Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 545 of 808  Not logged in ELOG logo
ID Date Icon Authordown Author Email Category OS ELOG Version Subject
  68937   Wed Apr 24 10:21:58 2019 Reply Heinz Junkesjunkes@fhi-berlin.mpg.deBug reportAllelogd 3.1.4Re: elog program does not respect "Allow edit" list

Thanks for the answer. The real problem is that you can overwrite existing entries even if you have set an entry to "read only", i.e. you have forbidden further editing.

Heinz

Stefan Ritt wrote:

There are two ways:

1) Use different password files for different logbooks. Each password file contains only those users which have access to that logbook.

2) Use "Login user = <usr list>" to restrict access to certain users in that list.

Stefan

Heinz Junkes wrote:

Since there's no answer to that.
I am the only one with the problem? Did I just configure something wrong?
Thanks Heinz

Heinz Junkes wrote:

submissions via the elog - program can overwrite entries even if the user has no edit rights

 

 

 

  68939   Wed Apr 24 11:03:26 2019 Reply Heinz Junkesjunkes@fhi-berlin.mpg.deBug reportAllelogd 3.1.4Re: elog program does not respect "Allow edit" list

Sorry, 

I meant "read only" by using "Restrict edit time" settings. e.g.

Restrict edit time = 24

I understand this to mean that an entry should not be able to be modified after 24 hours.

Heinz

Stefan Ritt wrote:

There is no "read only" flag. Please describe what you exactly did. Probably you want "Restrict edit time" for that.

Stefan

Heinz Junkes wrote:

Thanks for the answer. The real problem is that you can overwrite existing entries even if you have set an entry to "read only", i.e. you have forbidden further editing.

Heinz

Stefan Ritt wrote:

There are two ways:

1) Use different password files for different logbooks. Each password file contains only those users which have access to that logbook.

2) Use "Login user = <usr list>" to restrict access to certain users in that list.

Stefan

Heinz Junkes wrote:

Since there's no answer to that.
I am the only one with the problem? Did I just configure something wrong?
Thanks Heinz

Heinz Junkes wrote:

submissions via the elog - program can overwrite entries even if the user has no edit rights

 

 

 

 

 

  68941   Wed Apr 24 11:56:24 2019 Reply Heinz Junkesjunkes@fhi-berlin.mpg.deBug reportAllelogd 3.1.4Re: elog program does not respect "Allow edit" list

I ask my users where they had the problems and then create a demo for testing.
Thanks Heinz

Stefan Ritt wrote:

So you are telling me that "Restrict edit time" is not working correctly? In order to fix any problem, I have to reproduce it. Can you post a minimel elogd.cfg file with which I can reproduce the problem?

Stefan

Heinz Junkes wrote:

Sorry, 

I meant "read only" by using "Restrict edit time" settings. e.g.

Restrict edit time = 24

I understand this to mean that an entry should not be able to be modified after 24 hours.

Heinz

Stefan Ritt wrote:

There is no "read only" flag. Please describe what you exactly did. Probably you want "Restrict edit time" for that.

Stefan

Heinz Junkes wrote:

Thanks for the answer. The real problem is that you can overwrite existing entries even if you have set an entry to "read only", i.e. you have forbidden further editing.

Heinz

Stefan Ritt wrote:

There are two ways:

1) Use different password files for different logbooks. Each password file contains only those users which have access to that logbook.

2) Use "Login user = <usr list>" to restrict access to certain users in that list.

Stefan

Heinz Junkes wrote:

Since there's no answer to that.
I am the only one with the problem? Did I just configure something wrong?
Thanks Heinz

Heinz Junkes wrote:

submissions via the elog - program can overwrite entries even if the user has no edit rights

 

 

 

 

 

 

 

  68944   Fri Apr 26 11:24:21 2019 Reply Heinz Junkesjunkes@fhi-berlin.mpg.deBug reportAllelogd 3.1.4Re: elog program does not respect "Allow edit" list

Stefan, will send the info off this forum.

