images attached shown as inline , posted by Emiliano Gabrielli on Mon Feb 7 13:14:41 2005
|
I'm configuring this great application in order to replace the previous
elogbook my community is using (in the accelerator's world).
One of the main and mandatory feature they cannot renunce is the possibility
of displaying every attached image just inline, without having to click over
the file name or to enter the entry view (in which the attachment can
already be displayed inline) ...
- images (and hopefully ps, eps, pdf) be displayed inline just after the
text body of the message in the main "List" view
- possibility to configure the scale of this view
- possibility of build some thumbs in order to save BW and time
Is there any way to do it or any plan to implement such a feature in the
very next future ? |
Re: images attached shown as inline , posted by Stefan Ritt on Mon Feb 7 13:34:17 2005
|
> One of the main and mandatory feature they cannot renunce is the possibility
> of displaying every attached image just inline, without having to click over
> the file name or to enter the entry view (in which the attachment can
> already be displayed inline) ...
Displaying images in the list view is possible by going to the "Find" page and
checking "Display full entries" and "Show attachments". This can even be
automatized by putting
Start page = ?mode=full&attach=1
into the configuration file.
> - images (and hopefully ps, eps, pdf) be displayed inline just after the
> text body of the message in the main "List" view
PS, EPS and PDF files cannot be displayed inline by the browser (at least not
the browsers I know). I guess what you want is that users submit PDFs, and elog
should convert the PDF automatically into JPG and display a reduced version of
it. Unfortunately this is not possible, and it never will be, since one of the
design prinicples of elog is to be independent of any other package, and with
the requested functionality you would need lots of helper functions (like
ghostview, pbmtools, etc.) which some of which are not present under Windows.
> - possibility to configure the scale of this view
> - possibility of build some thumbs in order to save BW and time
Using a HTML <img width=100 ...> does not help. The image is then shown in a
smaller scale, but still the full picture has to be transferred. For making
thumbnails, you again need external libraries (see point above).
So if you want extensive image processing, you might be better of with a picture
gallery like applications, but maybe the automatic attachment display shown
above helps a little bit. |
Re: images attached shown as inline , posted by Emiliano Gabrielli on Mon Feb 7 14:06:48 2005
|
> > One of the main and mandatory feature they cannot renunce is the possibility
> > of displaying every attached image just inline, without having to click over
> > the file name or to enter the entry view (in which the attachment can
> > already be displayed inline) ...
>
> Displaying images in the list view is possible by going to the "Find" page and
> checking "Display full entries" and "Show attachments". This can even be
> automatized by putting
>
> Start page = ?mode=full&attach=1
>
> into the configuration file.
Perfect it works !! :-)
>
> > - images (and hopefully ps, eps, pdf) be displayed inline just after the
> > text body of the message in the main "List" view
>
> PS, EPS and PDF files cannot be displayed inline by the browser (at least not
> the browsers I know). I guess what you want is that users submit PDFs, and elog
> should convert the PDF automatically into JPG and display a reduced version of
> it. Unfortunately this is not possible, and it never will be, since one of the
> design prinicples of elog is to be independent of any other package, and with
> the requested functionality you would need lots of helper functions (like
> ghostview, pbmtools, etc.) which some of which are not present under Windows.
>
> > - possibility to configure the scale of this view
> > - possibility of build some thumbs in order to save BW and time
>
> Using a HTML <img width=100 ...> does not help. The image is then shown in a
> smaller scale, but still the full picture has to be transferred. For making
> thumbnails, you again need external libraries (see point above).
yes I know, but it could be a "placebo" :-P .. we are using the elog in a lan so it
could be a good temporary solution ...
can you point me to some documentation I can read to be able to do it? should I edit
the css file ?
>
> So if you want extensive image processing, you might be better of with a picture
> gallery like applications, but maybe the automatic attachment display shown
> above helps a little bit.
yes, of course...
can be usefull to be able to "optionally" execute some external program (a sort of
pipe) in order to be (eventually) able to set a "filter program" for attachments.
The same way an MTA does with procmail I mean.
in this case one has to be able to access both to the original image and the
processed one... |
Re: images attached shown as inline , posted by Stefan Ritt on Mon Feb 7 14:23:37 2005
|
> yes I know, but it could be a "placebo" :-P .. we are using the elog in a lan so it
> could be a good temporary solution ...
