ELOG Forum

Demo Discussion

Forum Config Examples Contributions Vulnerabilities

Discussion forum about ELOG, Page 332 of 807

Not logged in

Find | Login | Help

New entries since:

Thu Jan 1 01:00:00 1970

Full | Summary | Threaded | Show attachments

6451 Entries

Goto page Previous 1, 2, 3 ... 331, 332, 333 ... 805, 806, 807 Next

Author Email down

Fri Feb 19 09:59:04 2021

Re: Path disclosure on unfound file

I made a new RPM: https://elog.psi.ch/elog/download/RPMS/elog-3.1.4-3.el7.x86_64.rpm

Gabriel Lopez wrote:

Hello, This is coming up as a high vulnerability in our scans. Are there plans to update the rpm for this fix? If so is there an ETA? Any update would be much appreciated. Currently running elog-3.1.4-2

Stefan Ritt wrote:

Ok, I fixed the code in the current commit (395e101add19f0fe8a11a25d0822e511f34d94d1). The path gets stripped, and we see a

prinnydood wrote:

I can confirm this issue exists on version 3.1.3, which I have installed elog on Debian 10.

The issue also exists on version 3.14 (1.20190113git283534d97d5a.el7), which I tested on an AmazonLinux EC2 instance.

This is what I found:

1. if I leave out the extension at the end of the URL for a non-existent page, it gives me the red error box. So far so good... Example: /gibberish

2. if I include any random extension at the end of the URL for a non-existent page, it gives me the red error box. So far so good... Example: /gibberish.php or /gibberish.htm or /gibberish.asdfasd

3. if I include any .html extension specifically at the end of the URL for a non-existent page, elog exposes the path /usr/share/elog/themes/default/gibberish.html. This is a bug... Example: /gibberish.html exposes the path, and likewise, /.gibberish.html ( "dot" + gibberish) exposes the path

4. if I include a valid, existent .html file which is located in the directory /usr/share/elog/themes/default/, and call it, elog exposes the html document. Example: I created an html file called gibberish.html (containing <html><body><p>Hello world</p></body></html>) in my system's /usr/share/elog/themes/default/ directory. After navigating back to the /gibberish.html URL, I was presented with the HTML file.

Turning on -v (verbose mode), the response by elogd when accessing these are: "GET /elog/gibberish.html HTTP/1.0 Returned 605 bytes" (displays "Hello world" html file), and "GET /elog/gibberish.asdfasd HTTP/1.0 Returned 605 bytes" (displays red error box).

=====

My guess: the program seems to be caring about the files ONLY if they have html file extension. Please see the screenshots below.

====

What are the security implications? Not much, I think. From what I can tell, exposing the "/usr/share/themes/elog" path, and also exposing the elog version when the file does not exist. Hope this reply helps anyone else with the same question.

(I am sure the error exposing the version can be removed by editing the source code--this is probably beyond my capabilities at this point).

69319

Mon Mar 22 15:10:12 2021

Re: Request: make $text available for "subst"

$text is the full body text and can go over many lines. Since attributes are restricted to single lines, it's not possible to substitute them with the body text.

Stefan

Andreas Luedeke wrote:

Hi Stefan,

I've just tried to read the $text with subst into another field and failed.
It looks like $text is only available for the execution of shell scripts in the "execute new|edit|delete = <script>" command.

Could that be added? I can think of a multitude of applications:

In my case I want to fill an attribute X either with free text or generated from other fields. The list view will show just X and not how it was generated.
I could fill an attribute automatically with the character length of the text.
I could parse the text in a shell script and set other attributes according to the content.

Thank you for considering it.

Cheers, Andreas

69323

Wed Mar 24 10:01:34 2021

Re: automatically obtain entry ID from search

You would have to do that on the scrip level. Use "curl" to search a logbook. Like following URL would search for all entries in this forum where you are the authoer, then return the entries in CSV format:

https://elog.psi.ch/elogs/Forum/?mode=CSV1&Author=k%F6rner

Then you can parese this CSV file and extract the entry ID, which you can pass to the elog client to submit a new entry to the other logbook.

