Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 300 of 808  Not logged in ELOG logo
ID Date Icon Author Author Email Category OS ELOG Versiondown Subject
  67250   Mon Apr 16 11:10:07 2012 Warning Christopher Leechris@chrisandclaire.orgBug reportLinux2435Forgot Password

We seem to have a problem with retrieving user passwords using the forgot password system
This only happens when trying to use the password recovery from the first screen that forces people to log in with the following syntax:

Protect selection page = 1
Password file = XXXXX

On the first page of our elog which can be found at

http://physics.uj.ac.za/elog/

Now currently there is one page that is viewable by guests, so going to this direct link, bypasses the login at the main page
If you try login from this page, and then use the forgot password link, the email that gets sent through will then work.

The first email that gets sent through using the main login page has the following link:
https://physics.uj.ac.za/elog/?redir=%3Fcmd%3DChange+password%26oldpwd%3DYJAATGHSIRRSBLLP&uname=Tester&upassword=YJAATGHSIRRSBLLP

When clicking on the above link normally, it takes you to a NULL user

 

The email link that gets sent from the guest page, that works, looks like this:
https://physics.uj.ac.za/elog/General/?redir=%3Fcmd%3DChange+password%26oldpwd%3DSACWEHJWWHKEXLMO&uname=Tester&upassword=SACWEHJWWHKEXLMO

 

Attached is a copy of the cfg file. The last few logbooks are all actually just copies of TEMPLATE A, so I have removed all their details to make the file easier to read for now
 

Attachment 1: elogd.cfg
[global]
; GENERAL SETTINGS
port = 8080
URL = https://physics.uj.ac.za/elog/
Login expiration = 48

;sets login to first page
Protect selection page = 1
Password file = XXXXXX
Self register = 4

;SMTP email settings
SMTP username = physics.uj.elog@gmail.com
SMTP Password = XXXXXX
SMTP host = 173.194.67.108


;error logging details:
Logging level = 3
Logfile = elog.log

; Admins
Admin user = Chris, sash, connell

;Groups
Show top groups = 1

Group Open Logbooks = General, General Physics
Group Personal = Simon Connell, Martin Cook, Marius Tchonang, Doomnull Unwuchola, Admin Users, Claire Lee

Top Group Personal Logbooks = Open Logbooks, Personal
Top Group Instruments = Lang Topography, On-line LAUE, Plane Wave Topography, Diamond Processing
Top Group Collaboration = ATLAS - H --> Z'Z', ATLAS - W --> l nu tau nu, ATLAS -  Astro-Particle, ATLAS - MuonDB, JLAB - Omega
;Top Group Templates = Template A, Template B

[global Personal Logbooks]
Admin user = Chris, sash, connell

[global Instruments]
Admin user = Chris, sash, connell

[global Collaboration]
Admin user = Chris, sash, connell

[Template A]
; use user level password access
Password file = XXXXXX
Admin user = Chris, sash, connell
login user = Chris, sash, connell


; look and feel
Date format = %B %d, %Y
Title image URL = https://physics.uj.ac.za/elog/

; attributes
Attributes = Author, Author Email, Category, Subject
Options Category = Routine entry, Shift summary, Problem, Fix, Question, Info, Other
Extendable attributes = Category
Required Attributes = Category, Subject
Thread display = $Subject, entered by $author on $Entry date
Quick filter = Date, Category

; preset author and email
Preset Author = $long_name
Preset Author Email = $user_email

; these attributes cannot be changed
Locked Attributes = Author, Author Email

; only author can change its own entry
Restrict edit = 1

; options for reply
Subst on reply subject = Re: $Configuration Name
Remove on reply = Author, Author Email

; No Email notification
Suppress Email to users = 1

[Template B]
; use user level password access
Password file = XXXXXX
; Admin user = Chris, sash, connell
; login user = Chris, sash, connell

Theme = default
Display mode = threaded
Entries per page = 100
Filtered browsing = 0
Entries per page = 8
Reverse sort = 1
Restrict edit = 1
Summary lines = 1

Display Email recipients = 1
#Suppress Email to users = 0
#Email All = 
#Use Email From = physics.uj.elog@physics.uj.ac.za
#Use Email Subject = [ELOG][$logbook][$date][$subject]
#Preset Email = $user_email
#Email Encoding = 1
#Email Format = 15

Title image URL = https://physics.uj.ac.za/elog/

; look and feel
;Date format = %B %d, %
Title image URL = https://physics.uj.ac.za/elog/

Comment = Testing Worklist
List Display = Edit, ID, Job Description, Location, Status, Date Entered, Date Closed
Thread Display = $Location, $Job Description, $Date Entered, $Date Closed,
#Start Page = ?Status=2-Open&mode=threaded&sort=Location
Start Page = ?wpwd=1&mode=threaded&Status=2-Open&sort=Location
Date Format = %A, %B %d, %Y
Time Format = %A, %B %d, %Y, %H:%M
Message Height = 6
Attributes = Location, Status, Date Entered, Date Closed, Job Description, Author, Email
Type To Do = Time
Type Date Entered = time
Type Date Closed = time
Options Status = 1-To Do{1}, 2-Open{2}, 3-Closed{3}, 4-Suspended{4}
{1} Preset To Do = $Date
{2} Preset Date Entered = $Date
{3} Preset Date Closed = $Date
{4} Preset Date Closed = $Date
Options Location = Sequim, Port Angeles, All, Secaira
Extendable options = Location,
Page Title = Simon's Worklist - $subject
Option Author = Filled In Automatically
Subst Author = $long_name
Menu Commands = Back, New, Edit, Delete, Reply, Find, Select, Copy to, Move to,