>
> can you point me to some documentation I can read to be able to do it? should I edit
> the css file ?
No, I would have to add another option to the configuration file, it's not yet implemented.
> can be usefull to be able to "optionally" execute some external program (a sort of
> pipe) in order to be (eventually) able to set a "filter program" for attachments.
> The same way an MTA does with procmail I mean.
>
> in this case one has to be able to access both to the original image and the
> processed one...
Executing and external program is possible via the
Execute new/edit/delete = ...
command. While you can pass attribute values to the program to be executed, it is not
possible right now to pass attachment names, although this could be easily added. What
would be harder is to reformat the whole entry. If you just downsample an image, that
would be ok. But if you want to keep the original, you would have to modify the logbook
entry to contain n*2 attachments afterwards, which would not be easy.
So I don't see a simple way of achieving what you want. Sorry. |
Re: images attached shown as inline , posted by Emiliano Gabrielli on Mon Feb 7 15:59:04 2005
|
> > yes I know, but it could be a "placebo" :-P .. we are using the elog in a lan so it
> > could be a good temporary solution ...
> >
> > can you point me to some documentation I can read to be able to do it? should I edit
> > the css file ?
>
> No, I would have to add another option to the configuration file, it's not yet implemented.
>
uhm ok .. can I expect to get a release with this feature in the near future ?
tnx in advance |
Re: images attached shown as inline , posted by Stefan Ritt on Mon Feb 7 21:07:58 2005
|
> uhm ok .. can I expect to get a release with this feature in the near future ?
I checked how I would do that and did not find a good solution. If I put a
<img width=300 ...>
for example, this scales down a big picture to only 300 pixels width. But if you submit a small
picture, like just an icon, it blows it up to 300 pixels as well, which does not look nice.
Unfortunatle I don't know of any option like "maxwidth=x" which only scales pictures down if they
are larger than x. Do you know? |
Re: images attached shown as inline , posted by Emiliano Gabrielli on Tue Feb 8 12:39:53 2005
|
> > uhm ok .. can I expect to get a release with this feature in the near future ?
>
> I checked how I would do that and did not find a good solution. If I put a
>
> <img width=300 ...>
>
> for example, this scales down a big picture to only 300 pixels width. But if you submit a small
> picture, like just an icon, it blows it up to 300 pixels as well, which does not look nice.
> Unfortunatle I don't know of any option like "maxwidth=x" which only scales pictures down if they
> are larger than x. Do you know?
the following should do the job:
<table><TR><TD width="200">
<img src="IMG_3133.jpg" width="100%">
</TD></TR></table>
or (better I think)
<div style="width: 200px">
<img src="IMG_3133.jpg" style="width: 100%" />
</div>
the configurable parameter should be with obviously :-) |
Re: images attached shown as inline , posted by Stefan Ritt on Sat Feb 12 17:08:32 2005
|
> the following should do the job:
>
> <div style="width: 200px">
> <img src="IMG_3133.jpg" style="width: 100%" />
> </div>
>
> the configurable parameter should be with obviously :-)
Unfortunately not. Please find attached the screen dump from such a try, together with the HTML code.
As you can see, the little elog icon is stretched to the same width as the upper (large) picture. |
Re: images attached shown as inline , posted by Emiliano Gabrielli on Wed Feb 16 08:58:47 2005
|
> > the following should do the job:
> >
> > <div style="width: 200px">
> > <img src="IMG_3133.jpg" style="width: 100%" />
> > </div>
> >
> > the configurable parameter should be with obviously :-)
>
> Unfortunately not. Please find attached the screen dump from such a try, together with the HTML code.
> As you can see, the little elog icon is stretched to the same width as the upper (large) picture.
you are right ;-( I used a different code in my test and sent you and old test code, *but* also the last
one does not works on every browser ... the following code would do the job, but it seems to work only
in gecko-based browsers such as mozilla, firefox and safari ...