Heinz

Heinz Junkes wrote:

I ask my users where they had the problems and then create a demo for testing.
Thanks Heinz

Stefan Ritt wrote:

So you are telling me that "Restrict edit time" is not working correctly? In order to fix any problem, I have to reproduce it. Can you post a minimel elogd.cfg file with which I can reproduce the problem?

Stefan

Heinz Junkes wrote:

Sorry, 

I meant "read only" by using "Restrict edit time" settings. e.g.

Restrict edit time = 24

I understand this to mean that an entry should not be able to be modified after 24 hours.

Heinz

Stefan Ritt wrote:

There is no "read only" flag. Please describe what you exactly did. Probably you want "Restrict edit time" for that.

Stefan

Heinz Junkes wrote:

Thanks for the answer. The real problem is that you can overwrite existing entries even if you have set an entry to "read only", i.e. you have forbidden further editing.

Heinz

Stefan Ritt wrote:

There are two ways:

1) Use different password files for different logbooks. Each password file contains only those users which have access to that logbook.

2) Use "Login user = <usr list>" to restrict access to certain users in that list.

Stefan

Heinz Junkes wrote:

Since there's no answer to that.
I am the only one with the problem? Did I just configure something wrong?
Thanks Heinz

Heinz Junkes wrote:

submissions via the elog - program can overwrite entries even if the user has no edit rights

 

 

 

 

 

 

 

 

  69695   Mon Sep 18 13:49:05 2023 Angy Heinz Junkesjunkes@fhi-berlin.mpg.deBug reportLinuxelogd 3.1.4elog server crashed due to cookies send by client

Our elog instance (elogd 3.1.4 built Jan 13 2021, 20:44:20 revision ce2a48e9) has been running for years without any problems.

We have a new user who consistently crashes the elog:

GET /Omicron-STM-XPS/?rsort=Record%20date HTTP/1.1
Host: elog.fhi-berlin.mpg.de:4821
Cache-Control: max-age=0
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-gpc: 1
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Referer: https://elog.fhi-berlin.mpg.de/elog/isc/Omicron-STM-XPS/
Accept-Encoding: gzip, deflate, br
Accept-Language: el-GR,el;q=0.9,en;q=0.8
Cookie: ufnm=Sotirios Tsatsos; urem=1; elmode=full; elattach=1; sid=CD2B04E2C3F02EA4; googtrans=/en/en; amp_6e403e=aWS6RQd5UjGctj5Ym_cDzA.c2Fsdm9fc290b2thaXRlbkB5YWhvby5jb20=..1hajnscc0.1hajnscc0.0.ac.ac
X-Forwarded-For: 141.14.151.26
X-Forwarded-Host: elog.fhi-berlin.mpg.de
X-Forwarded-Server: elog.fhi-berlin.mpg.de
Connection: Keep-Alive


Received unknown cookie "googtrans"
Received unknown cookie "amp_6e403e"
*** buffer overflow detected ***: terminated
Abort (core dumped)

  69697   Tue Sep 19 10:58:14 2023 Reply Heinz Junkesjunkes@fhi-berlin.mpg.deBug reportLinuxelogd 3.1.4Re: elog server crashed due to cookies send by client

The server is crached because the author field was accidentally filled with a long string due to an automated (remote) script:


