Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 731 of 806  Not logged in ELOG logo
ID Date Icon Author Author Email Categorydown OS ELOG Version Subject
  68576   Wed Feb 8 16:38:15 2017 Smile fbretelnothx@hello.comBug reportLinux3.1.1Possible misuse of email headers Message-Id and In-Reply-To

Hi,

As mentionned before, we happen to fail to receive email messages related to updates on elog entries at our site. My understanding is that the SMTP header Message-Id MUST be unique for each email message. Whereas all elogd email messages get something like <logbook>-<entryId>@<domain>. See source code. For this header to become unique, there should be a random part in it.

Having the same Message-Id in multiple email messages results in only the first one being delivered on some email systems.

Moreover, elogd sets the In-Reply-To: header in the same manner (<logbook>-<entryId>@<domain>). Which is incorrect because this header relates to email messages, not elog entries, and should contain the email Message-Id of the email message to which it replies, itself handled by the email messaing system. But elogd hasn't received any email messsage in the first place. So I believe this header should simply be dropped.

I think I can provide a pull request on bitbucket for the Message-Id issue, and probably also for the In-Reply-To: if you decide it can be removed.

Cheers

  68577   Wed Feb 8 18:16:30 2017 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux3.1.1Re: Possible misuse of email headers Message-Id and In-Reply-To

A pull request would be highy appreciated, because you can then test it thoroughly on your side. Adding a random number to the message id is simple. "Reply-to" indeed does not make sense since elog cannot receive emails. Most sites use a generic "noreply@<domain>" to indicate to the user that a reply does not make sense. I guess the "Reply-to" does not have to be unique, right?

fbretel wrote:

Hi,

As mentionned before, we happen to fail to receive email messages related to updates on elog entries at our site. My understanding is that the SMTP header Message-Id MUST be unique for each email message. Whereas all elogd email messages get something like <logbook>-<entryId>@<domain>. See source code. For this header to become unique, there should be a random part in it.

Having the same Message-Id in multiple email messages results in only the first one being delivered on some email systems.

Moreover, elogd sets the In-Reply-To: header in the same manner (<logbook>-<entryId>@<domain>). Which is incorrect because this header relates to email messages, not elog entries, and should contain the email Message-Id of the email message to which it replies, itself handled by the email messaing system. But elogd hasn't received any email messsage in the first place. So I believe this header should simply be dropped.

I think I can provide a pull request on bitbucket for the Message-Id issue, and probably also for the In-Reply-To: if you decide it can be removed.

Cheers

 

  68578   Wed Mar 15 16:04:13 2017 Reply fbretelnothx@hello.comBug reportLinux3.1.1Re: Possible misuse of email headers Message-Id and In-Reply-To

Pull-request posted. Cheers.

  68579   Wed Mar 15 16:42:35 2017 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux3.1.1Re: Possible misuse of email headers Message-Id and In-Reply-To

Pull-request merged.

fbretel wrote:

Pull-request posted. Cheers.

 

  68608   Fri Apr 21 02:21:59 2017 Reply Xuan Wuwux@ihep.ac.cnBug reportWindows3.1.2Re: Elog crashes with null Username

We also meet this issue occasionally, so how can we get rid of this?

Stefan Ritt wrote:

Ups. This bug must have lingered there since the beginning of time. Funny that nobody noticed in the last ten years or so. I have fixed it in the current git revision.

Alan Grant wrote:

I haven't found any reporterd issues in the forum similar yet, but it appears there is a bug in Elog when logging into logbooks. If I leave Username and Password null and click Submit the daemon crashes. We've been having this problem off and on and after some verbose logging level 3 I was drawn to these recurring lines in the log:

16-Dec-2016 18:20:22 [172.23.113.4] {SER Reports} LOGIN user "" (attempt)
16-Dec-2016 23:15:52 [] Server listening on port 8080 ..
16-Dec-2016 23:18:05 [172.23.113.4] {Daily Request Log} LOGIN user "dmorrison" (attempt)

 

 

  68610   Fri Apr 21 05:27:35 2017 Reply Alan Grantagrant@winnipeg.caBug reportWindows3.1.2Re: Elog crashes with null Username

Are you using the current git revision Xuan?

Xuan Wu wrote:

We also meet this issue occasionally, so how can we get rid of this?

Stefan Ritt wrote:

Ups. This bug must have lingered there since the beginning of time. Funny that nobody noticed in the last ten years or so. I have fixed it in the current git revision.

Alan Grant wrote:

I haven't found any reporterd issues in the forum similar yet, but it appears there is a bug in Elog when logging into logbooks. If I leave Username and Password null and click Submit the daemon crashes. We've been having this problem off and on and after some verbose logging level 3 I was drawn to these recurring lines in the log:

16-Dec-2016 18:20:22 [172.23.113.4] {SER Reports} LOGIN user "" (attempt)
16-Dec-2016 23:15:52 [] Server listening on port 8080 ..
16-Dec-2016 23:18:05 [172.23.113.4] {Daily Request Log} LOGIN user "dmorrison" (attempt)

 

 

 

  68611   Fri Apr 21 08:19:05 2017 Reply Xuan Wuwux@ihep.ac.cnBug reportWindows3.1.2Re: Elog crashes with null Username

No, We are using the released version 3.1.2

How to use the current git revision or is it a long time to wait for the next release?

Alan Grant wrote:

Are you using the current git revision Xuan?

Xuan Wu wrote:

We also meet this issue occasionally, so how can we get rid of this?

Stefan Ritt wrote:

Ups. This bug must have lingered there since the beginning of time. Funny that nobody noticed in the last ten years or so. I have fixed it in the current git revision.

Alan Grant wrote:

I haven't found any reporterd issues in the forum similar yet, but it appears there is a bug in Elog when logging into logbooks. If I leave Username and Password null and click Submit the daemon crashes. We've been having this problem off and on and after some verbose logging level 3 I was drawn to these recurring lines in the log:

16-Dec-2016 18:20:22 [172.23.113.4] {SER Reports} LOGIN user "" (attempt)
16-Dec-2016 23:15:52 [] Server listening on port 8080 ..
16-Dec-2016 23:18:05 [172.23.113.4] {Daily Request Log} LOGIN user "dmorrison" (attempt)

 

 

 

 

  68612   Fri Apr 21 10:57:07 2017 Reply Stefan Rittstefan.ritt@psi.chBug reportWindows3.1.2Re: Elog crashes with null Username

I made a new release for you 3.1.3

Xuan Wu wrote:

No, We are using the released version 3.1.2

How to use the current git revision or is it a long time to wait for the next release?

Alan Grant wrote:

Are you using the current git revision Xuan?

Xuan Wu wrote:

We also meet this issue occasionally, so how can we get rid of this?

Stefan Ritt wrote:

Ups. This bug must have lingered there since the beginning of time. Funny that nobody noticed in the last ten years or so. I have fixed it in the current git revision.

Alan Grant wrote:

I haven't found any reporterd issues in the forum similar yet, but it appears there is a bug in Elog when logging into logbooks. If I leave Username and Password null and click Submit the daemon crashes. We've been having this problem off and on and after some verbose logging level 3 I was drawn to these recurring lines in the log:

16-Dec-2016 18:20:22 [172.23.113.4] {SER Reports} LOGIN user "" (attempt)
16-Dec-2016 23:15:52 [] Server listening on port 8080 ..
16-Dec-2016 23:18:05 [172.23.113.4] {Daily Request Log} LOGIN user "dmorrison" (attempt)

 

 

 

 

 

ELOG V3.1.5-3fb85fa6