<div style="width: 200px">
<img src="IMG_3133.jpg" style="max-width: 200" />
</div>
other browsers do not scale the vertical dimention :-( |
Re: images attached shown as inline , posted by Stefan Ritt on Wed Feb 16 09:02:09 2005
|
As I wrote you by mail, I implemented your idea in the following way. As you
say, it's only working on Gecko based systems. I did not implement additional
configuration parameters, but made it through the CSS file:
- adding a new CSS style "attachmentframe" around all attachments
- adding class "attachmentframe" to the 'default.css' like:
.attachmentframe {
border:1px solid grey;
border-top:1px solid lightgrey;
border-left:1px solid lightgrey;
background-color:white;
padding:5px;
}
.attachmentframe img {
max-width:100%;
}
The latter restricts the image size to 100%, which is the width of the
browser window. I like it that, but of course you can write 200px or
anything else. Please find the modified elogd.c and default.css under CVS. |
[patch] Re: images attached shown as inline , posted by Emiliano Gabrielli on Tue Feb 8 19:04:25 2005
|
> > uhm ok .. can I expect to get a release with this feature in the near future ?
>
> I checked how I would do that and did not find a good solution. If I put a
>
> <img width=300 ...>
>
> for example, this scales down a big picture to only 300 pixels width. But if you submit a small
> picture, like just an icon, it blows it up to 300 pixels as well, which does not look nice.
> Unfortunatle I don't know of any option like "maxwidth=x" which only scales pictures down if they
> are larger than x. Do you know?
the following patch should do the job:
#################################################################################
--- elogd_orig.c 2005-02-03 16:46:10.000000000 +0100
+++ elogd_imgscale.c 2005-02-08 18:58:14.000000000 +0100
@@ -13690,9 +13690,14 @@
("<tr><td colspan=%d class=\"attachment\">%s %d: <a href=\"%s\">%s</a>\n",
colspan, loc("Attachment"), index + 1, ref, attachment[index] + 14);
if (show_attachments)
- rsprintf
- ("</td></tr><tr><td colspan=%d class=\"messagelist\"><img
src=\"%s\"></td></tr>",
- colspan, ref);
+ if (!getcfg(lbs->name, "Attached image width", str, sizeof(str))) {
+ rsprintf("</td></tr><tr><td colspan=%d class=\"messagelist\"><img
src=\"%s\"></td></tr>",
+ colspan, ref);
+ } else {
+ rsprintf("</td></tr><tr><td colspan=%d class=\"messagelist\">"
+ "<div style=\"width: %s\"><img src=\"%s\" style=\"width:
100%\"></div></td></tr>",
+ colspan, str, ref);
+ }
} else {
rsprintf
("<tr><td colspan=%d class=\"attachment\">%s %d: <a href=\"%s\">%s</a>\n",
@@ -18090,7 +18095,10 @@
if (is_image(att)) {
rsprintf("<tr><td class=\"messageframe\">\n");
rsprintf("<a name=\"att%d\"></a>\n", index + 1);
- rsprintf("<img src=\"%s\"></td></tr>", ref);
+ if (!getcfg(lbs->name, "Attached image width entry", str, sizeof(str)))
+ rsprintf("<img src=\"%s\"></td></tr>", ref);
+ else
+ rsprintf("<div style=\"width: %s\"><img src=\"%s\" style=\"width:
100%\"></div></td></tr>", str, ref);
rsprintf("</td></tr>\n\n");
} else {
if (is_ascii(file_name)) {
##########################################################################################
two new elog.conf parameters are defined:
Attached image width ; width of full view image attached
Attached image width entry ; width of attached image in the entry list view
plz apply :-) |
[patch] Re: images attached shown as inline , posted by Stefan Ritt on Sat Feb 12 17:48:51 2005
|
Are you sure that this does not stretch small images? Please see elog:931
> two new elog.conf parameters are defined:
> Attached image width ; width of full view image attached
> Attached image width entry ; width of attached image in the entry list view
I would rather go with a new class in the CSS file to contain this options, since I
want to keep the number of options as small as possible. |
[patch]: fixed wrong extention check, posted by Emiliano Gabrielli on Tue Feb 8 17:40:54 2005
|
current version uses strstr() to check if the file has the expected ascii
text extension ... this is buggy becouse this way a file named
".txt_hidden_file" or "foo.config.dat" are both seen as .txt files.