Stefan

Chris Körner wrote:

Hi,

in our application I want to have, let's say in the simplest case, two logbooks. One as a database of samples we fabricated and one as a logbook for measurements. When a measurement on a sample is done and an entry is submitted to the 2nd logbook, I want to automatically edit or reply to the corresponding entry in the 1st logbook. For example I want to append a line in the free text field to have a full log of what happened to a sample there. We reference our samples with a unique auto-generated ID in both logbooks. Is is somehow possible to search the 1st logbook for that ID or any other attribute and obtain the elog entry ID since the elog client will need that ID for editing an entry?

69324

Wed Mar 24 10:06:26 2021

Re: Request: make $text available for "subst"

Sure, attributes can be shown multi-line, but they cannot be stored in the elog internal database. The database is a very old design and only allows for single line attributes. Just look at a YYMMDDa.log file and you will see that. I would have to change the database format to somethign more advanced like XML, but that would take me a couple of weeks or months.

Soooorrryy! ;-)

Andreas Luedeke wrote:

While the input widget of text attributes is a single line, they can easily be multi-line in the display - when you use HTML at least.
And of course the user can parse the text field and generate a single line, if he wants to.
If you leave it to me, I'll create wonderful applications to that feature :-)

Please? ;-)

Stefan Ritt wrote:

$text is the full body text and can go over many lines. Since attributes are restricted to single lines, it's not possible to substitute them with the body text.

Stefan

Andreas Luedeke wrote:

Hi Stefan,

Could that be added? I can think of a multitude of applications:

In my case I want to fill an attribute X either with free text or generated from other fields. The list view will show just X and not how it was generated.
I could fill an attribute automatically with the character length of the text.
I could parse the text in a shell script and set other attributes according to the content.

Thank you for considering it.

Cheers, Andreas

69327

Wed Mar 24 16:25:36 2021

Re: Pre-fill Attribute with last entry

Nope, there is no way to acces the last value of an attribute. Sorry.

Stefan

Dominic Schneider wrote:

Hi all together,

I struggle a lot with the following problem:
I try to prefill certain attributes with the value of exactly the same attribute in the last entry made in the same logbook.

I know I have to go with Preset, tried a view hours and searched the forum but i didn't find a thing. Am I overlooking a flag, an option or whatever, or is there just not such a functionality (which I dont believe)?

I thought about:
Preset Test_Attribute = $Test_attribute
Preset Test_Attribute = Re:$Test_attribute
Preset Test_Attribute = $shell(Command to somehow get last entry and this attributes value)
Not succesful though.

I would be very thankful for help, thanks in advance.

69331

Wed Mar 24 19:45:41 2021

Re: Pre-fill Attribute with last entry

That would actually be my recommendation. There is a "execute new" which you can call when submitting a new entry.

Stefan

Dominic Schneider wrote:

Hi Stefan, hi Sebastian,

thank you for your help. Ok I see its not that simple.

Is there maybe a way of executing a Script on submitting, writing the values of the Attributes into an temporary file and loading the values from this file via a preset shell script when opening a NEW entry?

Best wishes & thanks in advance

Sebastian Schenk wrote:

Sorry Stefan, but it is possible as you have the scripting ability.

The idea is to use "Preset Test_Attribute = $shell(script_to_get_the_last_entry)", where the script asks elog about the details and parses them.
The problem here is, that the elogd already is working to resolve the click on "new entry" request (or similar) and the script can't call elogd until the page is delievered, what is to late.
(If it would, the elogd will hang.)

So the script either has to directly parse all the entry.log files in the logbook folder or you need a second elogd running, which can answer the request from the script.
This second elogd could run on a different port and it doen't need to be public as it only answers internal requests and could use the same config as the "primary" elogd.
My idea for the script uses the python elog module to establish the connection and do the parsing.

I hope this helps as a workaround.
Best wishes,
Sebastian

Stefan Ritt wrote:

Nope, there is no way to acces the last value of an attribute. Sorry.

Stefan

Dominic Schneider wrote:

Hi all together,

I struggle a lot with the following problem:
I try to prefill certain attributes with the value of exactly the same attribute in the last entry made in the same logbook.