Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 624 of 808  Not logged in ELOG logo
ID Date Icon Author Author Email Category OS ELOG Versiondown Subject
  1464   Fri Oct 14 19:20:40 2005 Reply Carl Shireycarl.shirey@pw.utc.com Linux2.6Re: New Accounts

Stefan Ritt wrote:

Carl Shirey wrote:
I hope you can help me Stefan.
The problem that I am having is when someone request a account on elog I received e-mail message to activate there account. I click on the link from my e-mail to activate the account it takes me to the logon page. I log on and then I get a massage that the web does not exist.
What I found out was the elog Damon stops, and I have to restart it and everything work fine.
Here is a copy of me Elog config.

Also can you tell me how you set up the Subtext and the Show new entry buttons on the main page of the elog.

Thank for your help


I tried with the current version and could not reproduce your problem. Can you try to increase the login expiration like Login expiration = 240 for ten days. If you then click to activate an account and you have been logged in less than ten days ago, you will not be asked to logon. Does the problem then still occur?


No the problem does not occur when I am still log on.
  1514   Fri Nov 18 08:40:13 2005 Question Dinesh Bapatdinesh.bapat@gmail.com Windows2.6Send a email to E-log?
Is it possible to send an email to Elog and record an entry automatically?We have situations where endusers have very narrow bandwidth email access. But no broadband to update E-log. Is there some mechanism so that they can send a email and it update Elog automatically?Thanks in advance.
  1518   Fri Nov 18 21:09:01 2005 Reply Stefan Rittstefan.ritt@psi.ch Windows2.6Re: Send a email to E-log?

Dinesh Bapat wrote:
Is it possible to send an email to Elog and record an entry automatically?
Have a look at elog:Contributions/10
  1562   Thu Dec 22 01:17:12 2005 Question PJ Meyerpjm@pjmeyer.orgQuestion 2.6New docs?
Just looked at change log for 2.6
was wondering where the documentation for the new additions/changes is/are.
  1564   Thu Dec 22 08:58:25 2005 Reply Stefan Rittstefan.ritt@psi.chQuestion 2.6Re: New docs?

PJ Meyer wrote:
Just looked at change log for 2.6
was wondering where the documentation for the new additions/changes is/are.


I usually keep http://midas.psi.ch/elog/config.html up-to-date, but I agree that it's a bit hard to find the additions there, that's why there is the change log Wink

The ELCode is described on a separate page, which can also be accessed by clicking on the ELCode link below the text box of the logbook entry page.
  1607   Wed Jan 18 17:20:45 2006 Warning Chris Warnerchristopher_warner@dcd.uscourts.govBug reportLinux2.6Buffer Overflow?
Users can access root level directories by using a modified URL. I saw on some security web sites that this was a problem in previous versions. Was it not fixed in 2.6?

To recreate enter http://yourhost.yourdomain.com/../../../../etc/passwd

view your password file in the browser.


If this was previously reported, is there a fix?

Chris Warner
  1608   Thu Jan 19 10:31:05 2006 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2.6Re: Buffer Overflow?

Chris Warner wrote:
Users can access root level directories by using a modified URL. I saw on some security web sites that this was a problem in previous versions. Was it not fixed in 2.6?

To recreate enter http://yourhost.yourdomain.com/../../../../etc/passwd

view your password file in the browser.

If this was previously reported, is there a fix?

Chris Warner


Thanks for telling me, I didn't know. I was able to reproduce your problem under certain conditions, and I just released version 2.6.1 to fix it. However it has nothing to do with an old buffer overflow (see elog:941).

I would strongly advise everybody to upgrade as soon as possible.
  1615   Fri Jan 20 02:53:40 2006 Smile Chris Warnerchristopher_warner@dcd.uscourts.govCommentLinux2.6Re: Buffer Overflow?

Stefan Ritt wrote:

Chris Warner wrote:
Users can access root level directories by using a modified URL. I saw on some security web sites that this was a problem in previous versions. Was it not fixed in 2.6?

To recreate enter http://yourhost.yourdomain.com/../../../../etc/passwd

view your password file in the browser.

If this was previously reported, is there a fix?

Chris Warner


Thanks for telling me, I didn't know. I was able to reproduce your problem under certain conditions, and I just released version 2.6.1 to fix it. However it has nothing to do with an old buffer overflow (see elog:941).

I would strongly advise everybody to upgrade as soon as possible.


Thanks for the quick response!
ELOG V3.1.5-3fb85fa6