the following patch fixes the problem, plz apply to cvs:
#######################################################################
--- elogd_orig.c 2005-02-03 16:46:10.000000000 +0100
+++ elogd_extchk_fix.c 2005-02-08 17:32:21.000000000 +0100
@@ -1160,6 +1160,28 @@
#define my_toupper(_c) ( ((_c)>='a' && (_c)<='z') ? ((_c)-'a'+'A') : (_c) )
+static BOOL chkext(const char *str, const char *ext)
+{
+ int extl, strl;
+ char c1, c2;
+
+ if (ext == NULL || str == NULL)
+ return FALSE;
+
+ extl = strlen(ext);
+ strl = strlen(str);
+ if (extl >= strl)
+ return FALSE;
+ str = str+strl-extl;
+ while (*str) {
+ c1 = *str++;
+ c2 = *ext++;
+ if (my_toupper(c1) != my_toupper(c2))
+ return FALSE;
+ }
+ return TRUE;
+}
+
BOOL strieq(const char *str1, const char *str2)
{
char c1, c2;
@@ -1168,6 +1190,8 @@
return TRUE;
if (str1 == NULL || str2 == NULL)
return FALSE;
+ if (strlen(str1)!=strlen(str2))
+ return FALSE;
while (*str1) {
c1 = *str1++;
@@ -13698,8 +13722,8 @@
("<tr><td colspan=%d class=\"attachment\">%s %d: <a
href=\"%s\">%s</a>\n",
colspan, loc("Attachment"), index + 1, ref,
attachment[index] + 14);
- if ((strstr(str, ".TXT") || strstr(str, ".ASC") ||
strstr(str, ".CFG")
- || strstr(str, ".CONF")
+ if ((chkext(str, ".TXT") || chkext(str, ".ASC") ||
chkext(str, ".CFG")
+ || chkext(str, ".CONF")
|| strchr(str, '.') == NULL) && show_attachments) {
/* display attachment */
rsprintf("</td></tr><tr><td colspan=%d
class=\"messagelist\"><pre>", colspan);
@@ -14779,7 +14803,7 @@
regex_t re_buf[MAX_N_ATTR + 1];
regmatch_t pmatch[10];
- /* redirect if enpty parameters */
+ /* redirect if empty parameters */
if (strstr(_cmdline, "=&")) {
while ((pt1 = strstr(_cmdline, "=&")) != NULL) {
pt2 = pt1;
####################################################################### |
Re: [patch]: fixed wrong extention check, posted by Stefan Ritt on Sat Feb 12 17:45:39 2005
|
> current version uses strstr() to check if the file has the expected ascii
> text extension ... this is buggy becouse this way a file named
> ".txt_hidden_file" or "foo.config.dat" are both seen as .txt files.
I added your routine chkext() to the code, but actually use it differently. I
display now ASCII files not by their extension, but the code checks for each file
to contain non-printable characters. If it contains all printable letters, and does
not have the extension PDF, PS or EPS, it's shown inline. |
Re: [patch]: fixed wrong extention check, posted by Emiliano Gabrielli on Wed Feb 16 08:48:52 2005
|
> > current version uses strstr() to check if the file has the expected ascii
> > text extension ... this is buggy becouse this way a file named
> > ".txt_hidden_file" or "foo.config.dat" are both seen as .txt files.
>
> I added your routine chkext() to the code, but actually use it differently. I
> display now ASCII files not by their extension, but the code checks for each file
> to contain non-printable characters. If it contains all printable letters, and does
> not have the extension PDF, PS or EPS, it's shown inline.
I totally agree with you choice :-) |
preselected values and conditional options, posted by Emiliano Gabrielli on Mon Feb 7 13:28:18 2005
|
here is a piece of my current config:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
Attributes = Author, Type, Category, Subject
Required Attributes = Author, Type, Subject
Options Type = Deposition{1}, Arc Studies{1}, Conditioning{1}, Vacuum{2},
Other{3}
Show Attributes = Author, Subject, Type
{1}ROptions Category = Nb, NbN, W, cavity system
{2}ROptions Category = pump, leak, mounting
{1}Show Attributes = Author, Subject, Type, Category
{2}Show Attributes = Author, Subject, Type, Category
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
this is an escamotage I use to have the option to be displyed.
