Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 660 of 808  Not logged in ELOG logo
ID Date Icon Author Author Email Categorydown OS ELOG Version Subject
  65883   Thu May 15 18:36:55 2008 Question Devin Bougiedab66@cornell.eduBug report  reset password link when using proxy

For heightened security, we allow access to our ELOG installation from offsite through an apache proxy.  Therefore, the URL for our ELOG becomes http://www.lepp.cornell.edu/proxy/elog/ .  Everything seems to work properly with this setup except for the "reset password" utility.  When trying to reset ones password, the link sent in the "Password recovery" email becomes, for example:

http://www.lepp.cornell.edu/proxy/elog/ERL+W128/?redir=%3Fcmd%3DChange+password...

When using this link, the redirect redirects you to:

http://www.lepp.cornell.edu/ERL+W128/?cmd=Change%20password...

Which does not work.  Instead, the redirect should point to:

 

http://www.lepp.cornell.edu/proxy/elog/ERL+W128/?cmd=Change%20password...

Any suggestions or workarounds would be greatly appreciated.
 
Many thanks,
Devin

 

  65921   Wed Jul 9 19:57:50 2008 Warning Yoshio ImaiBug reportLinux2.7.3-2104Error messages while creating thumbnails
Hi again!

I have recently noticed that elog often creates large accumulations of the following group of error messages in our syslog:
Jul  9 19:05:00 elogd[27009]: Falling back to default group "elog"
Jul  9 19:05:00 elogd[27009]: Falling back to default user "elog"
Jul  9 19:05:02 elogd[27009]: Cannot restore original GID/UID.
Jul  9 19:05:02 elogd[27009]: Cannot remove pidfile "/var/run/elogd.pid" ; Permission denied
Jul  9 19:05:05 elogd[27013]: Falling back to default group "elog"
Jul  9 19:05:05 elogd[27013]: Falling back to default user "elog"
Jul  9 19:05:05 elogd[27013]: Cannot restore original GID/UID.
Jul  9 19:05:05 elogd[27013]: Cannot remove pidfile "/var/run/elogd.pid" ; Permission denied
Jul  9 19:05:05 elogd[27016]: Falling back to default group "elog"
Jul  9 19:05:05 elogd[27016]: Falling back to default user "elog"
Jul  9 19:05:06 elogd[27016]: Cannot restore original GID/UID.
Jul  9 19:05:06 elogd[27016]: Cannot remove pidfile "/var/run/elogd.pid" ; Permission denied

I have further found out that these coincide with the generation of attachment thumbnails (i.e. every time a user displays an entry generated before the advent of ImageMagick support for the first time, and every time the preview pictures are scaled/rotated while editing an entry).

The PID-file is indeed owned by the root user and not elog, but is correctly cleaned up at termination of the elog server.
Jul  9 19:47:08 elogd[27335]: elogd server aborted.

Jul  9 19:47:16 elogd[27359]: elogd 2.7.3 built Apr 18 2008, 14:08:31 
Jul  9 19:47:16 elogd[27359]: revision 2104
Jul  9 19:47:16 elogd[27359]: Falling back to default group "elog"
Jul  9 19:47:16 elogd[27359]: Falling back to default user "elog"
Jul  9 19:47:16 elogd[27360]: Falling back to default group "elog"
Jul  9 19:47:16 elogd[27360]: Falling back to default user "elog"
Jul  9 19:47:16 elogd[27360]: Cannot restore original GID/UID.
Jul  9 19:47:16 elogd[27360]: Cannot remove pidfile "/var/run/elogd.pid" ; Permission denied
Jul  9 19:47:16 elogd[27359]: ImageMagick detected

Does this point at some sort of problem?


Another question concerning the thumbnails of multi-page PDF-files: would it make sense to restrict the thumbnail generation to the first page? Since this is the title page, which in most cases is the only relevant page (really reading the file from the thumbnails is usually not possible anyway), this could help keep the attachment display less crowded ...


Thanks for the work and continuing support!

Yoshio
  65929   Tue Jul 22 23:23:17 2008 Question Kevin O'Sullivankosok@stanford.eduBug report 2.7.4Thumbnails not working

I get the following error where thumbnails should go: Cannot create thumbnail, please check ImageMagick installation.

I restarted elog and check the log, it does in fact detect ImageMagick and it does have the most recent version. I'm running ubuntu 2.6.24-19-server.  Is there something else I should be checking?

