/********************************************************************\

  Name:         auth.c
  Created by:   Stefan Ritt
  Copyright 2000 + Stefan Ritt

  ELOG is free software: you can redistribute it and/or modify
  it under the terms of the GNU General Public License as published by
  the Free Software Foundation, either version 3 of the License, or
  (at your option) any later version.

  ELOG is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU General Public License for more details.

  You should have received a copy of the GNU General Public License
  along with ELOG.  If not, see <http://www.gnu.org/licenses/>.


  Contents:     Authentication subroutines. Currently supported:

                - password file authentication
                - kerberos5 password authentication

  $Id: elog.c 2350 2010-12-23 10:45:10Z ritt $

\********************************************************************/

#include "elogd.h"

#ifdef HAVE_KRB5
#include <krb5.h>
#endif

#ifdef HAVE_LDAP
#include <ldap.h>

LDAP *ldap_ld;
char ldap_login_attr[64];
char ldap_dn_user[256];
char ldap_pw_user[64];
char ldap_userbase[256];
char ldap_bindDN[512];
#endif  /* HAVE_LDAP */

extern LOGBOOK *lb_list;

/*==================================================================*/

/*---- Kerberos5 routines ------------------------------------------*/

#ifdef HAVE_KRB5

int auth_verify_password_krb5(LOGBOOK * lbs, const char *user, const char *password, char *error_str,
                              int error_size)
{
   char *princ_name, str[256], realm[256];
   krb5_error_code error;
   krb5_principal princ;
   krb5_context context;
   krb5_creds creds;
   krb5_get_init_creds_opt options;

   if (krb5_init_context(&context) < 0)
      return FALSE;

   strlcpy(str, user, sizeof(str));
   if (getcfg(lbs->name, "Kerberos Realm", realm, sizeof(realm))) {
      strlcat(str, "@", sizeof(str));
      strlcat(str, realm, sizeof(str));
   }
   if ((error = krb5_parse_name(context, str, &princ)) != 0) {
      strlcpy(error_str, "<b>Kerberos error:</b>
", error_size);
      strlcat(error_str, krb5_get_error_message(context, error), error_size);
      strlcat(error_str, ".
Please check your Kerberos configuration.", error_size);
      return FALSE;
   }

   error = krb5_unparse_name(context, princ, &princ_name);
   if (error) {
      strlcpy(error_str, "<b>Kerberos error:</b>
", error_size);
      strlcat(error_str, krb5_get_error_message(context, error), error_size);
      strlcat(error_str, ".
Please check your Kerberos configuration.", error_size);
      return FALSE;
   }

   sprintf(str, "Using %s as server principal for authentication", princ_name);
   write_logfile(lbs, str);

   memset(&options, 0, sizeof(options));
   krb5_get_init_creds_opt_init(&options);
   memset(&creds, 0, sizeof(creds));
   error = krb5_get_init_creds_password(context, &creds, princ,
                                        (char *) password, NULL, NULL, 0, NULL, &options);

   krb5_free_context(context);

   if (error && error != KRB5KDC_ERR_PREAUTH_FAILED && error != KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN) {
      sprintf(error_str, "<b>Kerberos error %d:</b>
", error);
      strlcat(error_str, krb5_get_error_message(context, error), error_size);
      strlcat(error_str, ".
Please check your Kerberos configuration.", error_size);
      return FALSE;
   }

   if (error)
      return FALSE;

   return TRUE;
}

int auth_change_password_krb5(LOGBOOK * lbs, const char *user, const char *old_pwd, const char *new_pwd,
                              char *error_str, int error_size)
{
   char *princ_name, str[256], realm[256];
   int result_code, n;
   krb5_error_code error;
   krb5_data result_code_string, result_string;
   krb5_principal princ;
   krb5_context context;
   krb5_creds creds;
   krb5_get_init_creds_opt options;

   if (krb5_init_context(&context) < 0)
      return FALSE;

   strlcpy(str, user, sizeof(str));
   if (getcfg(lbs->name, "Kerberos Realm", realm, sizeof(realm))) {
      strlcat(str, "@", sizeof(str));
      strlcat(str, realm, sizeof(str));
   }
   if ((error = krb5_parse_name(context, str, &princ)) != 0) {
      strlcpy(error_str, "<b>Kerberos error:</b>
", error_size);
      strlcat(error_str, krb5_get_error_message(context, error), error_size);
      strlcat(error_str, ".
Please check your Kerberos configuration.", error_size);
      return FALSE;
   }

   error = krb5_unparse_name(context, princ, &princ_name);

   sprintf(str, "Using %s as server principal for authentication", princ_name);
   write_logfile(lbs, str);

   memset(&options, 0, sizeof(options));
   krb5_get_init_creds_opt_init(&options);
   krb5_get_init_creds_opt_set_tkt_life(&options, 300);
   krb5_get_init_creds_opt_set_forwardable(&options, FALSE);
   krb5_get_init_creds_opt_set_proxiable(&options, FALSE);

