Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 584 of 808  Not logged in ELOG logo
ID Date Icon Author Author Email Categorydown OS ELOG Version Subject
  186   Tue Jan 7 09:39:29 2003 Reply Stefan Rittstefan.ritt@psi.chBug report  Re: security in find option as a guest
> if you are guest in the find option  
> 
> select 'all logbook'
> 
> it will display all 'attributes' from other logbook 
> with no option  'guest command ...'
> but having the same 'attribute' name
> 
> Solution :
> **********
> I use the copy to command to make a copy to other logbook
> with option 'guest command' enabled
> 
> in this section I remove some field so the guest user can't no see all field
> 
> I suggest to give acces to 'guest' on a second run of elog to another
> port or other computer ?

I see your problem. I could either disable the "Search all logbooks" switch 
for certain logbooks (like the guest one), or restrict the search to logbooks 
which have a "guest command" option. What would you prefer?

- Stefan
  187   Tue Jan 7 16:04:14 2003 Reply Etienne Van Caillieetienne.vancaillie@mba.beBug report  Re: security in find option as a guest
> > if you are guest in the find option  
> > 
> > select 'all logbook'
> > 
> > it will display all 'attributes' from other logbook 
> > with no option  'guest command ...'
> > but having the same 'attribute' name
> > 
> > Solution :
> > **********
> > I use the copy to command to make a copy to other logbook
> > with option 'guest command' enabled
> > 
> > in this section I remove some field so the guest user can't no see all 
field
> > 
> > I suggest to give acces to 'guest' on a second run of elog to another
> > port or other computer ?
> 
> I see your problem. I could either disable the "Search all logbooks" switch 
> for certain logbooks (like the guest one), or restrict the search to 
logbooks 
> which have a "guest command" option. What would you prefer?
> 
> - Stefan

may be add a parameter

Restrict Search all logboog = 1 or 0
if 1 the switch will not appear 
  188   Tue Jan 7 17:30:50 2003 Idea Stefan Rittstefan.ritt@psi.chBug report  Re: security in find option as a guest
> may be add a parameter
> 
> Restrict Search all logboog = 1 or 0
> if 1 the switch will not appear 

The flag "Search all logbooks" is already there! (I forgot about it!). So 
just set it to "0" and you should be fine.

- Stefan
  194   Sat Jan 11 19:26:24 2003 Question Etienne Van Caillieetienne.vancaillie@mba.beBug report  Re: 'group' option in conflict with 'guest logic' and 'LogBook Tabs' option
> From Version 2.2.5 on, the configuration file entries
> 
> User = ...
> Group = ...
> 
> have been changed to
> 
> Usr = ...
> Grp = ...
> 
> in order not to conflict with the new "Group = ..." option which is used by 
> hierarchical logbooks.

not really a bug
works very fine just remarks : with this example
Group Phone & Adress = Whois, Qui_est_Qui
Group Extranet = Aide, Promos_Clients, Qui_est_Qui, Joke

[whois] is a intranet section for us : [qui_est_qui] is public
I add   'copy to = Qui_est_qui' 
so extranet or public can acces to limited information
just remove the attributes and guest user can see only limited info
see example below

small problem : 
****************
Logbook Tabs = 0  in the guest logbook will close the group header
may be create a parameter to solve ?
GroupGuest Extranet = ....

;--------------------  intranet info----------------
[Whois]
Comment = MBA & his Partner all your personal info must be here
Subdir = whoiswho
Menu commands = Back, New, Edit, Find, Help, Copy to
Attributes = Partner, AsTo, YourName, SurName, email1, email2, hotmail,Yahoo, 
GSMmail, Nickname, phone, fax, portable , home , adress, Remarks, birthday, 
QuadroUser, Function, Division
MOptions Partner = Mba, MbaCZ, BusinessCom, Edipax, Ibi, Other
Required Attributes = Parner, CodeName, YourName, email1, phone, birthday
Preset GSMmail = ???@proximus.be
Preset portable = 00 32
Copy to = Qui_est_Qui

Quick filter = Partner, Date, AsTo

;------------------------------------
[Qui_est_Qui]
Comment = MBA et ses collaborateurs à votre service 
Subdir = logbooks/whoiswho/public
Attributes = Partner, YourName, SurName, phone, fax ,portable ,email1 , 
hotmail, GSMmail, Nickname,  Remarks,Function, Division
MOptions Partner = Mba
Date format = %d/%m/%y
Quick filter = Date

;--------------------pas d'acces au autre menu no acces to main menu
Logbook Tabs = 0
Guest menu commands = Find
Guest find menu commands = Find
;-------------- rectriction on edit if not put  1  
Restrict edit = 1
Display mode = full
Help URL = http://www.mba.be







 
  196   Mon Jan 13 11:43:37 2003 Reply Stefan Rittstefan.ritt@psi.chBug report  Re: 'group' option in conflict with 'guest logic' and 'LogBook Tabs' option
> small problem : 
> ****************
> Logbook Tabs = 0  in the guest logbook will close the group header
> may be create a parameter to solve ?
> GroupGuest Extranet = ....

What I would recommend in that case is to run two copies of elogd in 
parallel, one for the public and one for the private section. They can even 
run on differnt ports so the firewall can block the private section. If the 
private logbooks are not defined in the public elogd, they don't show up in 
the logbook tabs, so only the publick logbook tabs are seen. Please note 
that two elogd daemons should not have concurrent write access to the same 
logbook, since there is not locking and the logbook could get messed up that 
way. So only one elogd should have write access to any logbook.

- Stefan
  198   Tue Jan 21 10:04:46 2003 Angy Etienne Van Caillieetienne.vancaillie@mba.beBug report  confused name in the attributes section
do not use confused name in attributes
**************************************
like
Attributes Type, Type2
the info on Type2 will be placed in the Type also
see attachment 1

Never use confused name like '
Attributes PC_Memory, Memory

If Stephan need more info I can send a exemple of the logbooks
Etienne
  199   Fri Jan 24 12:24:18 2003 Reply Stefan Rittstefan.ritt@psi.chBug report  Re: confused name in the attributes section
> do not use confused name in attributes
> **************************************
> like
> Attributes Type, Type2
> the info on Type2 will be placed in the Type also
> see attachment 1
> 
> Never use confused name like '
> Attributes PC_Memory, Memory

I acknowledge the problem. It had to do with the fact that for checkbox 
options, the first checkbox is submitted in the above case as "Type0", the 
second as "Type1", and the third as "Type2" which conficts with the other 
attribute. I fixed that and use now "Type#0" and so on which should be fine.

The fix will be included in V2.2.6.

Stefan
  212   Mon Feb 10 23:36:31 2003 Entry eric wootenwootene@verizon.netBug report  Find
When you do a find in elog, records per page (some crazy large number - for 
your forum logbook, display 57 entries seem to cause the problem, then 
select last year (1 years worth of logs),(don't select printable)

the results appear way off the screen (the message body looks fine, but the 
title, etc extend way off the screen).

Printable doesn't have this problem.
ELOG V3.1.5-3fb85fa6