> it would be good if the current state was listed in https://elog.psi.ch/elogs/Vulnerabilities/ 
> It seems there's now updated builds for at least windows, and the debian package still outdated?
> 
> Personally, I don't think removing download links and pulling packages should be more than a temporary measure.
> Treating people fairly IMHO means they should be able to reach a safe version by the same means that brought and left them exposed.
> 
> A clear central source would be best, one that has 
> 
> - package autobuilds
> - source
> - cve list
> 
> If I understand correctly, currently only the source is up to date?
> 
> 
> (I found py_elog on Github, so it could be an easy option to mirror ELOG there and let some free service handle the autobuilds.
> I don't know how well one can flag vulnerabilities there, but likely it's possible, and ideally more people would help there.)
> 
> 
> p.s.: My hat is off to the sysadmin who checked carefully, I wanted to introduce ELOG in a windows-centric place and I can't swear I would have checked this (official) download as well.

Very good ideas! Go ahead and implement them! We very much appreciate your contribution.

do not use confused name in attributes
**************************************
like
Attributes Type, Type2
the info on Type2 will be placed in the Type also
see attachment 1

Never use confused name like '
Attributes PC_Memory, Memory

If Stephan need more info I can send a exemple of the logbooks
Etienne

It seems when I use "reply" with an attachments, the original attachments of
the message are removed.

I use elog-2.3.5

Alexander.

Around line 2240 (in loc()) in elogd.c the following is written, 
which results in an infinite loop, since loc() recursively with
the same argument "Change %s".

   /* special case: "Change %s" */
   if (strstr(orig, "Change ")) {
      sprintf(result, loc("Change %s"), orig + 7);
      return result;
   }

For now I just commented these lines.

Somehow elog does not use the -s option (subdir) anymore,
resulting in a 'HTTP/1.1 404 Not Found' error.

For now I am using elog from version 2.3.9 together with elogd v2.5.0,
which seems to work OK.

When trying to stop elogd processes with the kill command
elogd exits only after access to the logbook.

It should exit immediately, maybe after some cleanup.

Noee. Here it works immediately.

Can you try with a fresh server from the distribution, with the example 
elogd.cfg, to see if there is any difference?

The killing is handled in the funciton ctrlc_handler(), which sets _abort = 
TRUE. This  is checked in line 16195, just after the select(), and the main 
loop is exited. The select finishes after one second, although I believe 
that the kill signal also terminates the select prematurely. The kill 
command and a Ctrl-C keystroke should work the same way, they both generate 
a SIGTERM or SIGINT signal.

Since I'n not a programmer I's like to be very carefulls with bug  
reports, but after testing for a while, I belive this my be a bug or  
something else:  
  
I have 2 systems running ELOG 2.5.1:   
1. uSE Linux 8.2, KDE 3.2 = NO problems at all! ELOG work's in every  
function quiet well!  
2. The Internet Server (of my friend): Windows 2003 Server, All MS paches  
installed, Running IIS 6.0 Port 80) and ELOG 2.5.1 (Port 8080) under  
FireDeamon 1.6GA (actual release) as a Service (Deamon).   
  
Problem under Win 2k3:  
This works very well, even with several users on the system and on ELOG  
as long as there is not msg. threaded! Is a Msg. Treaded ELOG produces  
the msg. showen in the attached Jepg-file below on Win 2k3.  
The problem occurs as soon as Elog would change to the threaded display 
or by clicking "Repaly" in the menu. Rights etc. are aleady checked on 
the file system and are looking well. Everithing will work well as 
nothing is thraded or testing locally under Linunx. 
 
Does anybody  
have an idea??? It my by a bog on Elog as well as from Microsoft or a  
problem produced by a dummy user (me...!). Since Linux don't have the  
problem and the same cfg-file and log-files are working well if I don't  
use mode=threaded as well as Display mode = threaded I believe it my be a  
realchance not to be the personal factor of the dummy user...   
  
ThankX for every hint!