   memset(&creds, 0, sizeof(creds));
   error = krb5_get_init_creds_password(context, &creds, princ,
                                        (char *) old_pwd, NULL, NULL, 0, "kadmin/changepw", &options);
   if (error) {
      strlcpy(error_str, "<b>Kerberos error:</b>
", error_size);
      strlcat(error_str, krb5_get_error_message(context, error), error_size);
      strlcat(error_str, ".
Please check your Kerberos configuration.", error_size);
      return FALSE;
   }

   error = krb5_set_password(context, &creds, (char *) new_pwd, princ,
                             &result_code, &result_code_string, &result_string);
   if (error) {
      strlcpy(error_str, "<b>Kerberos error:</b>
", error_size);
      strlcat(error_str, krb5_get_error_message(context, error), error_size);
      strlcat(error_str, ".
Please check your Kerberos configuration.", error_size);
      return FALSE;
   }

   if (result_code > 0) {
      if (result_code_string.length > 0) {
         strlcpy(error_str, result_code_string.data, error_size);
         if ((int) result_code_string.length < error_size)
            error_str[result_code_string.length] = 0;
      }
      if (result_string.length > 0) {
         strlcat(error_str, ": ", error_size);
         n = strlen(error_str) + result_string.length;
         strlcat(error_str, result_string.data, error_size);
         if (n < error_size)
            error_str[n] = 0;
      }
   }

   krb5_free_data_contents(context, &result_code_string);
   krb5_free_data_contents(context, &result_string);
   krb5_free_cred_contents(context, &creds);
   krb5_get_init_creds_opt_free(context, &options);
   krb5_free_context(context);

   if (result_code > 0)
      return FALSE;

   return TRUE;
}
#endif

/*---- LDAP routines ------------------------------------------*/

#ifdef HAVE_LDAP

int ldap_init(LOGBOOK *lbs, char *error_str, int error_size)
{
   char str[512], ldap_server[256];
   int version;
   int bind=0;
   
   // Read Config file
   if (getcfg(lbs->name, "LDAP server", ldap_server, sizeof(ldap_server))) {
      strlcpy(str, ldap_server, sizeof(str));
   }
   else   {
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      strlcat(str, "ERR: Cannot find LDAP server entry!", sizeof(str));
      write_logfile(lbs, str);
      return FALSE;
   }
   
   if (!getcfg(lbs->name, "LDAP userbase", ldap_userbase, sizeof(ldap_userbase))) {
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      strlcat(str, ", ERR: Cannot find LDAP userbase (e.g. \'ou=People,dc=example,dc=org\')!", sizeof(str));
      write_logfile(lbs, str);
      return FALSE;
   }
   
   if (!getcfg(lbs->name, "LDAP login attribute", ldap_login_attr, sizeof(ldap_login_attr))) {
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      strlcat(str, ", ERR: Cannot find LDAP login attribute (e.g. uid, cn, ...)!", sizeof(str));
      write_logfile(lbs, str);
      return FALSE;
   }

   if (!getcfg(lbs->name, "LDAP DN User", ldap_dn_user, sizeof(ldap_dn_user))) {
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      strlcat(str, ", ERR: Cannot find LDAP login attribute (e.g. uid, cn, ...)!", sizeof(str));
      write_logfile(lbs, str);
      return FALSE;
   }
   
   if (!getcfg(lbs->name, "LDAP PW User", ldap_pw_user, sizeof(ldap_pw_user))) {
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      strlcat(str, ", ERR: Cannot find LDAP login attribute (e.g. uid, cn, ...)!", sizeof(str));
      write_logfile(lbs, str);
      return FALSE;
   }
   // Initialize/open LDAP connection
   if(ldap_initialize( &ldap_ld, ldap_server )) {
      perror("ldap_initialize");
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      return FALSE;
   }

   // Use the LDAP_OPT_PROTOCOL_VERSION session preference to specify that the client is LDAPv3 client
   version = LDAP_VERSION3;
   ldap_set_option(ldap_ld, LDAP_OPT_PROTOCOL_VERSION, &version);
   
   write_logfile(lbs, str);
   
   return TRUE;
}

int auth_verify_password_ldap(LOGBOOK *lbs, const char *user, const char *password, char *error_str,
                              int error_size)
{  LDAPMessage *result, *err, *entry;
   int bind=0, i, rc=0, nb=0;
   char str[512], filter[512];
   char *attribute , *dn;
   BerElement *ber;
   BerValue **values;
    ldap_ld = NULL;
    memset(&ldap_bindDN[0], 0, sizeof(ldap_bindDN));
   struct timeval timeOut = {3,0}; // 3 second connection/search timeout
   // zerotime.tv_sec = zerotime.tv_usec = 0L;
   
   if(!ldap_init(lbs,error_str,error_size)) {
      strlcpy(error_str, "<b>LDAP initialization error</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      return FALSE;
   }
  
      printf("\n dn: %s\n", ldap_dn_user );
   //Bind with read account
   bind = ldap_simple_bind_s(ldap_ld, ldap_dn_user, ldap_pw_user, LDAP_AUTH_SIMPLE);
   if(bind != LDAP_SUCCESS) {
      strlcpy(error_str, "<b>LDAP BIND error with read account</b>
", error_size);
      strlcat(error_str, "
Please check your LDAP configuration.", error_size);
      return FALSE;
   }

