Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG  Not logged in ELOG logo
icon4.gif   elog client can set arbitrary values to locked attributes, posted by David Potterveld on Mon Nov 10 16:56:08 2008 
    icon2.gif   Re: elog client can set arbitrary values to locked attributes, posted by Stefan Ritt on Mon Nov 17 11:20:28 2008 
       icon2.gif   Re: elog client can set arbitrary values to locked attributes, posted by Stefan Ritt on Mon Nov 17 11:39:03 2008 
Message ID: 66038     Entry time: Mon Nov 10 16:56:08 2008     Reply to this: 66053
Icon: Warning  Author: David Potterveld  Author Email: potterveld@anl.gov 
Category: Bug report  OS: Linux  ELOG Version: 2.7.5-2135 
Subject: elog client can set arbitrary values to locked attributes 

When submitting entries via the elog client, I find that I can set arbitrary values for attributes that are supposedly "preset" and "locked".

As an example, I have in my elogd.cfg file:

[global]

...

Group Operations = Accelerator

Top group ATLAS = Operations

...

[global ATLAS]

Attributes = Experiment, Author, Author Email, Category, Subject
Required Attributes = Category, Subject
Options Category = Routine entry, Shift summary, Problem, Fix, Question, Info, Other
Extendable Options = Category

Preset Experiment =
Preset Author = $long_name
Preset Author Email = $user_email
Locked Attributes = Experiment, Author, Author Email

...

[Accelerator]
Attributes = Author, Author Email, Category, Subject
Options Category = Routine entry, Shift summary, Problem, Fix, Question, Info, Other

...

This works as intended with a web client (firefox). The Author and Author Email attributes are preset and unchangeable.

However, if I use the elog client, as in:

elog -v -h my.apache-proxy.server -d elog -l Accelerator -p 443 -s -u johndoe xxxxx -a Category=LN -a Subject=Test -a Author=IDoNotExist -n 1 -m entry.txt 
(johndoe is an existing user)

 
The entry is created with "IDoNotExist" as the Author name, instead of the correct name for the user johndoe,
and the Author Email attribute is blank.

Is there a way to enforce preset and locked attributes in the elogd server? (As a client could connect
with any arbitrary software, not just elog.)



ELOG V3.1.5-fe60aaf