> I am very much interested in using elog as a shift logbook for SOLEIL
> accelerators.

Hey, elog made it to SOLEIL! You know, we run it here at the SLS...

> I tested most of the options. Every thing works well except the conditional
> attributs when French language is selected. In this case, I lost the
> selected list option in the Field Equipement.

There was indeed a bug which only happend when switching to French! Some
javascript code contained

confirm('Erreur: l'attribute .... ')

So the "'" in l'attribute finished the string and Javascript stopped working. I
changed the quotes to

confirm("Erreur: l'attribute .... ")

so it works now. The new version is under CVS.

- Stefan

I am trying to use the command line utility elog. Some of the attributes 
that I have setup are multiple options. When I run the command line 
utility to create a new message, any attribute that is setup with multiple 
options will not be filled in. The syntax I am using is as  follows:

elog -h localhost -p 8080 -l Lab -a "Site=xxxx" -a "Area=System" -
a "Priority=Low" -a "Shift=1" -a "Status=Open" -m text.txt

Site and Area are defined in the config file as MOptions. Is there a way 
to use this feature with multiple options on attributes with the 
attributes = to one or more variables?

> I am trying to use the command line utility elog. Some of the attributes 
> that I have setup are multiple options. When I run the command line 
> utility to create a new message, any attribute that is setup with multiple 
> options will not be filled in. The syntax I am using is as  follows:
> 
> elog -h localhost -p 8080 -l Lab -a "Site=xxxx" -a "Area=System" -
> a "Priority=Low" -a "Shift=1" -a "Status=Open" -m text.txt
> 
> Site and Area are defined in the config file as MOptions. Is there a way 
> to use this feature with multiple options on attributes with the 
> attributes = to one or more variables?

For MOptions, you have to append an "_n" to each attribute to distinguish
different options for the same attribute, like

elog -h localhost -p 8080 -l Lab -a "Site_0=Home" -a "Site_1=Work" ...

Even if you only use one attribute, the trailing "..._0" is necessary. I will
add a note to the documentation.

Dear ELOG users,

It has been brought to my attention that ELOG has a vulnerability through
which one can obtain a remote shell (meaning to log in to your machine
through elog). There is even an exploit available which demonstrates that
both for linux and windows.

This is a severe security problem for all logooks which can be seen from
outside, even if they have password protection on. I strongly recommened to
upgrade to elog version 2.5.7 as soon as possible if you run a public elog
server.

Here is some explanation for the technically interested:

The problem arises from a strcpy() in the decode_post() routine, which
triggers a buffer overflow when attachment file names longer than 256
characters are submitted. I replaced (hopefully) all strcpy() with strlcpy()
to fix this problem, but if someone sees a location which I have missed,
please tell me.

The second vulnerability had to do with write passwords. If you put a "write
password = xxx" statement into your config file, it was still possible to
download the config file with a special hand-written URL, and decode the
write password, which is usually only base-64 encoded unless you haven't
compiled elog with the -DHAVE_CRYPT flag. I have changed that so if a write
password is present, the download is only possible when this password is
submitted in each request. If this has some effects on synchronizing of
logbooks, please let me know.

Stefan Ritt

munmap(0xb7db4000, 4096)                = 0
select(1024, [5], NULL, NULL, {6, 0})   = 1 (in [5], left {5, 996000})
recv(5, "GET /calendar_filter/imgs/window"..., 100000, 0) = 485
open("/usr/share/elog/scripts/calendar_filter/imgs/window_close.gif", O_RDONLY) = 6
close(6)                                = 0
open("/usr/share/elog/scripts/calendar_filter/imgs/window_close.gif", O_RDONLY) = 6
lseek(6, 0, SEEK_END)                   = 648
lseek(6, 0, SEEK_CUR)                   = 648
lseek(6, 0, SEEK_SET)                   = 0
time([1123066183])                      = 1123066183
read(6, "GIF89a\20\0\20\0\306`\0\16\26 \r\27!\16\30!\24 .\25 .I"..., 648) = 648
close(6)                                = 0
send(5, "HTTP/1.1 200 Document follows\r\nS"..., 879, 0) = 879
close(5)                                = 0
select(1024, [3], NULL, NULL, {1, 0})   = 0 (Timeout)
select(1024, [3], NULL, NULL, {1, 0})   = 0 (Timeout)
select(1024, [3], NULL, NULL, {1, 0})   = 0 (Timeout)
select(1024, [3], NULL, NULL, {1, 0})   = 0 (Timeout)
select(1024, [3], NULL, NULL, {1, 0})   = 0 (Timeout)
select(1024, [3], NULL, NULL, {1, 0})   = 0 (Timeout)
select(1024, [3], NULL, NULL, {1, 0})   = 0 (Timeout)
select(1024, [3], NULL, NULL, {1, 0})   = 0 (Timeout)
select(1024, [3], NULL, NULL, {1, 0})   = 0 (Timeout)
select(1024, [3], NULL, NULL, {1, 0})   = 1 (in [3], left {0, 81000})
accept(3, {sa_family=AF_INET, sin_port=htons(57723), sin_addr=inet_addr("127.0.0.1")}, [16]) = 5
time(NULL)                              = 1123066193
socket(PF_FILE, SOCK_STREAM, 0)         = 6
connect(6, {sa_family=AF_FILE, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory)
close(6)