   // search user
   sprintf(filter, "(%s=%s)", ldap_login_attr, user);

   rc = ldap_search_ext_s(
          ldap_ld,             // LDAP session handle
          ldap_userbase,       // Search Base

diff --git a/buildrpm b/buildrpm
index 9d21f4a..dba7067 100755
--- a/buildrpm
+++ b/buildrpm
@@ -12,7 +12,7 @@ set release = $argv[2]
 set dir = /tmp/elog-$version
 set archive = elog-$version-$release.tar.gz
 
-perl -wapi.bak -e 's&^(Version:\s+).*$&${1}'"${version}"'&;s&^(Release:\s+).*$&${1}'"${release}"'&;' elog.spec
+#perl -wapi.bak -e 's&^(Version:\s+).*$&${1}'"${version}"'&;s&^(Release:\s+).*$&${1}'"${release}"'&;' elog.spec
 
 # create temporary directory
 rm -Rf $dir
@@ -68,19 +68,33 @@ rm -Rf $dir
 
 # transfer archive
 echo Transfer archive...
-cp /tmp/$archive ~ritt/html/elog/download/tar/
-cp /tmp/$archive ~ritt/html/elog/download/tar/elog-latest.tar.gz
 cp /tmp/$archive ~/rpmbuild/SOURCES/elog-$version.tar.gz
-cd ~ritt/elog
-cp -f doc/ChangeLog ~ritt/html/elog/download/ChangeLog
+# If Stefan...
+if ( -d /home/ritt ) then
+  echo "Manager mode"
+  if ( -d ~ritt/html/elog/download/tar ) then
+    cp /tmp/$archive ~ritt/html/elog/download/tar/
+    cp /tmp/$archive ~ritt/html/elog/download/tar/elog-latest.tar.gz
+    cd ~ritt/elog
+    cp -f doc/ChangeLog ~ritt/html/elog/download/ChangeLog
+  endif
+endif
+cd -
 rm -f /tmp/$archive
 
+echo Cleanup $version-$release rpms
+rm -f ~/rpmbuild/RPMS/*/elog*${version}-${release}*.rpm
+rm -f ~/rpmbuild/SRPMS/elog*${version}-${release}*.rpm
 # building RPMs
-echo Build RPMs...
-rm -f ~/rpmbuild/RPMS/x86_64/*
-rm -f ~/rpmbuild/SRPMS/*
-rpmbuild -ba elog.spec || exit $?
-cp ~/rpmbuild/RPMS/x86_64/elog*rpm ~ritt/html/elog/download/RPMS/
-cp ~/rpmbuild/RPMS/x86_64/elog-$version-$release.x86_64.rpm ~ritt/html/elog/download/RPMS/elog-latest.x86_64.rpm
-cp ~/rpmbuild/SRPMS/elog*rpm ~ritt/html/elog/download/SRPMS/
-cp ~/rpmbuild/SRPMS/elog-$version-$release.src.rpm ~ritt/html/elog/download/SRPMS/elog-latest.src.rpm
+echo Build RPMs..
+rpmbuild -ba --define "version ${version}" --define "release ${release}" elog.spec || exit $?
+
+# If Stefan...
+if ( -d /home/ritt ) then
+  if ( -d ~ritt/html/elog/download/tar ) then
+    cp ~/rpmbuild/RPMS/x86_64/elog*rpm ~ritt/html/elog/download/RPMS/
+    cp ~/rpmbuild/RPMS/x86_64/elog-$version-$release.x86_64.rpm ~ritt/html/elog/download/RPMS/elog-latest.x86_64.rpm
+    cp ~/rpmbuild/SRPMS/elog*rpm ~ritt/html/elog/download/SRPMS/
+    cp ~/rpmbuild/SRPMS/elog-$version-$release.src.rpm ~ritt/html/elog/download/SRPMS/elog-latest.src.rpm
+  endif
+endif
diff --git a/elog.spec b/elog.spec
index 16add8f..8397eab 100755
--- a/elog.spec
+++ b/elog.spec
@@ -1,9 +1,13 @@
-# OpenSSH privilege separation requires a user & group ID
+# ELOG weblog application
+# rpmbuild -ba --define 'version 3.1.4' --define 'release 2' --define "date $(LC_TIME=En date '+%a %b %d %Y')" elog.spec
+ 
+#define	date	$(LC_TIME=En date '+%a %b %d %Y')      
+%define build_timestamp %(LC_TIME=En date '+%a %b %d %Y')
 
 Name:       elog
 Summary:    elog is a standalone electronic web logbook
-Version:    3.1.4
-Release:    2
+Version:    %version
+Release:    %release%{?dist}
 License:    GPL
 Group:      Applications/Networking
 Source:     http://elog.psi.ch/elog/download/elog-%{version}.tar.gz
@@ -41,6 +45,8 @@ access control, etc. Moreover, a single server can host several weblogs, and
 each weblog can be totally different from the rest. 
 
