Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 225 of 796  Not logged in ELOG logo
ID Date Icon Author Author Email Category OSup ELOG Version Subject
  1601   Wed Jan 18 12:33:00 2006 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux Re: Automatic Copy to

Chris Warner wrote:
Is it possible to configure elog to copy a new entry from 1 logbook to another?


No, you have to copy entries manually with the "Copy to" menu command. For that, you have to put something like

Menu commands = List, New, Edit, Copy to, Delete, Reply, Duplicate, Find, Config, Help

into your configuration file.
  1603   Wed Jan 18 12:49:39 2006 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux Re: Email based on not attribute value

Chris Warner wrote:
For instance, I have a server logbook that several people are able to write to. There is one person that is ultimately responsible for this server. I would like to generate an email any time that someone other than the System Administrator creates a new entry.


No, but there is a trick you can use. Put following into your config file:
Attributes = Author, ...
Preset Author = $long_name
Locked Attributes = Author
Options Author = Admin{1}, other{2}
{1}Suppress default = 1

Replace "Admin" with the name of the administrator. The "Author" field gets automatically set to the author name, and it's locked, so there will no be drop-down box which lets you select between "Admin" and "other". Now if the author is equal to "Admin", the condition {1} becomes true, and the "Supress default is executed. This check the "suppress email notificatio" box at the bottom, so normally no email gets sent from the administrator.
  1606   Wed Jan 18 13:31:32 2006 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux2.6.0Re: Problems with ELOG and Internet Explorer
Have you tried another browser, like Firefox? Do you have the same problems with Firefox? Can you try the following:

Start elogd manually with the "-v" flag, like
elogd -c <your config path> -v -p 8080
and watch the output carefully. When you submit an entry, elogd does redirection. You will see that in the HTTP header you have an entry like
...
Location: https://...
...
This location is taken from the URL statement of your config file. If it's wrong (like if you mixed http:// and https://), your browser will try to load the page from a non-existion location.
  1607   Wed Jan 18 17:20:45 2006 Warning Chris Warnerchristopher_warner@dcd.uscourts.govBug reportLinux2.6Buffer Overflow?
Users can access root level directories by using a modified URL. I saw on some security web sites that this was a problem in previous versions. Was it not fixed in 2.6?

To recreate enter http://yourhost.yourdomain.com/../../../../etc/passwd

view your password file in the browser.


If this was previously reported, is there a fix?

Chris Warner
  1608   Thu Jan 19 10:31:05 2006 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2.6Re: Buffer Overflow?

Chris Warner wrote:
Users can access root level directories by using a modified URL. I saw on some security web sites that this was a problem in previous versions. Was it not fixed in 2.6?

To recreate enter http://yourhost.yourdomain.com/../../../../etc/passwd

view your password file in the browser.

If this was previously reported, is there a fix?

Chris Warner


Thanks for telling me, I didn't know. I was able to reproduce your problem under certain conditions, and I just released version 2.6.1 to fix it. However it has nothing to do with an old buffer overflow (see elog:941).

I would strongly advise everybody to upgrade as soon as possible.
  1615   Fri Jan 20 02:53:40 2006 Smile Chris Warnerchristopher_warner@dcd.uscourts.govCommentLinux2.6Re: Buffer Overflow?

Stefan Ritt wrote:

Chris Warner wrote:
Users can access root level directories by using a modified URL. I saw on some security web sites that this was a problem in previous versions. Was it not fixed in 2.6?

To recreate enter http://yourhost.yourdomain.com/../../../../etc/passwd

view your password file in the browser.

If this was previously reported, is there a fix?

Chris Warner


Thanks for telling me, I didn't know. I was able to reproduce your problem under certain conditions, and I just released version 2.6.1 to fix it. However it has nothing to do with an old buffer overflow (see elog:941).

I would strongly advise everybody to upgrade as soon as possible.


Thanks for the quick response!
  1617   Mon Jan 23 10:30:51 2006 Question djekdjek@xs4all.nlBug reportLinux2.6.1 redirect errors via apache2
Since elog 2.6.0 we cannot redirect our elog via apache2.

in apache2.conf we have (had for a long time):
Redirect permanent /elog http://elog.oursite.com/elog/
ProxyPass /elog/ http://elog.oursite.com:8080/

When visiting the url, this results in:
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request GET /elog/myelog/.

After testing we found that ELOG V2.6.0-beta2 works just fine.
2.6.0 stable crashes after visiting a redirected url.

Running on debian sarge
  1618   Mon Jan 23 10:57:45 2006 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2.6.1 Re: redirect errors via apache2
> Since elog 2.6.0 we cannot redirect our elog via apache2.
> 
> in apache2.conf we have (had for a long time):
> Redirect permanent /elog http://elog.oursite.com/elog/
> ProxyPass /elog/ http://elog.oursite.com:8080/
> 
> When visiting the url, this results in:
> The proxy server received an invalid response from an upstream server.
> The proxy server could not handle the request GET /elog/myelog/.
> 
> After testing we found that ELOG V2.6.0-beta2 works just fine.
> 2.6.0 stable crashes after visiting a redirected url.
> 
> Running on debian sarge

Have you tried 2.6.1. I released it just recently, so I don't know when it will be available for Debian. Have you
checked that your "URL = xxx" statement in the config file is correct? I see above "myelog", while the proxy
passes requests to "elog".
ELOG V3.1.5-2eba886