subscriptions to some/all lists at one time/place (for example, setting all lists to NOMAIL when going on vacation). Since subscription settings are being modified, obviously the user is required to login and authenticate themselves. If the user has already logged in, and they select "All-Lists" (and submit) they MAY see more lists than the ones they are subscribed to, if there are any lists which are Confidential=No. If not, they will not see any more lists than those they are subscribed to. Subscriber's Corner was not designed and is not intended as a page from which non-subscribers can see a nice 'list-of-lists' they may possibly choose to join. As noted, a login is required to access Subscriber's Corner at all and it makes no sense to require a login of non-subscribers before seeing a 'list-of-lists'. There are also known issues with Subscriber's Corner in 1.8e and several changes have been made in various builds. A forthcoming version of LISTSERV will have this fixed and a new template page will be available for the Server Admin to define the 'list-of-lists' that non-subscribers may see when the "All-Lists" selection is made. Note carefully that for reasons of Security, the cgi script "WA" cannot ask LISTSERV for a listing of all available lists on the server unless the request is authenticated by some user's login. What will be shown at that time will depend on the privileges available to that logged-in user account which for most ordinary subscribers is a very low level of privilege (only the list(s) you are subscribed to). Yes, it seems to be an inconvenience. But otherwise it would be a huge security hole. What is happening here under the hood is the same security that applies to the 'LISTS' command sent by email, which was changed several years ago. Non-subscribers get this message: >> lists >None of the lists on this server are visible through the LISTS command. >Please use the "LIST GLOBAL" command to find mailing lists of interest. ... Subscribers get a list of only the list(s) they are subscribed to plus possibly "public" lists. List Owners get the list(s) they are owner= of and any others they are subscribed to. Site Admins (only) get all lists on the server.