I mean that something like the following:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
Attributes = Author, Type, Category, Subject
Required Attributes = Author, Type, Subject
Options Type = Deposition{1}, Arc Studies{1}, Conditioning{1}, Vacuum{2},
Other{3}
Preset Type = Deposition
{1}ROptions Category = Nb, NbN, W, cavity system
{2}ROptions Category = pump, leak, mounting
{3}Show Attributes = Author, Subject, Type
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
rises a bug: the select input correctly shows "Deposition" as preselected
value, BUT the attributes shown are not those identified by the "{3}".
re-selecting by hand the "deposition" Type option everything goes right.
sorry for my bad english |
Re: preselected values and conditional options, posted by Emiliano Gabrielli on Tue Feb 8 13:13:22 2005
|
up :-) |
Re: preselected values and conditional options, posted by Stefan Ritt on Sat Feb 12 17:06:44 2005
|
> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
> Attributes = Author, Type, Category, Subject
> Required Attributes = Author, Type, Subject
> Options Type = Deposition{1}, Arc Studies{1}, Conditioning{1}, Vacuum{2},
> Other{3}
> Preset Type = Deposition
The "Preset xxx" option actually never was ment to be used with conditional
attributes. I added that functionality in rev. 1.553. Please give it a try. |
Re: preselected values and conditional options, posted by Emiliano Gabrielli on Wed Feb 16 08:45:54 2005
|
> > ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
> > Attributes = Author, Type, Category, Subject
> > Required Attributes = Author, Type, Subject
> > Options Type = Deposition{1}, Arc Studies{1}, Conditioning{1}, Vacuum{2},
> > Other{3}
> > Preset Type = Deposition
>
> The "Preset xxx" option actually never was ment to be used with conditional
> attributes. I added that functionality in rev. 1.553. Please give it a try.
it works fine !!! thank you so much (btw, using Preset xxx{1} it doesn't
works.. but it should be the correct beaviour) |
Configuration problems, posted by Erich Beyrent on Mon Feb 14 17:10:00 2005
|
I am trying to run eLog under Apache 2 on my FreeBSD 5.3 server. I started
the daemon with "elogd -n <my hostname> -p 8080" and when I connect to my
server on that port, I get a 500 server configuration error. The Apache log
contains this:
malformed header from script. Bad header=Please specify hostname.: elog
I am running elogd 2.5.7-1 built Feb 14 2005, 09:55:19 revision 1.558
Any assistance would be greatly appreciated!
-Erich- |
Re: Configuration problems, posted by Stefan Ritt on Mon Feb 14 19:03:31 2005
|
> I am trying to run eLog under Apache 2 on my FreeBSD 5.3 server. I started
> the daemon with "elogd -n <my hostname> -p 8080" and when I connect to my
> server on that port, I get a 500 server configuration error. The Apache log
> contains this:
>
> malformed header from script. Bad header=Please specify hostname.: elog
- make sure your proxy definition in httpd.conf is correct and it uses port 8080
- start elogd with the "-v" flag to see the communication between Apache and elogd
- maybe you might need an "URL = http://<my hostname>/<elog dir>/" in the config
file |
Re: Configuration problems, posted by Erich Beyrent on Mon Feb 14 20:39:30 2005
|
> > I am trying to run eLog under Apache 2 on my FreeBSD 5.3 server. I started
> > the daemon with "elogd -n <my hostname> -p 8080" and when I connect to my
> > server on that port, I get a 500 server configuration error. The Apache log
> > contains this:
> >
> > malformed header from script. Bad header=Please specify hostname.: elog
>
> - make sure your proxy definition in httpd.conf is correct and it uses port 8080
> - start elogd with the "-v" flag to see the communication between Apache and elogd
> - maybe you might need an "URL = http://<my hostname>/<elog dir>/" in the config
> file
No luck. I have the proxy definition in my httpd.conf file. I have the URL parameter
in my elogd.cfg file.