 %changelog
+* %{build_timestamp} Stefan Ritt <stefan.ritt@psi.ch> %version-%release
+- Updated from git 
 * Wed Sep 26 2018 Stefan Ritt <stefan.ritt@psi.ch>
 - Made adjustments for new elog server and RH7
 * Fri Aug 29 2014 Stefan Ritt <stefan.ritt@psi.ch>
@@ -72,7 +78,7 @@ each weblog can be totally different from the rest.
    -g elog -M -r elog 2>/dev/null || :
 
 %build
-make
+make CFLAGS='-O3 -funroll-loops -fomit-frame-pointer -W -Wall -Wno-deprecated-declarations -Imxml -g'
 sed "s#\@PREFIX\@#%{prefix}#g" elogd.init_template > elogd.init
 
 %install
diff --git a/elogd.init b/elogd.init
index 5d4e7ee..e04143c 100644
--- a/elogd.init
+++ b/elogd.init
@@ -6,6 +6,9 @@
 # config: /usr/local/elog/elogd.cfg
 # pidfile: /var/run/elogd.pid
 
+# RHEL
+[ -f /etc/init.d/functions ] && . /etc/init.d/functions
+
 # Check for the config file
 if [ ! -f /usr/local/elog/elogd.cfg ]; then
     exit 0
diff --git a/elogd.init_template b/elogd.init_template
index e94b5d7..bb1b330 100755
--- a/elogd.init_template
+++ b/elogd.init_template
@@ -6,6 +6,9 @@
 # config: @PREFIX@/elog/elogd.cfg
 # pidfile: /var/run/elogd.pid
 
+# RHEL
+[ -f /etc/init.d/functions ] && . /etc/init.d/functions
+
 # Check for the config file
 if [ ! -f @PREFIX@/elog/elogd.cfg ]; then
     exit 0

diff --git a/Makefile b/Makefile
index d8eecba..87cb502 100644
--- a/Makefile
+++ b/Makefile
@@ -23,16 +23,32 @@ RCDIR      = $(ROOT)/etc/rc.d/init.d
 SRVDIR     = $(ROOT)/usr/lib/systemd/system
 
 # flag for SSL support
+ifdef USESSL
 USE_SSL    = 1
+else
+USE_SSL    = 0
+endif
 
 # flag for Kerberos support, please turn on if you need Kerberos
+ifdef USEKRB5
+USE_KRB5   = 1
+else
 USE_KRB5   = 0
+endif
 
 # flag for LDAP support, please turn on if you need LDAP
+ifdef USELDAP
+USE_LDAP   = 1
+else
 USE_LDAP   = 0
+endif
 
 # flag for PAM support, please turn on if you need PAM
+ifdef USEPAM
+USE_PAM    = 1
+else
 USE_PAM    = 0
+endif
 
 #############################################################
 
diff --git a/buildrpm b/buildrpm
index 1c0b9bc..8dde819 100755
--- a/buildrpm
+++ b/buildrpm
@@ -1,17 +1,38 @@
 #!/bin/csh
-# Usage: build [-n] <version> <release>
+# Usage: build [-n] <version> <release> [-krb5] [-ldap] [-pam] [-ssl]
 # Build ELOG distribution
 
 if ($#argv < 2) then
-  echo "Usage: build <version> <release>"
+  echo "Usage: build <version> <release> [-krb5] [-ldap] [-pam] [-ssl]"
   exit
 endif
  
 set version = $argv[1]
 set release = $argv[2]
+set i = 0
+set BUILDOPTS=""
+foreach argument ($argv)
+  set i=`expr $i + 1`
+  if ($i <= 2) continue
+  switch ($argument)
+    case "-ldap":
+       set BUILDOPTS="$BUILDOPTS --with ldap"
+       breaksw
+    case "-pam":
+       set BUILDOPTS="$BUILDOPTS --with pam"
+       breaksw
+    case "-ssl":
+       set BUILDOPTS="$BUILDOPTS --with ssl"
+       breaksw
+    case "-krb5":
+       set BUILDOPTS="$BUILDOPTS --with krb5"
+       breaksw
+  endsw
+end
+
 set dist = `rpm --eval %{\?dist}`
 set dir = /tmp/elog-$version
-set archive = elog-$version.tar.gz
+set archive = elog-$version-$release.tar.gz
 
 # create temporary directory
 rm -Rf $dir
@@ -65,7 +86,8 @@ rm -Rf $dir
 
 # transfer archive
 echo Transfer archive...
-mkdir -p ~/rpmbuild/SOURCES && cp /tmp/$archive ~/rpmbuild/SOURCES/elog-$version.tar.gz
+[ ! -d ~/rpmbuild/SOURCES ] && mkdir -p ~/rpmbuild/SOURCES 
+cp /tmp/$archive ~/rpmbuild/SOURCES/elog-$version-$release.tar.gz
 
