Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 1 of 234  Not logged in ELOG logo
icon5.gif   Options <attribute> = List????, posted by Mo on Mon Jul 1 13:56:12 2002 
Hello,
    Is it possible to have a drop down list with commas in the options.  
For instance, if you want to have a attribute "CityState" you would 
probably want a comma between the City and State name.  Since the Options 
are separated by commas, it turns into two different options.  I dont know 
if there is a way to do this or if this is a bug?

MO
    icon2.gif   Re: Options <attribute> = List????, posted by Stefan Ritt on Tue Jul 2 09:41:57 2002 
> Hello,
>     Is it possible to have a drop down list with commas in the options.  
> For instance, if you want to have a attribute "CityState" you would 
> probably want a comma between the City and State name.  Since the Options 
> are separated by commas, it turns into two different options.  I dont know 
> if there is a way to do this or if this is a bug?

From the next version on *2.0.4), one can specify attributes in quotation 
marks like

Options town = San Francisco, "Paris, Texas", "Paris, France"

which then can include commas.
icon5.gif   possible to modify link in email notification, posted by Stefan Siegel on Wed Jul 3 18:36:28 2002 
Hello,

I have a question concerning the following situation:

There is a one logbook with two possible acces methods (defined in config 
file) one for readonly access and one for read/write access. Both entries in 
the elogd.cfg file pointing to the same logbook.

When an allowed person enters a logbook entry with an email notification the 
link to the message is given inside the email. 
This link points to the read/write logbook entry.

Is it possible to alter the link in the email notification that it points to 
the corresponding readlonly logbook entry? 

Thank you for hints, best regards,


Stefan Siegel  
    icon2.gif   Re: possible to modify link in email notification, posted by Stefan Ritt on Thu Jul 4 09:23:50 2002 
Having the URL link to a different logbook is right now not possible. But 
what about setting up a single logbook with a write password. Everybody can 
access it for reading, but only these people who know the write password 
can enter messages.
icon4.gif   exit status of elog, posted by Heiko Scheit on Thu Jul 4 17:09:09 2002 
The exit status of elog is always 1.  It should be zero for
a successful submission.
    icon2.gif   Re: exit status of elog, posted by Stefan Ritt on Mon Jul 8 10:42:38 2002 
> The exit status of elog is always 1.  It should be zero for
> a successful submission.

Has been fixed in 2.0.4
icon4.gif   elog submit problem, posted by Heiko Scheit on Thu Jul 4 16:52:59 2002 
If a message is submitted via the elog command then the reply string '> ' is only inserted in the first line if a reply is made.
This message was submitted with the following commandline:
elog -v -h midas.psi.ch -p 80 -s elogdemo -l Forum -a "Icon=icon4.gif" -a "Author=Heiko Scheit"  -a "Author Email=h.scheit@mpi-hd.mpg.de" -a "Subject=elog submit problem" "...Message-text..."

Please press the reply button to see the problem.
    icon2.gif   Re: elog submit problem, posted by Stefan Ritt on Mon Jul 8 10:44:08 2002 
> If a message is submitted via the elog command then the reply string '> ' 
is only inserted in the first line if a reply is made.
> This message was submitted with the following commandline:
> elog -v -h midas.psi.ch -p 80 -s elogdemo -l Forum -a "Icon=icon4.gif" -
a "Author=Heiko Scheit"  -a "Author Email=h.scheit@mpi-hd.mpg.de" -
a "Subject=elog submit problem" "...Message-text..."
> Please press the reply button to see the problem.

Has been fixed in 2.0.4 (as you can see from this entry). Please make sure 
not to submit too long lines via "elog". For browser submissions, the line 
length is limited to 78 characters, but not for "elog" submissions.
icon4.gif   reverse sort and threaded mode does not display first entry, posted by Heiko Scheit on Thu Jul 4 17:05:03 2002 
When the option 'Reverse sort = 1' is used then the first entry
is not displayed (ID=1) when threaded mode is requested.

Probably you can see the problem using this link and switching 
on reverse sort.  

http://midas.psi.ch/elogdemo/Linux/last20?mode=threaded
    icon2.gif   Re: reverse sort and threaded mode does not display first entry, posted by Stefan Ritt on Mon Jul 8 10:45:37 2002 
> When the option 'Reverse sort = 1' is used then the first entry
> is not displayed (ID=1) when threaded mode is requested.
> 
> Probably you can see the problem using this link and switching 
> on reverse sort.  
> 
> http://midas.psi.ch/elogdemo/Linux/last20?mode=threaded

Has been fixed in 2.0.4, have a look at

http://midas.psi.ch/elogdemo/Linux/last20?mode=threaded&reverse=1
icon5.gif   Where can I get more information on the config file, posted by Scott Fenstermacher on Mon Jul 8 22:50:16 2002 
Where can I get more information about the config and themes file. I
downloaded the latest version (2.0.4) and the config file docs seem out of
date. I would like to get the icons working as well as getting the email to
work. The demo page at the elog home site shows both but I cannot find ant
references to the icons.
    icon2.gif   Re: Where can I get more information on the config file, posted by Stefan Ritt on Tue Jul 9 09:18:05 2002 
> Where can I get more information about the config and themes file. I
> downloaded the latest version (2.0.4) and the config file docs seem out of
> date. I would like to get the icons working as well as getting the email 
to
> work. The demo page at the elog home site shows both but I cannot find ant
> references to the icons.