Here is the command line I am using to start the daemon:
elogd -v -D -n <myhost> -p 8080 -l <myhost>/cgi-bin/elog/logbooks -c
/usr/local/server/apache/cgi-bin/elog/elogd.cfg
With the -v argument, here are the messages I get in /var/log/messages:
elogd 2.5.7-1 built Feb 14 2005, 09:55:19
Feb 14 14:38:28 onion elogd[34579]: revision 1.558
Feb 14 14:38:28 onion elogd[34579]: Config file :
/usr/local/server/apache/cgi-bin/elog/elogd.cfg
Feb 14 14:38:28 onion elogd[34579]: Resource dir : /usr/local/server/apache/cgi-bin/elog/
Feb 14 14:38:28 onion elogd[34579]: Logbook dir :
/usr/local/server/apache/cgi-bin/elog/logbooks/
Feb 14 14:38:28 onion elogd[34579]: Falling back to default group "elog"
Feb 14 14:38:28 onion elogd[34579]: Group "elog" not found
Feb 14 14:38:28 onion elogd[34579]: Falling back to default group "nogroup"
Feb 14 14:38:28 onion elogd[34579]: Falling back to default user "elog"
Feb 14 14:38:28 onion elogd[34579]: User "elog" not found
Feb 14 14:38:28 onion elogd[34579]: Falling back to default user "nobody"
Feb 14 14:38:28 onion elogd[34579]: Indexing logbook "demo" ...
Feb 14 14:38:28 onion elogd[34579]:
Feb 14 14:38:28 onion elogd[34579]: ID 1, 011108a.log, ofs 0, thead, MD5=
Feb 14 14:38:28 onion elogd[34579]: E4
Feb 14 14:38:28 onion elogd[34579]: 25
Feb 14 14:38:28 onion elogd[34579]: 4C
Feb 14 14:38:28 onion elogd[34579]: B8
Feb 14 14:38:28 onion elogd[34579]: AD
Feb 14 14:38:28 onion elogd[34579]: 4E
Feb 14 14:38:28 onion elogd[34579]: 88
Feb 14 14:38:28 onion elogd[34579]: 68
Feb 14 14:38:28 onion elogd[34579]: 08
Feb 14 14:38:28 onion elogd[34579]: 91
Feb 14 14:38:28 onion elogd[34579]: C9
Feb 14 14:38:28 onion elogd[34579]: 4D
Feb 14 14:38:28 onion elogd[34579]: 1E
Feb 14 14:38:28 onion elogd[34579]: B7
Feb 14 14:38:28 onion elogd[34579]: CB
Feb 14 14:38:28 onion elogd[34579]: C3
Feb 14 14:38:28 onion elogd[34579]:
Feb 14 14:38:28 onion elogd[34579]: After sort:
Feb 14 14:38:28 onion elogd[34579]: ID 1, 011108a.log, ofs 0
Feb 14 14:38:28 onion elogd[34579]: ok
Feb 14 14:38:28 onion elogd[34579]: Server listening on port 8080 ...
I am still getting the exact same error in my Apache log.
Any more ideas?
-Erich- |
Re: Configuration problems, posted by Stefan Ritt on Mon Feb 14 20:43:48 2005
|
> No luck. I have the proxy definition in my httpd.conf file. I have the URL parameter
> in my elogd.cfg file.
Can you show me the proxy definition? I hope you don't treat elogd as a CGI script... |
ELOG security vulnerability fixed, IMPORTANT!!!!, posted by Stefan Ritt on Mon Feb 14 12:36:30 2005
|
Dear ELOG users,
It has been brought to my attention that ELOG has a vulnerability through
which one can obtain a remote shell (meaning to log in to your machine
through elog). There is even an exploit available which demonstrates that
both for linux and windows.
This is a severe security problem for all logooks which can be seen from
outside, even if they have password protection on. I strongly recommened to
upgrade to elog version 2.5.7 as soon as possible if you run a public elog
server.
Here is some explanation for the technically interested:
The problem arises from a strcpy() in the decode_post() routine, which
triggers a buffer overflow when attachment file names longer than 256
characters are submitted. I replaced (hopefully) all strcpy() with strlcpy()
to fix this problem, but if someone sees a location which I have missed,
please tell me.
The second vulnerability had to do with write passwords. If you put a "write
password = xxx" statement into your config file, it was still possible to
download the config file with a special hand-written URL, and decode the
write password, which is usually only base-64 encoded unless you haven't
compiled elog with the -DHAVE_CRYPT flag. I have changed that so if a write
password is present, the download is only possible when this password is
submitted in each request. If this has some effects on synchronizing of
logbooks, please let me know.
