Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 117 of 807  Not logged in ELOG logo
    icon2.gif   Re: reverse sort option does not work for quick filter, posted by Stefan Ritt on Thu Jun 16 22:37:06 2005 
I finally found some time to fix this problem. The fix is under CVS.
    icon2.gif   Re: Cloning, posted by Stefan Ritt on Fri Jun 17 22:08:28 2005 

Gerfried Kumbartzki wrote:
The elogd.cfg has a read and write passwd set. Any user can access the logbook, read and write after providing the proper user id and password.


This might be your problem. Try to temporarily remove the read and write password from you config file, then do the cloning, then put it back. Cloning works with a passowd file, but I haven't tested it with read/write passwords.


Gerfried Kumbartzki wrote:
Beside missing the real stuff everything ends up in the users home directory. I would like it in the general area (/usr/local/elog for instance).


The cloning works in the current directory. So just go to /usr/local/elog and start "elogd -C ..." from there. Alternatively, copy your whole /usr/local/elog tree to the server manually. The "Synchronize" button then works again only with a password file. You need a "Mirror user = xxx" option in that case.
    icon2.gif   Re: elog crashes when admin tries to register new users, posted by Stefan Ritt on Fri Jun 17 22:33:29 2005 

Heiko Scheit wrote:
The following appended after the base (!) URL results in a segmentation fault
?cmd=Activate&new_user_name=test1&new_full_name=Test1

It works fine, if a specific logbook is given. So
http://my.ho.st/?cmd=Activate&new_user_name=test1&new_full_name=Test1
is not OK, while
http://my.ho.st/myLogBook/?cmd=Activate&new_user_name=test1&new_full_name=Test1
is OK.


Thanks for that info. It helped me debugging things. The problem is that the "activation" URL does not contain a logbook if there is a global password file. I have never tried that so of course it crashes Crying

I tried to fix this and committed the changes to CVS. Can you try with that version?
    icon2.gif   Re: prevent CVS and XML exports, posted by Stefan Ritt on Sun Jun 19 20:50:16 2005 

Paul Paquette wrote:
Hello All and Happy Father's Day,

How do I prevent Anonymous Users from exporting the Data when using the search funtion?

Thank You

Paul


By not allowing anonymous access at all. The CVS and XML exports do not contain more information than anonymous users can see on the web page, so there is no reason to prevent it. Anybody could view all pages anonymously (if guest access is allowed) and reconstruct the CVS data easily.
    icon2.gif   Re: prevent CVS and XML exports, posted by Emiliano Gabrielli on Mon Jun 20 09:56:28 2005 

Stefan Ritt wrote:

Paul Paquette wrote:
Hello All and Happy Father's Day,

How do I prevent Anonymous Users from exporting the Data when using the search funtion?

Thank You

Paul


By not allowing anonymous access at all. The CVS and XML exports do not contain more information than anonymous users can see on the web page, so there is no reason to prevent it. Anybody could view all pages anonymously (if guest access is allowed) and reconstruct the CVS data easily.


You are obviously talking about CSV (Comma Separated Values), and not CVS (Cuncurrent Verioning System).. Smile
    icon2.gif   Re: elog crashes when admin tries to register new users, posted by Heiko Scheit on Tue Jun 21 19:24:58 2005 

Quote:

Thanks for that info. It helped me debugging things. The problem is that the "activation" URL does not contain a logbook if there is a global password file. I have never tried that so of course it crashes Crying

I tried to fix this and committed the changes to CVS. Can you try with that version?


Not really, unless you have a fixed 2.5.9 version. Version 2.6 has
way too many new features, which I don't want at the moment. Or is
there a config option to get the old behavior?

I also saw that the format of the email notification has changed. As
I have scripts (bash, akw, procmail) that depend on this format I
would need much more time than I currently have to actually test
everything.

Maybe you should consider supporting two branches, say 'stable' (2.5.9
currently) and 'experimental' (2.6 currently)? For 'stable' only
severe bugs and security issues are fixed and in 'experimental' new
features are introduced. What do you say?

For me the risk of upgrading to 2.6 now seems to high, as many people
depend on the logbook.
    icon2.gif   email flagged as spam, posted by Heiko Scheit on Tue Jun 21 19:38:06 2005 

Heiko Scheit wrote:

I also saw that the format of the email notification has changed. As
I have scripts (bash, akw, procmail) that depend on this format I
would need much more time than I currently have to actually test
everything.


By the way, the emails I get from the forum are now all flagged as
spam. SpamAssassin is used and Spam-score header is

X-Spam-Score: 4.875 (****) ADDRESS_IN_SUBJECT, BAYES_00,HTML_40_50,
HTML_IMAGE_ONLY_24, HTML_MESSAGE, MIME_HEADER_CTYPE_ONLY,
MIME_HTML_ONLY, MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_ID,
NO_REAL_NAME, SPF_FAIL, SPF_HELO_PASS, TO_MALFORMED

Maybe you can see what the problem is.
    icon2.gif   Re: Cloning, posted by Gerfried Kumbartzki on Wed Jun 22 18:34:18 2005 
Thank you for the suggestions; I commented the read and write passwd in elogd.cfg out and only then I was able to clone
(elogd -v -C http://laptop:8080) the logbook to the new server.
But this is only part of the story. The logbook on the labtop is owned by the
default user elog and default group elog, that is needed to start up the elogd. Only a user "elog" can do the cloning, unless temporarily the owner ship in /usr/local/elog is changed. I made it work by temporarily changing the owner ship on both machines, did the cloning, changed back to owner elog, started elogd and all was running.
I setup synchronizing and here too it works only if the read passwd in elogd.cfg is commented out.
Sync works fine from the RedHat linux laptop (rpm installed), but crashes the elogd on the alpha Linux machine (compiled from src) most of the time. elogd hast to be restarted and the sync had not finished.
So for now I settled to do the synchronize only from the laptop but have to remove the read passwd each time. That is tolerable but not
convenient.

Here I have another question: My Elog is passwd protected, encrypted passwd in elogd.cfg (read and write). When connecting to the elog the window
pops up asking for a user name and the passwd. I donot remember exactly, what was done to set name and passwd. But I find it "strange" that the user name can be anything as long as the passwd is right to access the ELog.
I think I have to learn more about the whole user and passwd protection schema.

Thanks again
Gerfried
ELOG V3.1.5-3fb85fa6