Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 542 of 808  Not logged in ELOG logo
    icon2.gif   Re: Restrict Top Groups to logged-in users?, posted by Chris Green on Tue Jul 26 21:54:39 2005 

Stefan Ritt wrote:

If you move the "password file = <file>" entry around, you can get fooled by stored cookies. So after each modification, make sure to delete all cookies in your browser.


This didn't work, but after corresponding with Stefan privately, the following did:

[global]
Show Top Groups = 1

[global top_group]
Protect selection page = 1
Password file = papers.pwd

Thanks again, Stefan.
Chris
icon5.gif   Email subject garbaged when set?, posted by Chris Green on Wed Jul 27 17:30:38 2005 
Hi,

So I'm using the CVS version now since I was hoping this would be fixed. If I set the email subject explicitly, viz:

Use Email Subject = [BooNE-ELOG] New submission to $logbook from $Author

The email I get has:

Subject:
=?ISO-8859-1?B?W0Jvb05FLUVMT0ddIE5ldyBzdWJtaXNzaW9uIHRvIENoYXJnZWQgQ3Vyc
mVudCBQaSBQbHVzIGZyb20gQ2hyaXMgR3JlZW4=?=

... which isn't particularly illuminating.

Advice appreciated.

Thanks,
Chris.
icon5.gif   Notify email recipient of attachments without including?, posted by Chris Green on Wed Jul 27 17:38:25 2005 
Hi,

Our elog is going to be taking some large attachments. I've disabled the attachments from going out in the email, but I'd like email recipients to know that the post has attachments associated with it. Is there a mechanism to do this already, or would it be an enhancement? I'm looking for something like:

Email Notify Attachments = 0 | 1 | 2

Where 0 = no notification,
1 = number only,
2 = list

... independent of whether attachments are included with the email itself.

Thanks,
Chris.
    icon2.gif   Re: Email subject garbaged when set?, posted by Chris Green on Fri Aug 5 01:13:13 2005 

Stefan Ritt wrote:

Chris Green wrote:
The email I get has:

Subject:
=?ISO-8859-1?B?W0Jvb05FLUVMT0ddIE5ldyBzdWJtaXNzaW9uIHRvIENoYXJnZWQgQ3Vyc
mVudCBQaSBQbHVzIGZyb20gQ2hyaXMgR3JlZW4=?=

... which isn't particularly illuminating.


This is the BASE64 encoding of the subject. It was discussed here and I implemented it according to RFC2047. All subjects I receive look fine in Outlook and Thunderbird, but not under Pine, which apparently does not implement the RFC correctly. One could of course put a switch into elog to encode it or not. But as soon as you want to send some non-ASCII characters (like the Norwegian as described in the thread mentioned above) you have a problem. Maybe you can configure your email client correctly to interprete the encoded subject?


Apparently the pine people think they're implementing it correctly. Indeed the default subject, "[ISO-8859-1] New ELOG entry" appears just fine. The one for membership confirmation, and anything set in Use Email Subject, however, is borked as above. Maybe the pine bug is something that can be worked around with something simple (like spaces after the ISO spec, or something? Some things work just fine, as I said.

Thanks,
Chris.
    icon2.gif   Re: Notify email recipient of attachments without including?, posted by Chris Green on Fri Aug 5 01:15:23 2005 

Stefan Ritt wrote:

Chris Green wrote:
Hi,

Our elog is going to be taking some large attachments. I've disabled the attachments from going out in the email, but I'd like email recipients to know that the post has attachments associated with it. Is there a mechanism to do this already, or would it be an enhancement? I'm looking for something like:

Email Notify Attachments = 0 | 1 | 2

Where 0 = no notification,
1 = number only,
2 = list

... independent of whether attachments are included with the email itself.

Thanks,
Chris.


I added Email Format = 64 for only attachment names. So you could set Email Format = 111 to get everything except the full attachments.


Thanks for this. Will verify as soon as someone posts to the (now live) logbook.

Chris.
icon8.gif   Top Groups, Show Top Groups, password file and Protect Selection page have nasty interaction, posted by Chris Green on Fri Aug 5 02:27:15 2005 
Hi,

Just as our ELOG went into production, I tripped over a couple of related (I think) bugs.

First, the easy one: line 21368 of src/elogd.c has a compile warning which looks non-benign. I fixed it in my local copy with:

Index: elogd.c
===================================================================
RCS file: /usr/local/cvsroot/elog/src/elogd.c,v
retrieving revision 1.739
diff -r1.739 elogd.c
21368,21369c21368
< sprintf(str, "?fail=1", user);
< redirect(lbs, str);
---
> redirect(lbs, "?fail=1");

Regardless (ie if I use the original CVS code or the patched version), a hard-to trace problem occurs with my configuration whereby users are denied access after password entry at the logbook selection page (even when details are verifiably correct), and users are dropped through to the next (non-protected) Top Group page. This problem goes away if "Protect Selection Page" is turned off.

A kind of "shadow" of this problem occurs if you create a new logbook from the Change Config File page, whereby after creating the new logbook one is dropped through to the next Top Group's selection page after saving the configuration (and the url has ?fail=1 added to it, althoguh line 21368 above is hardly the only place where this could have occurred).

I think all these things are linked. I'd be grateful if you could review this section of this code for possible causes of these problems. While we can operate for now with non-logged-in users able to see our list of logbooks, that is not something we want for the long term.

Thanks for your help,
Chris.
    icon7.gif   Re: Top Groups, Show Top Groups, password file and Protect Selection page have nasty interaction, posted by Chris Green on Fri Aug 5 16:15:04 2005 

Stefan Ritt wrote:
One note I would like to make however: "Top groups" were invented for having completely separate logbook groups. Before the invention of top groups, one had to run several instances of elogd for different departments for example, where one department should not see the other department's logbooks. But having many departments means having to maintain many elogd daemons. This led to the invention of top groups, so one daemon can serve several independent groups, each having their own [global] section, with probably their own administrator.

In your case however, it would be more applicable not to use top groups, but use nested groups. Like
Group MiniBooNE = Analysis, Miscellaneous
Group Analysis = Charged Current Pi Plus, Neutral Current Coherent Pions
Group Miscellaneous = demo

I presume this is more what you want, and you can avoid some problems which arise from top groups.


The quick attempt I just made to use this doesn't do what I want, which is to require password protection for the Analysis logbook selection page. If you think that *is* possible and I just didn't configure it properly, I'd appreciate pointers. In the meantime though, your bug fixes appear to have solved my top group / password problem and I think I'll proceed with that for now.

Thanks again,
Chris.
icon5.gif   How does RSS interact with password protection?, posted by Chris Green on Fri Aug 5 16:17:00 2005 
Can I have an RSS feed to a protected log book? Does it also require authentication, or does it bypass it? If it bypasses it, how do I disable RSS?

Thanks,
Chris.
ELOG V3.1.5-3fb85fa6