  65932   Wed Jul 23 15:14:58 2008 Reply Stefan Rittstefan.ritt@psi.chBug report 2.7.4Re: Thumbnails not working

Kevin O'Sullivan wrote:

I get the following error where thumbnails should go: Cannot create thumbnail, please check ImageMagick installation.

I restarted elog and check the log, it does in fact detect ImageMagick and it does have the most recent version. I'm running ubuntu 2.6.24-19-server.  Is there something else I should be checking?

 Try the following:

  • Put logfile = elog.log into your elogd.cfg
  • Upload an image to get the error
  • Examine your elog.log file

You should get something like:

23-Jul-2008 15:10:38 [] Server listening on port 8080 ..
23-Jul-2008 15:10:52 [stefan@127.0.0.1] {demo} SHELL "convert "logbooks\demo\080723_151052_Capture.png" "logbooks\demo\080723_151052_Capture.png.png""

In your logfile. Now try the "convert" command manually under the same account elogd is running. Possible reasons for problems are:

  • The "convert" command is not in your path or links to another program. Unfortunately ImageMagick chose a pretty standard name for this program
  • The account under which elogd is running does not have write access to the logbook directory
  • converts wants to call ghostscript for PDF conversion, but it is not installed
  • ...
  65935   Tue Jul 29 17:50:51 2008 Warning jhjon.huang@ses-americom.comBug reportWindows2.73-1.exeElogd.exe crashes almost everyday

My Elog running on windows 2003 sp1 is crashing with this error "  Faulting application elogd.exe, version 0.0.0.0, faulting module elogd.exe, version 0.0.0.0, fault address 0x00061330."  the version of elogd.exe is  has a built date of 2/22/2008.  Will upgrading to the latest windows binary resolve this issue?    Thanks!!

 

  65936   Wed Jul 30 10:06:57 2008 Reply Stefan Rittstefan.ritt@psi.chBug reportWindows2.73-1.exeRe: Elogd.exe crashes almost everyday

jh wrote:

My Elog running on windows 2003 sp1 is crashing with this error "  Faulting application elogd.exe, version 0.0.0.0, faulting module elogd.exe, version 0.0.0.0, fault address 0x00061330."  the version of elogd.exe is  has a built date of 2/22/2008.  Will upgrading to the latest windows binary resolve this issue?    Thanks!!

 I would give it a try!

  65937   Wed Jul 30 19:54:28 2008 Entry Alan Stonealstone@fnal.govBug reportLinux2.7.4-2113Exploit Browser Tabs to Make Anonymous Entries

One of my shifters just managed to make an anonymous logbook entry even though the Author attribute is required.

It turns out that he had two tabs in his browser opened/logged into the Elog.  He logged out in one tab only.   Then he

did some other work on the desktop.  Then he returned to the browser to make a new logbook entry, finding the tab which

still showed the logged in menu, including the link for "New".  The Shifer is on day two, so he did not give any special

notice to seeing Anonymous in the Author field instead of his name.  He did point it out when I came in, and noted that

no warning was given about making an anonymous entry.

 

I tested the same scenario myself.  One cannot preview an anonymous entry (when Author field is a required attribute).

A warning is given.  However, one can submit the anonymous entry, and no warning is given.

Alan

  65938   Thu Jul 31 09:25:01 2008 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2.7.4-2113Re: Exploit Browser Tabs to Make Anonymous Entries

Alan Stone wrote:

One of my shifters just managed to make an anonymous logbook entry even though the Author attribute is required.

It turns out that he had two tabs in his browser opened/logged into the Elog.  He logged out in one tab only.   Then he

did some other work on the desktop.  Then he returned to the browser to make a new logbook entry, finding the tab which

still showed the logged in menu, including the link for "New".  The Shifer is on day two, so he did not give any special

notice to seeing Anonymous in the Author field instead of his name.  He did point it out when I came in, and noted that

no warning was given about making an anonymous entry.

 

I tested the same scenario myself.  One cannot preview an anonymous entry (when Author field is a required attribute).

A warning is given.  However, one can submit the anonymous entry, and no warning is given.

 What configuration do you use? I tried to reproduce your problem with a "minimal" configuration like

[demo]
Attributes = Author, Subject
Preset Author = $long_name
Locked Attributes = Author

When I log out from the second browser tab and click on "New" on the first browser tab, I am shown the login page, not the new entry page. I guess your "menu commands" and "guest menu commands" allow non-logged in users to issue a "New" command. Try removing that.

Stefan

ELOG V3.1.5-3fb85fa6