Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 211 of 806  Not logged in ELOG logo
    icon2.gif   Re: Attribute substitution in email configuration, posted by Stefan Ritt on Wed Jan 18 13:06:50 2006 

Adam Blandford wrote:
Not sure if this functionality is intended or is a bug.


It was not implemented, however you call this Wink

I added that in the current SVN version, so it will be contained in the next release.
    icon2.gif   Re: Problems with ELOG and Internet Explorer, posted by Stefan Ritt on Wed Jan 18 13:31:32 2006 
Have you tried another browser, like Firefox? Do you have the same problems with Firefox? Can you try the following:

Start elogd manually with the "-v" flag, like
elogd -c <your config path> -v -p 8080
and watch the output carefully. When you submit an entry, elogd does redirection. You will see that in the HTTP header you have an entry like
...
Location: https://...
...
This location is taken from the URL statement of your config file. If it's wrong (like if you mixed http:// and https://), your browser will try to load the page from a non-existion location.
    icon2.gif   Re: Buffer Overflow?, posted by Stefan Ritt on Thu Jan 19 10:31:05 2006 

Chris Warner wrote:
Users can access root level directories by using a modified URL. I saw on some security web sites that this was a problem in previous versions. Was it not fixed in 2.6?

To recreate enter http://yourhost.yourdomain.com/../../../../etc/passwd

view your password file in the browser.

If this was previously reported, is there a fix?

Chris Warner


Thanks for telling me, I didn't know. I was able to reproduce your problem under certain conditions, and I just released version 2.6.1 to fix it. However it has nothing to do with an old buffer overflow (see elog:941).

I would strongly advise everybody to upgrade as soon as possible.
    icon2.gif   Re: Access to global configuration in v2.6.1, posted by Stefan Ritt on Thu Jan 19 15:23:02 2006 
> I just installed v.2.6.1 coming from the previous 2.6.0 (on Win2000)
> When I access the "configuration" function from a logbook, in the cfg page I only see two buttons in the header
> (save or cancel); in the previous version I saw more buttons there ("global config", "create new logbook" and so
> on), so here I'm unable to access global configuration or logbook management (except for current logbook options).

I tried to reproduce your problem, but could not. In my windows installation it looks fine. You only see the
(save and cancel) buttons only if you go to "Change [global]", otherwise you see the "Change [global]", "Delete
this logbook" etc. buttons. Have you tried with the default elogd.cfg which comes from the distribution?
    icon2.gif   Re: settings for "show only new entries", posted by Stefan Ritt on Thu Jan 19 17:05:22 2006 

Ulrich Trüssel wrote:
how ca i set the date for the "show only new entries" button? maybe i missed somethin on the elog.cfg description?
thank's for hint! Smile


That button works as follows: When you are active browsing entries, your activity is recorded (only the time) in the password file. Now when you are inactive for more than one hour, you are considered "logged out", and your last activity is taken as a filter for new entries. That means you see new entries since your last activity in the logbook. If you want to see the last day/week/month etc. you can define a quick filter on the date instead.
    icon2.gif   Re: In version 2.6 the themes do not work right on Windows., posted by Stefan Ritt on Thu Jan 19 20:53:01 2006 

Mark Coudriet wrote:
But I just updated to your new version 2.6.1 & everything is fine now. Thanks for your help! Big grin


Japp. I switched back to relative links for CSS again, seems to give less trouble. Pleased
    icon2.gif   Re: redirect errors via apache2, posted by Stefan Ritt on Mon Jan 23 10:57:45 2006 
> Since elog 2.6.0 we cannot redirect our elog via apache2.
> 
> in apache2.conf we have (had for a long time):
> Redirect permanent /elog http://elog.oursite.com/elog/
> ProxyPass /elog/ http://elog.oursite.com:8080/
> 
> When visiting the url, this results in:
> The proxy server received an invalid response from an upstream server.
> The proxy server could not handle the request GET /elog/myelog/.
> 
> After testing we found that ELOG V2.6.0-beta2 works just fine.
> 2.6.0 stable crashes after visiting a redirected url.
> 
> Running on debian sarge

Have you tried 2.6.1. I released it just recently, so I don't know when it will be available for Debian. Have you
checked that your "URL = xxx" statement in the config file is correct? I see above "myelog", while the proxy
passes requests to "elog".
    icon2.gif   Re: Quicklink does not work for one field, posted by Stefan Ritt on Tue Jan 24 08:11:13 2006 

mark james wrote:

mark james wrote:

Stefan Ritt wrote:

mark james wrote:
I am not so bold as to log this as a bug but one of my Quicklink fields just do not work.


Sorry my late reply, but now I have fixed this problem. The update is under SVN and will be contained in the next release.


Thanks for that. I am now using ver V2.6.1-1622. So I guess that doesn't qualify as a "next release". I wonder if there is anything I could do to work around the issue?

Mark

In fact now the dropdown seems to be working but when I 'tick' an entry, it is not being written to the ascii file.


Can you try V2.6.1-1634? I fixed several issues with ticking entries coming from "MOptions" lists.
ELOG V3.1.5-3fb85fa6