Oops, I forgot the "IOptions" statement to documentation. Please see the 
updated version at

http://midas.psi.ch/elog/config.html

look for "IOptions". For the Email notification see the whole 
section "Email 
notification" near the bottom of the page.
icon5.gif   problem saving elogd.cfg, posted by Mo on Mon Jul 8 17:18:05 2002 
In version 2.0.4 of eLog I was having some problems with saving my 
configuration file once I edited it on the web using the config. command.
I keep getting the message "Cannot open file %s: elogd.cfg".  I made sure 
the file was in the right directory.  I dont know if I am doing something 
wrong or if its a bug?

Mo.
    icon2.gif   Re: problem saving elogd.cfg, posted by Stefan Ritt on Tue Jul 9 09:25:41 2002 
> In version 2.0.4 of eLog I was having some problems with saving my 
> configuration file once I edited it on the web using the config. command.
> I keep getting the message "Cannot open file %s: elogd.cfg".  I made sure 
> the file was in the right directory.  I dont know if I am doing something 
> wrong or if its a bug?

The error display is certainly wrong. I fixed that and you can download the 
updated version at 

http://midas.psi.ch/cgi-bin/cvsweb/elog/elogd.c

As for the error, you should check the file permissions. If you run the 
daemon under a user which has no write access to the directory or file, you 
would get the described error.
icon4.gif   elog submit without user and password, posted by H. Scheit on Mon Jul 8 19:42:13 2002 
With elog it is possible to submit messages to a password protected
logbook without specifying the -u option.  I.e. NO PASSWORD is
necessary to submit a message.  I assume it is related to the problem
of expiring password-cookies while entering the message using a web
browser.
    icon2.gif   Re: elog submit without user and password, posted by Stefan Ritt on Tue Jul 9 10:58:18 2002 
> With elog it is possible to submit messages to a password protected
> logbook without specifying the -u option.  I.e. NO PASSWORD is
> necessary to submit a message.  I assume it is related to the problem
> of expiring password-cookies while entering the message using a web
> browser.

Indeed this problem is related to the expiring password cookies. As a 
reminder: For the submission of a new entry, the password is checked when one 
presses the "New" button, but NOT for the "submit". This is because a 
password can expire between the "New" and the "Submit", so a entered message 
could not be sent. The question is now what to do with the standalone "elog".

Right now, elog does a normal submission where the password is not checked, 
which is maybe not what one wants. But what to do? If elog sends a special 
flag "please do check password on submit", someone could analyze the source 
code, remove the flag from elog and then still submit messages without a 
password. If I put an additional flag to the web browser submission "please 
do not check the password since the cookie might have been expired", someone 
can add this flag into elog and still bypass the password checking.

Anothe thing which bothers me is if you specify the password explicitly on 
the command line of elog, it's visible in some scripts etc, which yould be a 
security issue as well.

Any ideas?
       icon2.gif   Re: elog submit without user and password, posted by H. Scheit on Tue Jul 9 15:28:33 2002 
> > With elog it is possible to submit messages to a password protected
> > logbook without specifying the -u option.  I.e. NO PASSWORD is
> > necessary to submit a message.  I assume it is related to the problem
> > of expiring password-cookies while entering the message using a web
> > browser.
> 
> Indeed this problem is related to the expiring password cookies. As a 
> reminder: For the submission of a new entry, the password is checked when
one 
> presses the "New" button, but NOT for the "submit". This is because a 
> password can expire between the "New" and the "Submit", so a entered message 
> could not be sent. The question is now what to do with the standalone
"elog".
> 
> Right now, elog does a normal submission where the password is not checked, 
> which is maybe not what one wants. But what to do? If elog sends a special 
> flag "please do check password on submit", someone could analyze the source 
> code, remove the flag from elog and then still submit messages without a 
> password. If I put an additional flag to the web browser submission "please 
> do not check the password since the cookie might have been expired", someone 
> can add this flag into elog and still bypass the password checking.

I guess it cannot and doesn't have to be 100% save.  Maybe if the web
interface is used for a new message a long random number (let's call
it newID) can be included, which elog remembers for some time (say 1
day).  Now elogd accepts a new message only if 

  1) the cookies is there and valid or
  2) if the cookies are NOT THERE, but the newID matches one of the
       stored ones.     

The new message is rejected if the cookies are there, but are wrong.

> Anothe thing which bothers me is if you specify the password explicitly on 
> the command line of elog, it's visible in some scripts etc, which yould be a 
> security issue as well.

Maybe the encoded password should be specified.  I use wget to
retrieve some entries automatically over a cron job and with wget
you specify a cookie-file with --cookie-file (or something like
this).  The content of this file corresponds to the content of the
netscape cookie file.

> 
> Any ideas?

Can one delete or edit messages with elog?  If yes then this should not be
possible.
          icon2.gif   Re: elog submit without user and password, posted by Stefan Ritt on Wed Jul 10 08:53:21 2002 
> I guess it cannot and doesn't have to be 100% save.  Maybe if the web
> interface is used for a new message a long random number (let's call
> it newID) can be included, which elog remembers for some time (say 1
> day).  Now elogd accepts a new message only if 
> 
>   1) the cookies is there and valid or
>   2) if the cookies are NOT THERE, but the newID matches one of the
>        stored ones.     
> 
> The new message is rejected if the cookies are there, but are wrong.

Ok that sounds a good idea to me, I will work on that.

> Can one delete or edit messages with elog?  If yes then this should not be
> possible.

No this is not possible.
ELOG V3.1.5-2eba886