Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 617 of 807  Not logged in ELOG logo
New entries since:Thu Jan 1 01:00:00 1970
ID Date Icon Authordown Author Email Category OS ELOG Version Subject
  1260   Tue Jul 12 10:15:30 2005 Warning Emiliano GabrielliAlberT@SuperAlberT.itBug fixLinux2.5.9Re: elog utility for submission used wrong 'Host:' in POST header
> The 'elog' utility for commandline submission used wrong 'Host:' in POST header.
> The host listed after 'Host:' should be the host where the server runs, not the
> localhost (see patch below).
>
> $ diff -u elog.c_20050711 elog.c
> --- elog.c_20050711 Mon Jul 11 18:54:20 2005
> +++ elog.c Mon Jul 11 18:55:31 2005
> @@ -421,7 +421,7 @@
> sprintf(request + strlen(request), "%s/%d?cmd=download", experiment, message_id);
> strcat(request, " HTTP/1.0\r\n");
>
> - sprintf(request + strlen(request), "Host: %s\r\n", host_name);
> + sprintf(request + strlen(request), "Host: %s\r\n", host);
> sprintf(request + strlen(request), "User-Agent: ELOG\r\n");
>
> first = 1;
> @@ -872,7 +872,7 @@
> strcat(request, " HTTP/1.0\r\n");
>
> sprintf(request + strlen(request), "Content-Type: multipart/form-data; boundary=%s\r\n", boundary);
> - sprintf(request + strlen(request), "Host: %s\r\n", host_name);
> + sprintf(request + strlen(request), "Host: %s\r\n", host);
> sprintf(request + strlen(request), "User-Agent: ELOG\r\n");
> sprintf(request + strlen(request), "Content-Length: %d\r\n", content_length);

This is not completally true IMHO .. better, it is, but it is not the only problem.

Elog seems to speak HTML/1.0, where "host:" is not implemented ... Since ELOG does not support Vhosts I think the right beaviour is to remove the "Host:" header at all ...

On the other hand it should replay with an error when a bogus client tries to speak HTML/1.0 specifing "host:",
and (the wrost case) when the bogus client says to speak HTML/1.1 and doesnt provide the required "Host:" header ...
Yes .. elog will ignore it, but it is an RFC requirement for HTML/1.1 !
  1263   Wed Jul 13 10:12:38 2005 Reply Emiliano GabrielliAlberT@SuperAlberT.itRequestAll Re: userlist multiple select

Stefan Ritt wrote:

Emiliano Gabrielli wrote:
a multiple selection box it's a standard web tool .. if one is not able to use its browser is not an elog problem IMHO


Really? Can you point me to a common web site using this? I would really like to see how other people use this.


I can't remember just now a web site using it .. what I mean is that "multiple" attribute for the "select" tag is a standard for the web (it's not an IE extension or so on ..) so every web browser implements it.

It's normally used, for example, when you fill a form describing your attitudes, here you can often choose from a select box a number of interest you are concerded.. but it is only an example

Stefan Ritt wrote:


Emiliano Gabrielli wrote:
My request is becouse having a number of user (say 20) makes the checkbox solution very very nasty .. again, it's a choice you give to the smart user .. others simply will not notice any change in elog Wink


Ok, I put it on my wishlist. If more than one person asks for this, I will implement it. Unfortunately it's not only putting a multiple into the HTML page, it's also a different way how multiple selections are passed in the POST form and their decoding, so it will be an hour or two of work for me.

Yes I know, uhm... if you point me to the right piece of code to be adjusted I can see if I'll be able to do the job Smile
  1264   Wed Jul 13 15:09:48 2005 Entry Emiliano GabrielliAlberT@SuperAlberT.itBug reportAll [code] should be a sort of <CDATA >
Using the [code] elocode should be intended also to preserve the tagged text from beeing parsed as html or elcode itself ..

this is an example:

Quote:
Note that, for security reasons, you should check the MD5 FINGERPRINT of the SSL certificate issued by the server agaist the following one:

MD5 Fingerprint = 23:A7:AD:33:3C:08:BE:2A:62:6E:85:DF:B8:00:23:40


Thank you
  1265   Thu Jul 14 12:47:06 2005 Entry Emiliano GabrielliAlberT@SuperAlberT.itBug reportAll short/long_name should point the same user
.. I mean that if I use:
Restrict edit                 = 1
; preset author and email
Preset Author                 = $short_name
Preset Author Email           = $user_email
Preset on reply Author        = $short_name
Preset on reply Author Email  = $user_email
Subst on reply subject        = Re: $subject

; these attributes cannot be changed
Locked Attributes             = Author, Author Email

and then I change Preset Author to be "$long_name" Elog does not permit the autor to edit an old post of its own ...
It is not able to argue that short and long name are the same person..

