Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG  Not logged in ELOG logo
icon5.gif   Access to global configuration in v2.6.1, posted by Giorgio Croci Candiani on Thu Jan 19 15:02:38 2006 
    icon2.gif   Re: Access to global configuration in v2.6.1, posted by Stefan Ritt on Thu Jan 19 15:23:02 2006 
       icon2.gif   Re: Access to global configuration in v2.6.1, posted by Giorgio Croci Candiani on Sat Jan 21 14:02:57 2006 
       icon2.gif   Re: Access to global configuration in v2.6.1, posted by Giorgio Croci Candiani on Wed Jan 25 01:08:06 2006 
          icon2.gif   Re: Access to global configuration in v2.6.1, posted by Stefan Ritt on Wed Jan 25 08:24:28 2006 elogd.cfgCapture.gif
             icon2.gif   Re: Access to global configuration in v2.6.1, posted by Giorgio Croci Candiani on Wed Jan 25 12:08:13 2006 
                icon2.gif   Re: Access to global configuration in v2.6.1, posted by Stefan Ritt on Wed Jan 25 12:10:46 2006 
                   icon2.gif   Re: Access to global configuration in v2.6.1, posted by Giorgio Croci Candiani on Tue Mar 14 17:11:10 2006 
                      icon2.gif   Re: Access to global configuration in v2.6.1, posted by Giorgio Croci Candiani on Tue Aug 29 15:16:31 2006 
Message ID: 1917     Entry time: Tue Aug 29 15:16:31 2006     In reply to: 1772
Icon: Reply  Author: Giorgio Croci Candiani  Author Email: g.crocic@libero.it 
Category: Bug report  OS: Linux | Windows  ELOG Version: 2.6.1 
Subject: Re: Access to global configuration in v2.6.1 
Hi,
after a long time, I thought I could try to investigate the code some further,
and maybe I found some hint.
The page where I expected the options to show was (probably) the one generated by this function:

void show_admin_page(LOGBOOK * lbs, char *top_group)

Inside, it, the buttons are generated by following code snippets:

(elogd.c:10443)
if (is_admin_user_global(getparam("unm"))) {
   sprintf(str, loc("Change %s"), "[global]");
   rsprintf("<input type=submit name=cmd value=\"%s\">\n", str);
}
(elogd.c:10461)
  if (is_admin_user("global", getparam("unm"))) {
     rsprintf("<input type=submit name=cmd value=\"%s\">\n", loc("Delete this logbook"));
     rsprintf("<input type=submit name=cmd value=\"%s\">\n", loc("Rename this logbook"));
     rsprintf("<input type=submit name=cmd value=\"%s\">\n", loc("Create new logbook"));
}

The functions called to validate the user are following:

(elogd.c:21298)
BOOL is_admin_user(char *logbook, char *user):
//...
   if (user == NULL)
      return FALSE;

(elogd.c:21324)

BOOL is_admin_user_global(char *user)
{
//...
   if (user == NULL)
      return FALSE;

Since I assume that I'm probably in the "userless" case (no users are defined in the configuration,
and no usernames are set when launching elog either), I would understand that this causes the options for
global config editing etc etc not to be shown on the admin page.

In my opinion (and given that my interpretation of the code flow isn't wrong), the "null"
user should be indeed considered admin, at least as long as no user management is defined whatsoever.
(If I got it right, if user==NULL, but a password file exists, user management is applied,
thus we're in the case of anonymous user which is correctly not admin).

Again, I might be wrong, but I would be curious to hear an opinion from you about this issue.
Thanks again for your attention.
GiorgioCC
ELOG V3.1.5-fe60aaf