Stefan Ritt |
Re: ELOG security vulnerability fixed, IMPORTANT!!!!, posted by Recai Oktas on Mon Feb 14 18:49:44 2005
|
Attention to Debian users;
I've prepared the fixed package and also contacted to Debian Security Team for
an urgent security upload. Since then you may wish to update your package from
the following URL:
http://l10n-turkish.alioth.debian.org/debian/elog_2.5.7+r1558-1_i386.deb
Or you can also make an update via apt-get by adding the below line to your
'/etc/apt/sources.list' file:
deb http://l10n-turkish.alioth.debian.org/debian/ ./
> The second vulnerability had to do with write passwords. If you put a "write
> password = xxx" statement into your config file, it was still possible to
> download the config file with a special hand-written URL, and decode the
> write password, which is usually only base-64 encoded unless you haven't
> compiled elog with the -DHAVE_CRYPT flag.
FYI, Debian package has already been compiled with this flag.
-- Recai Oktas, Maintainer of Debian package |
ELOG Command Line Utility, posted by Tim Fowler on Wed Feb 9 15:40:12 2005
|
I am trying to use the command line utility elog. Some of the attributes
that I have setup are multiple options. When I run the command line
utility to create a new message, any attribute that is setup with multiple
options will not be filled in. The syntax I am using is as follows:
elog -h localhost -p 8080 -l Lab -a "Site=xxxx" -a "Area=System" -
a "Priority=Low" -a "Shift=1" -a "Status=Open" -m text.txt
Site and Area are defined in the config file as MOptions. Is there a way
to use this feature with multiple options on attributes with the
attributes = to one or more variables? |
Re: ELOG Command Line Utility, posted by Stefan Ritt on Sun Feb 13 17:21:19 2005
|
> I am trying to use the command line utility elog. Some of the attributes
> that I have setup are multiple options. When I run the command line
> utility to create a new message, any attribute that is setup with multiple
> options will not be filled in. The syntax I am using is as follows:
>
> elog -h localhost -p 8080 -l Lab -a "Site=xxxx" -a "Area=System" -
> a "Priority=Low" -a "Shift=1" -a "Status=Open" -m text.txt
>
> Site and Area are defined in the config file as MOptions. Is there a way
> to use this feature with multiple options on attributes with the
> attributes = to one or more variables?
For MOptions, you have to append an "_n" to each attribute to distinguish
different options for the same attribute, like
elog -h localhost -p 8080 -l Lab -a "Site_0=Home" -a "Site_1=Work" ...
Even if you only use one attribute, the trailing "..._0" is necessary. I will
add a note to the documentation. |
Help with configuration newbie, posted by Anand Sengupta on Fri Feb 11 15:44:38 2005
|
Hi,
We have set up a elog server at our institute. The configuration file is
attached. We have the following queries:
1. When replying to another reply in a thread, the author_name attribute is
not substitued (as desired). Since this is a mandatory field, we are not
able to send the reply message. However, reply to the originial message
works fine.
2. "Use Email From = string" prepends an additional "" to the "From"
field in the e-mails.
3. "Fixed Attributes Reply = Subject" fixes the subject line while replying.
However when we add "Category" attribute to this list, it breaks.
Can someone help us?
Suggestions and tips will be thankfully recieved. |
Re: Help with configuration newbie, posted by Stefan Ritt on Sat Feb 12 20:11:48 2005
|
> 1. When replying to another reply in a thread, the author_name attribute is
> not substitued (as desired). Since this is a mandatory field, we are not
> able to send the reply message. However, reply to the originial message
> works fine.
Preset on reply Author = $long_name
Do not use "Remove on reply".
> 2. "Use Email From = string" prepends an additional "" to the "From"
> field in the e-mails.
This has been fixed recently, please update.
> 3. "Fixed Attributes Reply = Subject" fixes the subject line while replying.
> However when we add "Category" attribute to this list, it breaks.
I tried to use your config file and add
Fixed attributes reply = Subject, Category
and it worked as expected. What kind of "break" did you observe? |
Re: Help with configuration newbie, posted by Anand Sengupta on Sat Feb 12 20:51:43 2005
|
> > 1. When replying to another reply in a thread, the author_name attribute is
> > not substitued (as desired). Since this is a mandatory field, we are not
> > able to send the reply message. However, reply to the originial message
> > works fine.
