> I am trying to use the command line utility elog. Some of the attributes 
> that I have setup are multiple options. When I run the command line 
> utility to create a new message, any attribute that is setup with multiple 
> options will not be filled in. The syntax I am using is as  follows:
> 
> elog -h localhost -p 8080 -l Lab -a "Site=xxxx" -a "Area=System" -
> a "Priority=Low" -a "Shift=1" -a "Status=Open" -m text.txt
> 
> Site and Area are defined in the config file as MOptions. Is there a way 
> to use this feature with multiple options on attributes with the 
> attributes = to one or more variables?

For MOptions, you have to append an "_n" to each attribute to distinguish
different options for the same attribute, like

elog -h localhost -p 8080 -l Lab -a "Site_0=Home" -a "Site_1=Work" ...

Even if you only use one attribute, the trailing "..._0" is necessary. I will
add a note to the documentation.

Dear ELOG users,

It has been brought to my attention that ELOG has a vulnerability through
which one can obtain a remote shell (meaning to log in to your machine
through elog). There is even an exploit available which demonstrates that
both for linux and windows.

This is a severe security problem for all logooks which can be seen from
outside, even if they have password protection on. I strongly recommened to
upgrade to elog version 2.5.7 as soon as possible if you run a public elog
server.

Here is some explanation for the technically interested:

The problem arises from a strcpy() in the decode_post() routine, which
triggers a buffer overflow when attachment file names longer than 256
characters are submitted. I replaced (hopefully) all strcpy() with strlcpy()
to fix this problem, but if someone sees a location which I have missed,
please tell me.

The second vulnerability had to do with write passwords. If you put a "write
password = xxx" statement into your config file, it was still possible to
download the config file with a special hand-written URL, and decode the
write password, which is usually only base-64 encoded unless you haven't
compiled elog with the -DHAVE_CRYPT flag. I have changed that so if a write
password is present, the download is only possible when this password is
submitted in each request. If this has some effects on synchronizing of
logbooks, please let me know.

Stefan Ritt

> I am trying to run eLog under Apache 2 on my FreeBSD 5.3 server.  I started
> the daemon with "elogd -n <my hostname> -p 8080" and when I connect to my
> server on that port, I get a 500 server configuration error.  The Apache log
> contains this:
> 
> malformed header from script. Bad header=Please specify hostname.: elog

- make sure your proxy definition in httpd.conf is correct and it uses port 8080
- start elogd with the "-v" flag to see the communication between Apache and elogd
- maybe you might need an "URL = http://<my hostname>/<elog dir>/" in the config
file

> No luck.  I have the proxy definition in my httpd.conf file.  I have the URL parameter
> in my elogd.cfg file.

Can you show me the proxy definition? I hope you don't treat elogd as a CGI script...

As I wrote you by mail, I implemented your idea in the following way. As you
say, it's only working on Gecko based systems. I did not implement additional
configuration parameters, but made it through the CSS file:

- adding a new CSS style "attachmentframe" around all attachments
- adding class "attachmentframe" to the 'default.css' like:

.attachmentframe {
  border:1px solid grey;
  border-top:1px solid lightgrey;
  border-left:1px solid lightgrey;
  background-color:white;
  padding:5px;
}

.attachmentframe img {
    max-width:100%;
}

The latter restricts the image size to 100%, which is the width of the 
browser window. I like it that, but of course you can write 200px or 
anything else. Please find the modified elogd.c and default.css under CVS.

Have a look at http://midas.psi.ch/elogs/Contributions/10

> There is a problem with the 'Show Attributes' option
> causing the 'Format ...' options to be ignored.
> 
> See attachment for patch.

Thanks a lot. I applied your patch and committed the changes to CVS.

> If you have a space in a logbook name and you enable password list, then 
> the "List" menu option forces you to the login page each time.
> The URL says "aaa+bbb", but when you do not have passwords enabled, the 
> URL is "aaa bbb"

Thanks for reporting this. I fixed it in the current CVS version.