Reverse sort = 1
Quick Filter = Location, Status

Subst on reply subject = Re: $Job Description
Thread display = $subject, posted by $author on $Entry time
Thread icon = Icon
Remove on reply = Author, Author Email
Date format = %B %d, %Y
Preset Author = $long_name
Preset Author Email = $user_email
Locked Attributes = Author
Quick filter = Date, Category, Status

[General]

[General Physics]

[Simon Connell]

[Martin Cook]

[Marius Tchonang]

[Doomnull Unwuchola]

[Admin Users]

[Claire Lee]

[Lang Topography]

[On-line LAUE]

[Plane Wave Topography]

[Diamond Processing]

[ATLAS - H --> Z'Z']

[ATLAS - W --> l nu tau nu]

[ATLAS -  Astro-Particle]

[ATLAS - MuonDB]

[JLAB - Omega]

  67255   Mon Apr 30 17:05:28 2012 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2435Re: Forgot Password

Christopher Lee wrote:

We seem to have a problem with retrieving user passwords using the forgot password system 

Thanks for reporting that bug. With the help of your config file I finally could reproduce and fix it. The fix is contained in SVN revision 2462.

  67256   Tue May 1 09:20:00 2012 Cool Christopher Leechris@chrisandclaire.orgBug reportLinux2435Re: Forgot Password

Stefan Ritt wrote:

Christopher Lee wrote:

We seem to have a problem with retrieving user passwords using the forgot password system 

Thanks for reporting that bug. With the help of your config file I finally could reproduce and fix it. The fix is contained in SVN revision 2462.

 Thanks mate.. Glad to know it wasn't just me going insane? I'll keep an eye out for the new file

  67259   Wed May 2 09:17:56 2012 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2435Re: Forgot Password

Christopher Lee wrote:

Stefan Ritt wrote:

Christopher Lee wrote:

We seem to have a problem with retrieving user passwords using the forgot password system 

Thanks for reporting that bug. With the help of your config file I finally could reproduce and fix it. The fix is contained in SVN revision 2462.

 Thanks mate.. Glad to know it wasn't just me going insane? I'll keep an eye out for the new file

For the new version have a look here: http://midas.psi.ch/elog/faq.html#21 

  67127   Mon Sep 26 08:13:10 2011 Entry Olivier CallotOlivier.Callot@cern.chBug reportLinux2418Spurious characters in the searched string

Hi,

We have a problem with the search command: Since our last upgrade to v2.9.0-2418 the searched string is pre- and postfixed with ASCII character expressed in % format, see the attached image. The searched string is prefied with %255E and postfxed by %2524 in the URL. And teh search fails. This affects searches from drop-down menus.

Thanks in advance.

Attachment 1: Capture.PNG
Capture.PNG
  67128   Mon Sep 26 10:38:59 2011 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2418Re: Spurious characters in the searched string

Olivier Callot wrote:

Hi,

We have a problem with the search command: Since our last upgrade to v2.9.0-2418 the searched string is pre- and postfixed with ASCII character expressed in % format, see the attached image. The searched string is prefied with %255E and postfxed by %2524 in the URL. And teh search fails. This affects searches from drop-down menus.

Thanks in advance.

Strange. In this forum it works without extra characters. Just try it yourself. Do you have any strange configuration? Can you send me a minimal elogd.cfg which produces that error, maybe derived from the example elogd.cfg from the distribution.

- Stefan 

  67129   Mon Sep 26 11:16:19 2011 Reply Olivier CallotOlivier.Callot@cern.chBug reportLinux2418Re: Spurious characters in the searched string

Stefan Ritt wrote:

Olivier Callot wrote:

Hi,

We have a problem with the search command: Since our last upgrade to v2.9.0-2418 the searched string is pre- and postfixed with ASCII character expressed in % format, see the attached image. The searched string is prefied with %255E and postfxed by %2524 in the URL. And teh search fails. This affects searches from drop-down menus.

Thanks in advance.

Strange. In this forum it works without extra characters. Just try it yourself. Do you have any strange configuration? Can you send me a minimal elogd.cfg which produces that error, maybe derived from the example elogd.cfg from the distribution.

- Stefan 

 Well, It may be our implementation of re-routing web requests: The requested string in elog  is prefixed by %5E (^) and postfixed by %24 ($). But in my case, the '%' is again escaped as %25 so the prefix becomes %255E that is not understood by elog as being '^' ...

I will see with my experts in routing if this is something that can be fixed in our configuration. But when elog processes the input string, it should un-escape these characters and find back the '^', no?

  67131   Mon Sep 26 14:49:48 2011 Reply Olivier CallotOlivier.Callot@cern.chBug reportLinux2418Re: Spurious characters in the searched string

Olivier Callot wrote:

Stefan Ritt wrote:

Olivier Callot wrote:

Hi,

We have a problem with the search command: Since our last upgrade to v2.9.0-2418 the searched string is pre- and postfixed with ASCII character expressed in % format, see the attached image. The searched string is prefied with %255E and postfxed by %2524 in the URL. And teh search fails. This affects searches from drop-down menus.

Thanks in advance.

Strange. In this forum it works without extra characters. Just try it yourself. Do you have any strange configuration? Can you send me a minimal elogd.cfg which produces that error, maybe derived from the example elogd.cfg from the distribution.

- Stefan 

 Well, It may be our implementation of re-routing web requests: The requested string in elog  is prefixed by %5E (^) and postfixed by %24 ($). But in my case, the '%' is again escaped as %25 so the prefix becomes %255E that is not understood by elog as being '^' ...

I will see with my experts in routing if this is something that can be fixed in our configuration. But when elog processes the input string, it should un-escape these characters and find back the '^', no?

 It turned out to be a setting of our re-routing of requests that re-escaped the '%'. Sorry for the noise. Cheers

ELOG V3.1.5-3fb85fa6