Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 3 of 796  Not logged in ELOG logo
ID Date Icondown Author Author Email Category OS ELOG Version Subject
  185   Mon Jan 6 19:53:28 2003 Warning Etienne Van Caillieetienne.vancaillie@mba.beBug report  security in find option as a guest
if you are guest in the find option  

select 'all logbook'

it will display all 'attributes' from other logbook 
with no option  'guest command ...'
but having the same 'attribute' name

Solution :
**********
I use the copy to command to make a copy to other logbook
with option 'guest command' enabled

in this section I remove some field so the guest user can't no see all field

I suggest to give acces to 'guest' on a second run of elog to another
port or other computer ?
  231   Wed Feb 19 14:48:56 2003 Warning Heiko Scheith.scheit@mpi-hd.mpg.deComment  Re: Participation on development of ELOG
> > We are interested in using your ELOG (which we consider to be a wonderful 
> > application) even more. We would like to make a few adaptations in your 
> > source code, above all to add some functionality that we are missing.
> > 
> > I was wondering if there is a way we could coordinate the development 
> > together. For instance, would it be of your interest to receive the code 
> > adaptations we do and implement it in your future releases? 
> 
> Sure, I'm very interested in those and ready to merge it into the main 
> development tree.
> 
> - Stefan

I think it is very good to include this in elog, but, 
since this is also a big security risk (especially if people are
running elogd as root) I would suggest a compile time option to 
enable this, like: gcc... -DALLOW_SCRIPT ...  
The default should be that it is disabled.
Maybe one should only allow it if the user running elogd is NOT root.

Heiko
  259   Wed Apr 2 05:39:45 2003 Warning Greg Siemsgregory.siems@state.mn.usBug report  Disappearing attachments
Let me start by saying that I really like ELOG-- it's a nice tool.

I'm trying out version 2.3.3. The problem that I'm having is with
attachments disappearing when I do the following:

1. create a new entry that contains one or more attachments.
2. verify that the new entry from step 1 saved correctly.
3. reply to the entry from step 1.
4. return to the entry from step 1 only to find the attachments gone.

The attachement files are still in the logbook directory, it's just that
they are no longer attached to the entry.

FWIW, I've attached the elog.config that I'm using...

Thanks,

Greg
  273   Mon Apr 7 23:00:48 2003 Warning Stefan Rittstefan.ritt@psi.chComment  Passwords might have changed for logbook "Forum"
A problem (elog:272) with certain passwords has been fixed in version 
2.3.5 of ELOG. This forum runs the updated version, which can cause login 
problems. All users with a password length of 3,6,9,12,... characters 
cannot login with their old password anymore. They have to click 
on "Forgot password?" in the login screen to have the system create a new 
password for them and send it to their registered email address. In case 
no email address has been registered, one can send me directly an email 
(stefan.ritt@psi.ch). After one receives the new password via 
email, one can log in again and change the password to the old one, which 
then gets registered correctly. I apologize for any inconvenience.

- Stefan
  291   Tue Apr 22 11:18:00 2003 Warning Thomas Saleinnone   Several Problems with 2.3.5
We use ELOG 2.3.5 for Windows with a German language file and have found 


some new problems:




. Certain strings are not translated.


Language error: string "Plese log on by clicking on following link and 


change your password" not found for language "de"


Language error: string "A new password for user <i>"%s"</i> has been sent 


to %s" not found for language "de"




While the first string is obviously written wrong, the second one misses a 


quotation mark.






. If a user uses the new "password forgotten" function, he receives an 


email, but after having clicked the URL in the mail, he gets the following 


error message as simple text, i.e. not formatted by use of the CSS file:




Invalid URL: Notizen/?redir=%3Fcmd%3DChange%20password%26old_pwd%


3DE3ARcjI/&uname=sal&upassword=E3ARcjI/ 


Bitte benutzen Sie die Zurück-Taste Ihres Browsers ...  




Nevertheless the new password was written into the specified password file. 


(This behaviour as far as we know was also with earlier versions of ELOG.)






. If one could not log in through the button "Login", one does not receive 


an error message, but will be pushed simply back to the main page, 


status "Not logged in". (This was as far as we know was also with earlier 


versions of ELOG.)








. If you want to change as an admin the passwords of several users, it 


would be convenient, to get always back to the page, where you may choose 


the next user ... but you will be pushed back to the main page with the 


messages. (This was as far as we know was also with earlier versions of 


ELOG.)








. But the simple change of passwords for users does not always succeed: I 


have changed the password for a user A to "anuvis", the next user B should 


have gotten the same new password, but this time it was not accepted. 


Message "Wrong password". Might it be, that this goes only once because of 


an initialisation problem ? I had to edit the password file manually.








. Opera browser 7.03 simply crashes, when choosing the direct URL to our 


logbook, i.e. http://localhost:8080/logbook2. We have set a general 


password file and a different read password for each of our logbooks.


If we choose http://localhost:8080/logbook1 everything is fine. We get a 


window "Authentication required" and type in simply the read password, no 


user name.


If we choose http://localhost:8080/logbook2 the behaviour is different. We 


see the window "Authentication required" appear, then Opera crashes.


Change of the read passwords did not change this erroneous behaviour. This 


problem was not with version ELOG 2.3.4.




In Internet Explorer 6 all is okay.






. NOWRAP tag in Date column


The date column takes quite a lot of space in the logs overview. As the 
information is only of secondary importance I would prefer date and time 
being wrapped like e.g. the contributors name. Of course, I could help 
myself with a 
in my language file, but this would force a break also on the single message view.
  292   Tue Apr 22 11:29:44 2003 Warning Thomas Saleinsalein@ckc.deBug report  Opera and IE behave different
I repeat ...
. Opera browser 7.03 simply crashes, when choosing the direct URL to our 
logbook, i.e. http://localhost:8080/logbook2. We have set a general 
password file and a different read password for each of our logbooks.
If we choose http://localhost:8080/logbook1 everything is fine. We get a 
window "Authentication required" and type in simply the read password, no 
user name.
If we choose http://localhost:8080/logbook2 the behaviour is different. We 
see the window "Authentication required" appear, then Opera crashes.
Change of the read passwords did not change this erroneous behaviour. This 
problem was not with version ELOG 2.3.4.

In Internet Explorer 6 all is okay.


 ... and add

The behaviour is different in those browsers even with the start page at 
http://localhost:8080/
Internet Explorer 6 demands a login. But as we have no password we cannot 
login.
Opera 7.03 demands no login and simply offers the list of logbooks to 
choose one.
  306   Thu May 1 10:27:17 2003 Warning Stefan Rittstefan.ritt@psi.ch   Cookie problem using Apache 1.3.23 as Proxy
Today I found out that Apache 1.3.23 (and probably 1.3.24) has a problem 
with ELOG if used as a proxy server. Due to a bug in Apache, only one 
cookie is transmitted through the proxy at a time. This makes it impossible 
to log in into ELOG with user name and password (requires two cookies). 
Apache 1.3.23 comes with RedHat 7.3 for example.

To solve the problem, update Apache to 1.3.27.

See also http://bugs.apache.org/index.cgi/full/9655
  322   Wed May 7 16:04:45 2003 Warning Heiko Scheith.scheit@mpi-hd.mpg.deBug report  missing '.' in emails
missing '.' in emails
-----------------------

A dot '.' at the beginning of a line is not transmitted via email.
It is stored in the entry properly though.

Test:
./There is a dot just before '/There...'

Greetings, Heiko

Well it seems here it is working fine...

.
ELOG V3.1.5-fe60aaf