 # if running on at PSI copy to download area
 if (`hostname` == 'elog01.psi.ch') then
@@ -75,6 +97,8 @@ if (`hostname` == 'elog01.psi.ch') then
     cp -v /tmp/$archive ~ritt/html/elog/download/tar/elog-latest.tar.gz
     cp -vf doc/ChangeLog ~ritt/html/elog/download/ChangeLog
   endif
+  # define Factory Packager
+  set BUILDOPTS="${BUILDOPTS} --define \"packager Stefan Ritt <stefan.ritt@psi.ch>\""
 endif
 rm -f /tmp/$archive
 
@@ -83,8 +107,13 @@ rm -f ~/rpmbuild/RPMS/*/elog*${version}-${release}*.rpm
 rm -f ~/rpmbuild/SRPMS/elog*${version}-${release}*.rpm
 
 # building RPMs
+cp elog.spec.template ~/rpmbuild/SPECS/elog.spec
+sed -i "s/__ELOGVER__/${version}/;s/__ELOGREL__/${release}/" ~/rpmbuild/SPECS/elog.spec
 echo Build RPMs...
-rpmbuild -ba --define "version ${version}" --define "release ${release}" elog.spec || exit $?
+set factorydate = `env LC_TIME=C date '+%a %b %d %Y'`
+rpmbuild -ba ${BUILDOPTS} --define "factorydate ${factorydate}" \
+	--define "version ${version}" --define "elogrel ${release}" \
+	~/rpmbuild/SPECS/elog.spec || exit $?
 