>
> Preset on reply Author = $long_name
>
> Do not use "Remove on reply".
This worked. Thanks.
>
> > 2. "Use Email From = string" prepends an additional "" to the "From"
> > field in the e-mails.
>
> This has been fixed recently, please update.
Agani, thanks for the information.
>
> > 3. "Fixed Attributes Reply = Subject" fixes the subject line while replying.
> > However when we add "Category" attribute to this list, it breaks.
>
> I tried to use your config file and add
>
> Fixed attributes reply = Subject, Category
>
> and it worked as expected. What kind of "break" did you observe?
For me, when I put the Category in the fixed attributes for reply, I see the
Category but when I actually try to send the message - it says Category not
entered. I am sure I am doing something very stupid. Please help.
- Anand. |
Re: Help with configuration newbie, posted by Stefan Ritt on Sun Feb 13 16:43:05 2005
|
> For me, when I put the Category in the fixed attributes for reply, I see the
> Category but when I actually try to send the message - it says Category not
> entered. I am sure I am doing something very stupid. Please help.
No, it was a bug, which I could reproduce now. I fixed it in revision 1.554. It will
be contained in the next release. |
erroneus encoding, posted by Emiliano Gabrielli on Tue Feb 8 13:00:40 2005
|
elog sends wrong HTTP headers, charset is empty and not separed from the
next one "Connection: Keep-Alive ... this bug tells the browser that the
encoding is "connection:" ... that is wrong.
root@emc2:/home/albert# GET -USde http://midas.psi.ch/elogs/Forum/
GET http://midas.psi.ch/elogs/Forum/
User-Agent: lwp-request/2.06
GET http://midas.psi.ch/elogs/Forum/ --> 200 Document follows
Connection: close
Date: Tue, 08 Feb 2005 11:54:40 GMT
Pragma: no-cache
Server: ELOG HTTP 2.5.6-2
Content-Type: text/html;charset=Connection: Keep-Alive
Expires: Fri, 01 Jan 1983 00:00:00 GMT
.....
....
this is the problem from validator point of viev:
http://validator.w3.org/check?uri=http%3A%2F%2Fmidas.psi.ch%2Felogs%2FForum%2F&charset=%28detect+automatically%29&doctype=%28detect+automatically%29&ss=1&verbose=1 |
Re: erroneus encoding, posted by Emiliano Gabrielli on Tue Feb 8 15:41:55 2005
|
the following patch corrects the problem, plz apply :
--- elogd.c 2005-02-03 16:46:10.000000000 +0100
+++ elogd_albert.c 2005-02-08 15:40:36.000000000 +0100
@@ -6178,7 +6178,7 @@
if (getcfg("global", "charset", str, sizeof(str)))
rsprintf("Content-Type: text/html;charset=%s\r\n", str);
else
- rsprintf("Content-Type: text/html;charset=%S\r\n", DEFAULT_HTTP_CHARSET);
+ rsprintf("Content-Type: text/html;charset=%s\r\n", DEFAULT_HTTP_CHARSET);
if (use_keepalive) {
rsprintf("Connection: Keep-Alive\r\n");
@@ -11267,7 +11267,7 @@
rsprintf("Server: ELOG HTTP %s\r\n", VERSION);
rsprintf("Accept-Ranges: bytes\r\n");
rsprintf("Connection: close\r\n");
- rsprintf("Content-Type: text/plain;charset=%S\r\n", DEFAULT_HTTP_CHARSET);
+ rsprintf("Content-Type: text/plain;charset=%s\r\n", DEFAULT_HTTP_CHARSET);
rsprintf("Pragma: no-cache\r\n");
rsprintf("Expires: Fri, 01 Jan 1983 00:00:00 GMT\r\n\r\n"); |
Re: erroneus encoding, posted by Stefan Ritt on Sat Feb 12 17:31:46 2005
|
> elog sends wrong HTTP headers, charset is empty and not separed from the
> next one "Connection: Keep-Alive ... this bug tells the browser that the
> encoding is "connection:" ... that is wrong.
This has to do with the "%S" vs. "%s" bug described elsewhere in this forum.
I fixed that. The validator link above now also reports error free. |
|