Yes I know, you'll ask me why I should change it .. the anwer is.. I don't have to, but (as I could do it logically) I'd like to be able to do..

In my case I changed it by error, people inserted entries and now I restored the correct one .. so now I have to unlock the attribute and change every Author by hand as admin
Smile
  1266   Thu Jul 14 13:05:33 2005 Entry Emiliano GabrielliAlberT@SuperAlberT.itBug reportAll Re: short/long_name should point the same user

Emiliano Gabrielli wrote:
.. I mean that if I use:
Restrict edit                 = 1
; preset author and email
Preset Author                 = $short_name
Preset Author Email           = $user_email
Preset on reply Author        = $short_name
Preset on reply Author Email  = $user_email
Subst on reply subject        = Re: $subject

; these attributes cannot be changed
Locked Attributes             = Author, Author Email

and then I change Preset Author to be "$long_name" Elog does not permit the autor to edit an old post of its own ...
It is not able to argue that short and long name are the same person..

Yes I know, you'll ask me why I should change it .. the anwer is.. I don't have to, but (as I could do it logically) I'd like to be able to do..

In my case I changed it by error, people inserted entries and now I restored the correct one .. so now I have to unlock the attribute and change every Author by hand as admin
Smile



a problem related to this issue is that an attribute of userlist type automatically sets the user to be in the long form..

My proposal is to alwais store users in the long form and anly give the possibility to use the short or long form in displaing time..
  1267   Thu Jul 14 15:58:07 2005 Entry Emiliano GabrielliAlberT@SuperAlberT.itCommentAll A new ELOG user wants to register on "127.0.0.1"
A new ELOG user wants to register on "127.0.0.1"


the scenario is:
- elog on localhost
- stunnel on the external interface

I dont want elog to listen on external interface, so.. why do not use the URL cfg attribute for this issue ?
  1270   Thu Jul 14 19:11:54 2005 Reply Emiliano GabrielliAlberT@SuperAlberT.itBug reportAll Re: short/long_name should point the same user

Stefan Ritt wrote:

Emiliano Gabrielli wrote:
In my case I changed it by error, people inserted entries and now I restored the correct one .. so now I have to unlock the attribute and change every Author by hand as admin
Smile


Well, that teaches you not to do this error again Wink


uhm.. I think the confusion intrinsict in elog between long and short name is something to be solved ..
an attribute of type "userlist" fills always with the long_name .. but if I would to insert it as short ?

the users shown in the users admin dropdown menu is short .. why? .. may be I didnt understood the way this issue works .. Crying
  1271   Thu Jul 14 19:16:06 2005 Reply Emiliano GabrielliAlberT@SuperAlberT.itCommentAll Re: A new ELOG user wants to register on "127.0.0.1"

Stefan Ritt wrote:

Emiliano Gabrielli wrote:
A new ELOG user wants to register on "127.0.0.1"


the scenario is:
- elog on localhost
- stunnel on the external interface

I dont want elog to listen on external interface, so.. why do not use the URL cfg attribute for this issue ?


You can specify the interface to liste on with the
"-n <interface>"
parameter of elogd.


I know Smile

the following is the configuration I'm telling about... and it raises the problem reported
albert@YYYYYYYYY:~$ ps axu | grep elog
elog     22348  1.0  1.9 23660 20408 ?       Ss   11:32   4:54 /usr/sbin/elogd -f /var/run/elogd.pid -c /etc/elog.conf -d /var/lib/elog -s /usr/share/elog -p 8081 -n 127.0.0.1 -x -D
root     22353  0.0  0.2 45436 2276 ?        Ss   11:32   0:17 /usr/sbin/stunnel -o /var/log/elog/elog_daemon.log -p /etc/ssl/certs/stunnel_XXXXXXX.pem -d XXXXXX.roma2.infn.it:8080 -r 127.0.0.1:8081
ELOG V3.1.5-3fb85fa6