 # if running on at PSI copy to download area
 if (`hostname` == 'elog01.psi.ch') then
diff --git a/elog.spec b/elog.spec
deleted file mode 100755
index 8397eab..0000000
--- a/elog.spec
+++ /dev/null
@@ -1,107 +0,0 @@
-# ELOG weblog application
-# rpmbuild -ba --define 'version 3.1.4' --define 'release 2' --define "date $(LC_TIME=En date '+%a %b %d %Y')" elog.spec
- 
-#define	date	$(LC_TIME=En date '+%a %b %d %Y')      
-%define build_timestamp %(LC_TIME=En date '+%a %b %d %Y')
-
-Name:       elog
-Summary:    elog is a standalone electronic web logbook
-Version:    %version
-Release:    %release%{?dist}
-License:    GPL
-Group:      Applications/Networking
-Source:     http://elog.psi.ch/elog/download/elog-%{version}.tar.gz
-Vendor:     Stefan Ritt <stefan.ritt@psi.ch>
-URL:        http://elog.psi.ch/elog
-BuildRoot:  /tmp/%{name}-root
-Prefix:     /usr/local
-BuildRequires: openssl-devel >= 0.9.8e
-
-%description
-ELOG is part of a family of applications known as weblogs. 
-Their general purpose is : 
-
-1. To make it easy for people to put information online in a chronological
-   fashion, in the form of short, time-stamped text messages ("entries") 
-   with optional HTML markup for presentation, and optional file attachments 
-   (images, archives, etc.) 
-
-2. To make it easy for other people to access this information through a 
-   Web interface, browse entries, search, download files, and optionally add, 
-   update, delete or comment on entries. 
-
-ELOG is a remarkable implementation of a weblog in at least two respects : 
-
-- Its simplicity of use: you don't need to be a seasoned server operator 
-and/or an experimented database administrator to run ELOG ; one executable 
-file (under Unix or Windows), a simple configuration text file, and it works. 
-No Web server or relational database required. It is also easy to translate 
-the interface to the appropriate language for your users. 
-
-- Its versatility: through its single configuration file, ELOG can be made 
-to display an infinity of variants of the weblog concept. There are options 
-for what to display, how to display it, what commands are available and to whom, 
-access control, etc. Moreover, a single server can host several weblogs, and 
-each weblog can be totally different from the rest. 
-
-%changelog
-* %{build_timestamp} Stefan Ritt <stefan.ritt@psi.ch> %version-%release
-- Updated from git 
-* Wed Sep 26 2018 Stefan Ritt <stefan.ritt@psi.ch>
-- Made adjustments for new elog server and RH7
-* Fri Aug 29 2014 Stefan Ritt <stefan.ritt@psi.ch>
-- Added BuildRequires, thanks to Stefan Roiser from CERN
-* Fri Oct 21 2005 Stefan Ritt <stefan.ritt@psi.ch>
-- Added resources/ directory
-* Fri Mar 14 2003 Stefan Ritt <stefan.ritt@psi.ch>
-- Added %post to change ownership of elog files
-* Thu Jan 30 2003 Stefan Ritt <stefan.ritt@psi.ch>
-- Added installation of man pages, thanks to Serge Droz <serge.droz@psi.ch>
-* Tue Aug 13 2002 Stefan Ritt <stefan.ritt@psi.ch>
-- Added elog group and user, thanks to Nicolas Chuche [nchuche@teaser.fr]
-* Tue Jun 18 2002 Stefan Ritt <stefan.ritt@psi.ch>
-- Put elogd.init into TAR file, add logbooks directory, put elogd in sbin/
-* Tue Jun 18 2002 Serge Droz <serge.droz@psi.ch>
-- Update to 2.0.0
-* Mon Jun  3 2002 Serge Droz <serge.droz@psi.ch>
-- Update to 1.3.6 
-* Fri May 31 2002 Serge Droz <serge.droz@psi.ch>
-- Initial RPM
-
-
-%prep
-%setup -q
-
-%pre
-%{_sbindir}/groupadd -r elog 2>/dev/null || :
-%{_sbindir}/useradd -d / -s /bin/false \
-   -g elog -M -r elog 2>/dev/null || :
-
-%build
-make CFLAGS='-O3 -funroll-loops -fomit-frame-pointer -W -Wall -Wno-deprecated-declarations -Imxml -g'
-sed "s#\@PREFIX\@#%{prefix}#g" elogd.init_template > elogd.init
-
-%install
-make install ROOT=$RPM_BUILD_ROOT MANDIR=$RPM_BUILD_ROOT%{_mandir}
-
-%post
-chown -R elog:elog $RPM_BUILD_ROOT%{prefix}/elog
-
-%clean
-rm -rf $RPM_BUILD_ROOT
-
-%files
-%defattr(-,root,root)
-/etc/rc.d/init.d/elogd
-%{_mandir}/man1/*
-%{_mandir}/man8/*
-%doc	README COPYING doc
-%defattr(-,elog,elog)
-%prefix/bin/*
-%prefix/sbin/elogd
-%prefix/elog/resources
-%prefix/elog/ssl
-%prefix/elog/themes
-%prefix/elog/scripts
-%prefix/elog/logbooks
-%config(noreplace) %prefix/elog/elogd.cfg
diff --git a/elog.spec.template b/elog.spec.template
--- a/elog.spec.template
+++ b/elog.spec.template
0a1,139
> # ELOG weblog application
> # rpmbuild -ba --define 'elogver 3.1.4' --define 'elogrel 2' --with ssl --with pam --with ldap --with krb5 --define 'factorydate date'
>  
> # define date of build for changelog and default release
> %define build_timestamp %(LC_TIME=C date '+%a %b %d %Y')
> %{!?factorydate: %define factorydate %build_timestamp}
> 
> # default version and release
> %{!?elogver: %define elogver __ELOGVER__ }
> %{!?elogrel: %define elogrel __ELOGREL__ }
> # default release is build date
> %{!?elogrel: %define elogrel %{build_timestamp} }
> 
> # Build options :
> # Read: If neither macro exists, then add the default definition.
> %{?_with_krb5: %define _with_krb5 USEKRB5=1}
> %{?_with_ldap: %define _with_ldap USELDAP=1}
> %{?_with_pam: %define _with_pam USEPAM=1}
> %{?_with_ssl: %define _with_ssl USESSL=1}
> # Default build options are with SSL 
> %{!?_with_ssl: %{!?_without_ssl: %define _with_ssl USESSL=1}}
> # builder info
> %define whoami %(eval who am i | awk '{print $1}')
> %define HOSTNAME %(hostname)
> %{!?packager: %define packager %{whoami} %{whoami}@%{HOSTNAME}}
> 
> Name:       elog
> Summary:    elog is a standalone electronic web logbook
> Version:    %elogver
> Release:    %elogrel%{?customrel}%{?dist}
> License:    GPL
> Group:      Applications/Networking
> Source:     http://elog.psi.ch/elog/download/elog-%{elogver}-%{elogrel}.tar.gz
> Vendor:     Stefan Ritt <stefan.ritt@psi.ch>
> URL:        http://elog.psi.ch/elog
> BuildRoot:  /tmp/%{name}-root
> Prefix:     /usr/local
> # Add build dependencies for pam, ssl and ldap features if enabled.
> # Note: Tag tokens must start at beginning-of-line.
> #
> # Read: If feature is enabled, then add the build dependency.
> %{?_with_krb5:BuildRequires: krb5-devel}
> %{?_with_krb5:Requires: krb5-libs}
> %{?_with_ldap:BuildRequires: openldap-devel >= 2.4.1}
> %{?_with_ldap:Requires: openldap >= 2.4.1}
> %{?_with_pam:BuildRequires: pam-devel >= 1.1.1}
> %{?_with_ssl:BuildRequires: openssl-devel >= 0.9.8e}
> 
> %description
> ELOG is part of a family of applications known as weblogs. 
> Their general purpose is : 
> 
> 1. To make it easy for people to put information online in a chronological
>    fashion, in the form of short, time-stamped text messages ("entries") 
>    with optional HTML markup for presentation, and optional file attachments 
>    (images, archives, etc.) 
> 
> 2. To make it easy for other people to access this information through a 
>    Web interface, browse entries, search, download files, and optionally add, 
>    update, delete or comment on entries. 
> 
> ELOG is a remarkable implementation of a weblog in at least two respects : 
> 
> - Its simplicity of use: you don't need to be a seasoned server operator 
> and/or an experimented database administrator to run ELOG ; one executable 
> file (under Unix or Windows), a simple configuration text file, and it works. 

