Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 131 of 808  Not logged in ELOG logo
ID Date Icon Author Author Email Category OS ELOG Version Subjectdown
  1177   Sat Jun 4 16:37:04 2005 Reply Heiko Scheith.scheit@mpi-hd.mpg.deBug reportLinux2.5.9Re: reverse sort option does not work for quick filter
[quote="Stefan Ritt"][quote="Heiko Scheit"]The 'reverse sort' option does not work for quick filter searches. 
In the
URL there is always written 'reverse=0'.  For normal 'Find' it works OK.[/quote]

I don't understand the problem. If I take the example elogd.cfg from the distribution, it sorts in reverse
order, since the file contains [i]Reverse sort=1[/i]. If I apply a quick filter, the result is still sorted in
reverse order (entry ID from high to low). If I set [i]Reverse sort=0[/i], the even after applying a quick
filter, the entries are sorted with their ID from low to high. Applying a quick filter should not put a
[i]reverse=0[/i] into the URL, so it's strange to me where this comes from. Can you try to reproduce the problem
with the demo elogd.cfg?[/quote]

I played with the quick filter settings somewhat.  Here is what I get.
I can't really make sense of it, but maybe you can figure out what
happens.  Below, the first line always contains the 'Quick filter'
config setting.  The lines below show the URL after searching with the
quick filter for the 1st, 2nd,... attribute listed in the quick filter
setting.  (The common base of the URL was removed.  Shown is
everything after the last '/'.)  Each 'quick search' was started from
the 'List' or 'Back' page, i.e. the URL ended with a '/'.

As you can see below the result depends on the number and on the order
(!) of the attributes.  Only a few give the desired result (marked
with # OK).  Incidentally the option 'Date, Something' works fine,
which is the combination found in the demo config file.  :)

Quick filter            = Subject, Date, Login
?Subject=sd&Login=           # OK
?last=1&&reverse=0
?Login=sdf&reverse=0

Quick filter            = Subject, Login, Date
?Subject=scd&reverse=0
?Login=sdf&reverse=0
?last=1&reverse=0

Quick filter            = Date, Subject, Login
?last=1&&reverse=0
?Subject=sd&Login=           # OK
?Login=sd&reverse=0

Quick filter            = Subject, Date
?Subject=sd                  # OK
?last=1&reverse=0

Quick filter            = Date, Subject
?last=1&Subject=             # OK
?Subject=ddsd                # OK

Quick filter            = Login, Date
?Login=sch                   # OK
?last=31&reverse=0

Quick filter            = Subject, Login
?Subject=dsd&Login=          # OK
?Login=sd&reverse=0

Quick filter            = Login, Subject
?Login=sd&Subject=           # OK
?Subject=sd&reverse=0
  1195   Thu Jun 16 22:37:06 2005 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2.5.9Re: reverse sort option does not work for quick filter
I finally found some time to fix this problem. The fix is under CVS.
  55   Mon Jul 8 10:45:37 2002 Reply Stefan Rittstefan.ritt@psi.chBug fix  Re: reverse sort and threaded mode does not display first entry
> When the option 'Reverse sort = 1' is used then the first entry
> is not displayed (ID=1) when threaded mode is requested.
> 
> Probably you can see the problem using this link and switching 
> on reverse sort.  
> 
> http://midas.psi.ch/elogdemo/Linux/last20?mode=threaded

Has been fixed in 2.0.4, have a look at

http://midas.psi.ch/elogdemo/Linux/last20?mode=threaded&reverse=1
  69408   Tue Nov 2 12:07:46 2021 Reply Stefan Rittstefan.ritt@psi.chQuestionLinuxelog-3.1.4-2Re: results of security scan

The elgod.c progarm itself is rather weak in SSL, since I just don't have time to catch up with the latest SSL enhancements. The safest you can do is to put an industry-strenth web server like Apache in front of elogd and let that server handle the SSL layer.

Stefan

David Stops wrote:

Recently central IT scanned our elog server and reported the following "vulnerabilities"

  • 42873 (1) - SSL Medium Strength Cipher Suites Supported (SWEET32)
  • 51192 (1) - SSL Certificate Cannot Be Trusted
  • 65821 (1) - SSL RC4 Cipher Suites Supported (Bar Mitzvah)
  • 85582 (1) - Web Application Potentially Vulnerable to Clickjacking

Is there any easy way of preventing these

Thanks and Best Wishes

David

 

  69409   Thu Nov 4 13:48:00 2021 Reply David Stopsdjs@star.sr.bham.ac.ukQuestionLinuxelog-3.1.4-2Re: results of security scan

Thanks, I'll try that and see what happens

 

David

Stefan Ritt wrote:

The elgod.c progarm itself is rather weak in SSL, since I just don't have time to catch up with the latest SSL enhancements. The safest you can do is to put an industry-strenth web server like Apache in front of elogd and let that server handle the SSL layer.

