Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG  Not logged in ELOG logo
icon5.gif   user change under webserver authentication not recognized, posted by Frank Heyroth on Fri Jan 19 15:49:13 2024 
    icon2.gif   Re: user change under webserver authentication not recognized, posted by Frank Heyroth on Wed Jan 24 14:50:21 2024 
       icon2.gif   Re: user change under webserver authentication not recognized, posted by Stefan Ritt on Fri Feb 23 15:13:46 2024 
Message ID: 69742     Entry time: Fri Feb 23 15:13:46 2024     In reply to: 69725
Icon: Reply  Author: Stefan Ritt  Author Email: Thstefan.ritt@psi.ch 
Category: Bug report  OS: Linux  ELOG Version: 3.1.5-1 
Subject: Re: user change under webserver authentication not recognized 

Thanks for the fix, I committed it. Please give it a quicky try sinc I cannot test it here (don't use webserver authentication...)

Stefan

Frank Heyroth wrote:

I found the reason of the bug:
In line 27441 of elogd.cxx the http_user is overwritten by the user saved in the sid_ array as a sideeffect of the sid_check function:
sid_check(getparam("sid"), http_user)

It can solved by changing elogd.cxx @ line 27441

27441c27441,27446
<          if (!sid_check(getparam("sid"), http_user)) { /*  if we don't have a sid yet, set it */
---
>          i=sid_check(getparam("sid"), thumb_name);
>          if (i && strcmp(http_user,thumb_name)!=0) {  /* user changed */
>             sid_remove(getparam("sid"));
>             i=FALSE;
>          }
>          if (!i) { /*  if we don't have a sid yet, set it */

Remark: I have used the variables i & thumb_name of the function in a local context.

 

ELOG V3.1.5-fe60aaf