# ELOG weblog application
# rpmbuild -ba --define 'elogver 3.1.4' --define 'elogrel 2' --with ssl --with pam --with ldap --with krb5 --define 'factorydate date'
 
# define date of build for changelog and default release
%define build_timestamp %(LC_TIME=C date '+%a %b %d %Y')
%{!?factorydate: %define factorydate %build_timestamp}

# default version and release
%{!?elogver: %define elogver __ELOGVER__ }
%{!?elogrel: %define elogrel __ELOGREL__ }
# default release is build date
%{!?elogrel: %define elogrel %{build_timestamp} }

# Build options :
# Read: If neither macro exists, then add the default definition.
%{?_with_krb5: %define _with_krb5 USEKRB5=1}
%{?_with_ldap: %define _with_ldap USELDAP=1}
%{?_with_pam: %define _with_pam USEPAM=1}
%{?_with_ssl: %define _with_ssl USESSL=1}
# Default build options are with SSL 
%{!?_with_ssl: %{!?_without_ssl: %define _with_ssl USESSL=1}}
# builder info
%define whoami %(eval who am i | awk '{print $1}')
%define HOSTNAME %(hostname)
%{!?packager: %define packager %{whoami} %{whoami}@%{HOSTNAME}}

Name:       elog
Summary:    elog is a standalone electronic web logbook
Version:    %elogver
Release:    %elogrel%{?customrel}%{?dist}
License:    GPL
Group:      Applications/Networking
Source:     http://elog.psi.ch/elog/download/elog-%{elogver}-%{elogrel}.tar.gz
Vendor:     Stefan Ritt <stefan.ritt@psi.ch>
URL:        http://elog.psi.ch/elog
BuildRoot:  /tmp/%{name}-root
Prefix:     /usr/local
# Add build dependencies for pam, ssl and ldap features if enabled.
# Note: Tag tokens must start at beginning-of-line.
#
# Read: If feature is enabled, then add the build dependency.
%{?_with_krb5:BuildRequires: krb5-devel}
%{?_with_krb5:Requires: krb5-libs}
%{?_with_ldap:BuildRequires: openldap-devel >= 2.4.1}
%{?_with_ldap:Requires: openldap >= 2.4.1}
%{?_with_pam:BuildRequires: pam-devel >= 1.1.1}
%{?_with_ssl:BuildRequires: openssl-devel >= 0.9.8e}

%description
ELOG is part of a family of applications known as weblogs. 
Their general purpose is : 

1. To make it easy for people to put information online in a chronological
   fashion, in the form of short, time-stamped text messages ("entries") 
   with optional HTML markup for presentation, and optional file attachments 
   (images, archives, etc.) 

2. To make it easy for other people to access this information through a 
   Web interface, browse entries, search, download files, and optionally add, 
   update, delete or comment on entries. 

ELOG is a remarkable implementation of a weblog in at least two respects : 

- Its simplicity of use: you don't need to be a seasoned server operator 
and/or an experimented database administrator to run ELOG ; one executable 
file (under Unix or Windows), a simple configuration text file, and it works. 
No Web server or relational database required. It is also easy to translate 
the interface to the appropriate language for your users. 

- Its versatility: through its single configuration file, ELOG can be made 
to display an infinity of variants of the weblog concept. There are options 
for what to display, how to display it, what commands are available and to whom, 
access control, etc. Moreover, a single server can host several weblogs, and 
each weblog can be totally different from the rest. 

%changelog
* %{build_timestamp} %{packager} %{version}-%{release}
- rebuild with option(s): %{?_with_krb5:KRB5 }%{?_with_ldap:LDAP }%{?_with_pam:PAM }%{?_with_ssl:SSL}

* %{factorydate} Stefan Ritt <stefan.ritt@psi.ch> %{version}-%{release}
- Updated from git 
* Wed Sep 26 2018 Stefan Ritt <stefan.ritt@psi.ch>
- Made adjustments for new elog server and RH7
* Fri Aug 29 2014 Stefan Ritt <stefan.ritt@psi.ch>
- Added BuildRequires, thanks to Stefan Roiser from CERN
* Fri Oct 21 2005 Stefan Ritt <stefan.ritt@psi.ch>
- Added resources/ directory
* Fri Mar 14 2003 Stefan Ritt <stefan.ritt@psi.ch>
- Added %post to change ownership of elog files
* Thu Jan 30 2003 Stefan Ritt <stefan.ritt@psi.ch>
- Added installation of man pages, thanks to Serge Droz <serge.droz@psi.ch>
* Tue Aug 13 2002 Stefan Ritt <stefan.ritt@psi.ch>
- Added elog group and user, thanks to Nicolas Chuche [nchuche@teaser.fr]
* Tue Jun 18 2002 Stefan Ritt <stefan.ritt@psi.ch>
- Put elogd.init into TAR file, add logbooks directory, put elogd in sbin/
* Tue Jun 18 2002 Serge Droz <serge.droz@psi.ch>
- Update to 2.0.0
* Mon Jun  3 2002 Serge Droz <serge.droz@psi.ch>
- Update to 1.3.6 
* Fri May 31 2002 Serge Droz <serge.droz@psi.ch>
- Initial RPM