Author: The ion getter pump has successfully recovered and appears to be operating steadily once more. Consequently, I proceeded with sputtering to obtain an XPS survey scan of the Au sample.  Initially, the stability of the X-ray function was compromised, leading to multiple interruptions. Subsequently, an unexplained issue arose regarding the collection of counts on the channeltron detector. Additionally, the emission current exhibited fluctuations. Fortunately, it seems that we have addressed and resolved the previous issues.  In the image below, two XPS survey spectra are presented. The spectrum highlighted with a red line corresponds to the AlKa source, which was selected using the AlKa button. Conversely, the spectrum with a black line represents the MgKa source. In both cases, the energy configuration was set to 1486.7 eV. It's worth noting that the 1050 eV peak in both spectra corresponds to the Au4f state, with an energy displacement of 961.7 eV due to X-ray ghost lines caused by O contamination (84+961.7). It has come to my attention that the Mg source appears to have oxidized, a phenomenon we've observed before.  Moreover, it's important to highlight that the difference between the peaks in the low binding energy region is approximately 100 eV, not the expected 233 eV (considering the energy difference between magnesium and aluminum). This observation holds true for both cases where the same energy setting was used. Additionally, the energy of the Au4f peakSotirios Tsatso

Instead of just "Sotirios Tsatso". 

So it had nothing to do with the cookies etc.. But when the item created in this way was called up, the system crashed:

[248459.853246] elogd_misc[8407]: segfault at 561725164a4e ip 00007f8210c02854 sp 00007ffdcb92b338 error 4 in libc-2.31.so[7f8210a99000+178000]
[248459.853251] Code: 7f 07 c5 fe 7f 4f 20 c5 fe 7f 54 17 e0 c5 fe 7f 5c 17 c0 c5 f8 77 c3 48 39 f7 0f 87 ab 00 00 00 0f 84 e5 fe ff ff c5 fe 6f 26 <c5> fe 6f 6c 16 e0 c5 fe 6f 74 16 c0 c5 fe 6f 7c 16 a0 c5 7e 6f 44

 

Heinz Junkes wrote:

Our elog instance (elogd 3.1.4 built Jan 13 2021, 20:44:20 revision ce2a48e9) has been running for years without any problems.

We have a new user who consistently crashes the elog:

GET /Omicron-STM-XPS/?rsort=Record%20date HTTP/1.1
Host: elog.fhi-berlin.mpg.de:4821
Cache-Control: max-age=0
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-gpc: 1
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Referer: https://elog.fhi-berlin.mpg.de/elog/isc/Omicron-STM-XPS/
Accept-Encoding: gzip, deflate, br
Accept-Language: el-GR,el;q=0.9,en;q=0.8
Cookie: ufnm=Sotirios Tsatsos; urem=1; elmode=full; elattach=1; sid=CD2B04E2C3F02EA4; googtrans=/en/en; amp_6e403e=aWS6RQd5UjGctj5Ym_cDzA.c2Fsdm9fc290b2thaXRlbkB5YWhvby5jb20=..1hajnscc0.1hajnscc0.0.ac.ac
X-Forwarded-For: 141.14.151.26
X-Forwarded-Host: elog.fhi-berlin.mpg.de
X-Forwarded-Server: elog.fhi-berlin.mpg.de
Connection: Keep-Alive


Received unknown cookie "googtrans"
Received unknown cookie "amp_6e403e"
*** buffer overflow detected ***: terminated
Abort (core dumped)

 

  50   Thu Jul 4 16:52:59 2002 Warning Heiko Scheith.scheit@mpi-hd.mpg.de   elog submit problem
If a message is submitted via the elog command then the reply string '> ' is only inserted in the first line if a reply is made.
This message was submitted with the following commandline:
elog -v -h midas.psi.ch -p 80 -s elogdemo -l Forum -a "Icon=icon4.gif" -a "Author=Heiko Scheit"  -a "Author Email=h.scheit@mpi-hd.mpg.de" -a "Subject=elog submit problem" "...Message-text..."

Please press the reply button to see the problem.
  51   Thu Jul 4 17:05:03 2002 Warning Heiko Scheith.scheit@mpi-hd.mpg.deBug report  reverse sort and threaded mode does not display first entry
When the option 'Reverse sort = 1' is used then the first entry
is not displayed (ID=1) when threaded mode is requested.

Probably you can see the problem using this link and switching 
on reverse sort.  

http://midas.psi.ch/elogdemo/Linux/last20?mode=threaded
ELOG V3.1.5-3fb85fa6