Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 424 of 808  Not logged in ELOG logo
 Find |  Login |  Help 
 Full | Summary | Threaded | Hide attachments  Show only new entries    6457 Entries 
Goto page Previous  1, 2, 3 ... 423, 424, 425 ... 806, 807, 808   Next  
ID Date Icon Author Author Emaildown Category OS ELOG Version Subject
  66921   Wed Oct 27 23:43:37 2010 Question Morion Blackmorion.estariol@gmail.comQuestionOther2.8.0Can anyone help compile ELog 2.8.0 on SunOS 5.11?

 I have server with SunOS 5.11:

uname -a

SunOS *** 5.11 snv_134 i86pc i386 i86pc

 

when I try to compile ELog I get error:

gmake

gcc  -DHAVE_SSL -w -c -o crypt.o src/crypt.c

gcc  -DHAVE_SSL -I../mxml -o elog src/elog.c crypt.o -lsocket -lnsl -lssl

Undefined                       first referenced

 symbol                             in file

MAX                                 crypt.o

MIN                                 crypt.o

mempcpy                             crypt.o

_ast_strtoul                        crypt.o

_ast_realloc                        crypt.o

ld: fatal: symbol referencing errors. No output written to elog

collect2: ld returned 1 exit status

gmake: *** [elog] Error 1

 
 
Can anyone help to compile Elog?

  351   Thu May 22 21:36:54 2003 Warning Roberto Morellimorelli@es.netBug report  bug in cfg file
Hello Folks,

Found an interesting problem with 2.3.7 under redhat 9.0 linux.

When you take the elogd.cfg file and the menu commands = <list> and guest 
menu commands = <list>, the config menu for edit the elogd.cfg stops 
working, yet if I change the URL manually, I can still get to the file and 
the menus do not change.  If I delete all menu commands, then all works 
without errors, yet the menus do not match default.

Also, the self registration function equal to 3 does not always send email.

Cheers,
Roberto
  69285   Thu Dec 31 18:35:19 2020 Reply prinnydoodmoltensolderlabs@pm.meBug reportLinux3.1.3Re: Path disclosure on unfound file

I can confirm this issue exists on version 3.1.3, which I have installed elog on Debian 10.

The issue also exists on version 3.14 (1.20190113git283534d97d5a.el7), which I tested on an AmazonLinux EC2 instance.

This is what I found:

1. if I leave out the extension at the end of the URL for a non-existent page, it gives me the red error box. So far so good... Example: /gibberish

2. if I include any random extension at the end of the URL for a non-existent page, it gives me the red error box. So far so good... Example: /gibberish.php or /gibberish.htm or /gibberish.asdfasd

3. if I include any .html extension specifically at the end of the URL for a non-existent page, elog exposes the path /usr/share/elog/themes/default/gibberish.html. This is a bug... Example: /gibberish.html exposes the path, and likewise, /.gibberish.html ( "dot" + gibberish) exposes the path

4. if I include a valid, existent .html file which is located in the directory /usr/share/elog/themes/default/, and call it, elog exposes the html document. Example: I created an html file called gibberish.html (containing <html><body><p>Hello world</p></body></html>) in my system's /usr/share/elog/themes/default/ directory. After navigating back to the /gibberish.html URL, I was presented with the HTML file.

Turning on -v (verbose mode), the response by elogd when accessing these are: "GET /elog/gibberish.html HTTP/1.0 Returned 605 bytes" (displays "Hello world" html file), and "GET /elog/gibberish.asdfasd HTTP/1.0 Returned 605 bytes" (displays red error box).

=====

My guess: the program seems to be caring about the files ONLY if they have html file extension. Please see the screenshots below.

====

What are the security implications? Not much, I think. From what I can tell, exposing the "/usr/share/themes/elog" path, and also exposing the elog version when the file does not exist. Hope this reply helps anyone else with the same question.

(I am sure the error exposing the version can be removed by editing the source code--this is probably beyond my capabilities at this point).

Attachment 1: no_extension.png
no_extension.png
Attachment 2: nonexistent_html.png
nonexistent_html.png
Attachment 3: random_extension.png
random_extension.png
Attachment 4: valid_html_file_with_html_extension.png
valid_html_file_with_html_extension.png
  682   Fri Sep 3 20:17:12 2004 Question Bryan Moffitmoffit@jlab.org Linux2.5.4PostScipt Files shown as text.
At some point, in the last week or so, I upgraded the debian-unstable
version (r1459-1) of elog.  Now, PostScript files (as attachments) are
displayed (shown in ascii text, instead of just showing the link).  

Is there an option in the elog.cfg to only display certain files (like .gif
or .jpg).
  683   Fri Sep 3 20:17:20 2004 Question Bryan Moffitmoffit@jlab.org Linux2.5.4PostScript Files shown as text.
At some point, in the last week or so, I upgraded the debian-unstable
version (r1459-1) of elog.  Now, PostScript files (as attachments) are
displayed (shown in ascii text, instead of just showing the link).  

Is there an option in the elog.cfg to only display certain files (like .gif
or .jpg).
  684   Fri Sep 3 20:17:35 2004 Question Bryan Moffitmoffit@jlab.orgQuestionLinux2.5.4PostScript Files shown as text.
At some point, in the last week or so, I upgraded the debian-unstable
version (r1459-1) of elog.  Now, PostScript files (as attachments) are
displayed (shown in ascii text, instead of just showing the link).  

Is there an option in the elog.cfg to only display certain files (like .gif
or .jpg).
  66867   Wed Jul 28 17:21:31 2010 Question Bryan Moffitmoffit@jlab.orgQuestionLinux2.7.8-2278Disable forward/backward navigation keystrokes?

I wondered if there was a config line that enabled/disabled the forward and backward navigation keystrokes that were implemented in 2.7.0?

The current definitions (Control-PgUp/PgDown/Home/End) interfere with those keys I use to navigate between tabs in Firefox.  It'd be nice if they could either be turned off.. or redefined.

  66869   Wed Jul 28 17:32:15 2010 Reply Bryan Moffitmoffit@jlab.orgQuestionLinux2.7.8-2278Re: Disable forward/backward navigation keystrokes?

Stefan Ritt wrote:

Bryan Moffit wrote:

I wondered if there was a config line that enabled/disabled the forward and backward navigation keystrokes that were implemented in 2.7.0?

The current definitions (Control-PgUp/PgDown/Home/End) interfere with those keys I use to navigate between tabs in Firefox.  It'd be nice if they could either be turned off.. or redefined.

They are defined in

<ELOG directory>\scripts\elcode.js

Just go to the browse(evt) function and redefine or remove them there. 

 Got it to work as desired.

 

Thanks for your help and your quick response.

Goto page Previous  1, 2, 3 ... 423, 424, 425 ... 806, 807, 808   Next  
ELOG V3.1.5-3fb85fa6