%prep
%setup -q

%pre
%{_sbindir}/groupadd -r elog 2>/dev/null || :
%{_sbindir}/useradd -d / -s /bin/false \
   -g elog -M -r elog 2>/dev/null || :

%build
make %{?_with_ssl} %{?_with_pam} %{?_with_ldap} %{?_with_krb5} CFLAGS='-O3 -funroll-loops -fomit-frame-pointer -W -Wall -Wno-deprecated-declarations -Imxml -g'
sed "s#\@PREFIX\@#%{prefix}#g" elogd.init_template > elogd.init

%install
make install ROOT=$RPM_BUILD_ROOT MANDIR=$RPM_BUILD_ROOT%{_mandir}

%post
chown -R elog:elog $RPM_BUILD_ROOT%{prefix}/elog

%clean
rm -rf $RPM_BUILD_ROOT

%files
%defattr(-,root,root)
/etc/rc.d/init.d/elogd
%{_mandir}/man1/*
%{_mandir}/man8/*
%doc	README COPYING doc
%defattr(-,elog,elog)
%prefix/bin/*
%prefix/sbin/elogd
%prefix/elog/resources
%prefix/elog/ssl
%prefix/elog/themes
%prefix/elog/scripts
%prefix/elog/logbooks
%config(noreplace) %prefix/elog/elogd.cfg

Index: elogd.c
===================================================================
--- elogd.c	(revision 2414)
+++ elogd.c	(working copy)
@@ -74,6 +74,8 @@
 char attr_list[MAX_N_ATTR][NAME_LENGTH];
 char attr_options[MAX_N_ATTR][MAX_N_LIST][NAME_LENGTH];
 int attr_flags[MAX_N_ATTR];
+/** Validation pattern for attribute, to test if it contains expected value */
+char attr_valid_pattern[MAX_N_ATTR][NAME_LENGTH];
 
 char attr_list_default[][NAME_LENGTH] = { "Author", "Type", "Category", "Subject", "" };
 
@@ -7033,7 +7035,7 @@
 
 int scan_attributes(char *logbook)
 /* scan configuration file for attributes and fill attr_list, attr_options
- and attr_flags arrays */
+ and attr_flags and attr_valid_pattern arrays */
 {
    char list[10000], str[NAME_LENGTH], str2[NAME_LENGTH], type[NAME_LENGTH],
        tmp_list[MAX_N_ATTR][NAME_LENGTH];
@@ -7062,11 +7064,20 @@
          }
       }
 
-      /* get options lists for attributes */
+      /* get options lists and validation patterns for attributes */
       memset(attr_options, 0, sizeof(attr_options));
+      memset(attr_valid_pattern, 0, sizeof(attr_valid_pattern));
       for (i = 0; i < n; i++) {
          n_options = 0;
 
+         sprintf(str, "ValidPattern %s", attr_list[i]);
+         if (getcfg(logbook, str, list, sizeof(list)))
+         {
+            strncpy(attr_valid_pattern[i], list, sizeof(attr_valid_pattern[i])-1);
+            attr_valid_pattern[i][sizeof(attr_valid_pattern[i])-1] = 0;
+            attr_flags[i] |= AF_HAS_VALID_PATT;
+         }
+
          sprintf(str, "Options %s", attr_list[i]);
          if (getcfg(logbook, str, list, sizeof(list)))
             n_options = strbreak(list, attr_options[i], MAX_N_LIST, ",", FALSE);
@@ -9650,6 +9661,17 @@
             rsprintf("    document.form1.%s.focus();\n", ua);
             rsprintf("    return false;\n");
             rsprintf("  }\n");
+            if (attr_flags[i] & AF_HAS_VALID_PATT) 
+            {
+              sprintf(str, loc("var validPatt=new RegExp(\"%s\");"), attr_valid_pattern[i]);
+              rsprintf("  %s\n", str);
+              rsprintf("  if (!validPatt.test(document.form1.%s.value)) {\n", ua);
+              sprintf(str, loc("Invalid value for attribute '%s'"), attr_list[i]);
+              rsprintf("    alert(\"%s\");\n", str);
+              rsprintf("    document.form1.%s.focus();\n", ua);
+              rsprintf("    return false;\n");
+              rsprintf("  }\n");
+            }
          }
       }
 
Index: elogd.h
===================================================================
--- elogd.h	(revision 2414)
+++ elogd.h	(working copy)
@@ -192,6 +192,7 @@
 #define AF_MUSERLIST         (1<<13)
 #define AF_USEREMAIL         (1<<14)
 #define AF_MUSEREMAIL        (1<<15)
+#define AF_HAS_VALID_PATT    (1<<16)
 
 /* attribute format flags */
 #define AFF_SAME_LINE              1