Stefan

David Stops wrote:

Recently central IT scanned our elog server and reported the following "vulnerabilities"

  • 42873 (1) - SSL Medium Strength Cipher Suites Supported (SWEET32)
  • 51192 (1) - SSL Certificate Cannot Be Trusted
  • 65821 (1) - SSL RC4 Cipher Suites Supported (Bar Mitzvah)
  • 85582 (1) - Web Application Potentially Vulnerable to Clickjacking

Is there any easy way of preventing these

Thanks and Best Wishes

David

 

 

  68176   Mon Nov 2 08:41:20 2015 Reply Andreas Luedekeandreas.luedeke@psi.chBug reportAll3.1.1Re: restrict edit time and autosave
Hi Kester,
yes, I did run into the same problem, that I could not even delete old drafts due to our restrict edit time.
We allow anonymous submissions in our operation logbooks. After a while drafts of unsubmitted messages just pile up; and I need to remove them as administrator.
While I can do that easily for anonymous drafts, I cannot do that for drafts of other users: I don't easily see those drafts.
It would be really nice, if drafts would be handled different then other entries regarding "Restrict edit time" as you've suggested.
Cheers, Andreas
Kester Habermann wrote:

Hello,

When using restrict edit time together with autosave, there is the following problem: The counter for restrict edit time seems to start after the autosave. If the time is up, it is no longer possible to submit the report.
It is also not possble to edit old drafts if restrict edit has elapsed since the creation of the save.
Autosave is definitively a nice new feature. However, I think it would be better if the counter for restrict edit time only started after the "submit" of the report and allowed edits to drafts no matter how old they are. As it is one needs to either set a really high value for restrict edit time or turn off autosave.
The issue seems to be related to: https://midas.psi.ch/elogs/Forum/68103

Regards

Kester

 

 

 

 

  69001   Thu Aug 15 13:34:23 2019 Reply Andreas Luedekeandreas.luedeke@psi.chRequestLinux3.1.4Re: restrict edit time

Yes, I agree that cleaning up old Draft entries and correcting/deleting old entries is a job for the administrator. Currently I do what you've said: commenting out "restrict edit time", changing the entry, commenting in "restrict edit time".

There are already some commands specifically for the admin:

  • Admin textarea = <cols>,<rows>
  • Admin user = <user list>

It would make sense to add more of them, for this specific case:

  • Admin restrict edit time = <hours>

If that is set to "-1", then the Admin can edit old entries regardless of their age. Actually there is no option to "unset" restrict edit time inherited from a global config: a negative time would make sense as "disabling" restrict edit time.

Another item for the endless wishlist ;-)

Cheers, Andreas

Sebastian Schenk wrote:

Hello,
I have experienced some inconveniences with the restrict edit time option.

First, it is not possible for admin users to edit an entry after the edit time.
The restrict edit option allows admin users to edit posts from other users,
so I think admins should also be allowed to edit posts after edit time.
As they can edit the config and temporarily disable the restrict edit time option, which is an issue.

Secondly, if a user made a draft and did not submitted it before the edit time runs out,
the draft got stuck as it cannot be edited (and submitted) any more.

Best wishes,
Sebastian

 

  1851   Thu Jun 22 08:04:13 2006 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux2.6.1Re: restrict access
> -1- how can I restrict the access 
> of a certain user such that he can only see certain logbooks. 

This can be achieved with the "Login user = ..." option.

> But also not showing the other logbooks on the selection page.

You could try to use "top groups". This gives you "separate" groups of logbooks, so you could make a public tree
seen by everybody and private trees only seen by a few people. Please read the documentation for details.

> -2- How can I have a login page instead of the logbook selection page.
> When I insert the password statement the config, I get a blank page.

You get a login page instead of the selection page if the "Password file = " statement is in the [global] section
and "Protect selection page = 1". You might have to delete all cookies in your browser if you move the password
file statement between the [global] and the logbook sections, because otherwise the old cookies might prevent you
from logging out.
ELOG V3.1.5-3fb85fa6