Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 615 of 807  Not logged in ELOG logo
ID Date Icon Author Author Email Category OS ELOG Version Subject
  1611   Thu Jan 19 16:59:38 2006 Question Ulrich Trüsselulrich.truessel@familienhund.chQuestion 2.6.xsettings for "show only new entries"
how ca i set the date for the "show only new entries" button? maybe i missed somethin on the elog.cfg description?
thank's for hint! Smile
  1610   Thu Jan 19 15:23:02 2006 Reply Stefan Rittstefan.ritt@psi.chBug report 2.6.1Re: Access to global configuration in v2.6.1
> I just installed v.2.6.1 coming from the previous 2.6.0 (on Win2000)
> When I access the "configuration" function from a logbook, in the cfg page I only see two buttons in the header
> (save or cancel); in the previous version I saw more buttons there ("global config", "create new logbook" and so
> on), so here I'm unable to access global configuration or logbook management (except for current logbook options).

I tried to reproduce your problem, but could not. In my windows installation it looks fine. You only see the
(save and cancel) buttons only if you go to "Change [global]", otherwise you see the "Change [global]", "Delete
this logbook" etc. buttons. Have you tried with the default elogd.cfg which comes from the distribution?
  1609   Thu Jan 19 15:02:38 2006 Question Giorgio Croci Candianig.crocic@libero.itBug report 2.6.1Access to global configuration in v2.6.1
Hi,
I just installed v.2.6.1 coming from the previous 2.6.0 (on Win2000)
When I access the "configuration" function from a logbook, in the cfg page I only see two buttons in the header
(save or cancel); in the previous version I saw more buttons there ("global config", "create new logbook" and so
on), so here I'm unable to access global configuration or logbook management (except for current logbook options).
I am logged in as admin (actually I have a single-user configuration, thus no particular users defined).
I hope this report may be helpful, and not just being caused by a misunderstanding on my side ;)
Thanks
GiorgioCC
  1608   Thu Jan 19 10:31:05 2006 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2.6Re: Buffer Overflow?

Chris Warner wrote:
Users can access root level directories by using a modified URL. I saw on some security web sites that this was a problem in previous versions. Was it not fixed in 2.6?

To recreate enter http://yourhost.yourdomain.com/../../../../etc/passwd

view your password file in the browser.

If this was previously reported, is there a fix?

Chris Warner


Thanks for telling me, I didn't know. I was able to reproduce your problem under certain conditions, and I just released version 2.6.1 to fix it. However it has nothing to do with an old buffer overflow (see elog:941).

I would strongly advise everybody to upgrade as soon as possible.
  1607   Wed Jan 18 17:20:45 2006 Warning Chris Warnerchristopher_warner@dcd.uscourts.govBug reportLinux2.6Buffer Overflow?
Users can access root level directories by using a modified URL. I saw on some security web sites that this was a problem in previous versions. Was it not fixed in 2.6?

To recreate enter http://yourhost.yourdomain.com/../../../../etc/passwd

view your password file in the browser.


If this was previously reported, is there a fix?

Chris Warner
  1606   Wed Jan 18 13:31:32 2006 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux2.6.0Re: Problems with ELOG and Internet Explorer
Have you tried another browser, like Firefox? Do you have the same problems with Firefox? Can you try the following:

Start elogd manually with the "-v" flag, like
elogd -c <your config path> -v -p 8080
and watch the output carefully. When you submit an entry, elogd does redirection. You will see that in the HTTP header you have an entry like
...
Location: https://...
...
This location is taken from the URL statement of your config file. If it's wrong (like if you mixed http:// and https://), your browser will try to load the page from a non-existion location.
  1605   Wed Jan 18 13:06:50 2006 Reply Stefan Rittstefan.ritt@psi.chBug report 2.6.0Re: Attribute substitution in email configuration

Adam Blandford wrote:
Not sure if this functionality is intended or is a bug.


It was not implemented, however you call this Wink

I added that in the current SVN version, so it will be contained in the next release.
  1604   Wed Jan 18 12:57:30 2006 Reply Stefan Rittstefan.ritt@psi.chBug report  Re: In version 2.6 the themes do not work right on Windows.

Quote:
The URL is fixed at whichever logbook that is selected (e.g. ELOG 2.5.9-4 is <link rel="stylesheet" type="text/css" href="default.css"> & ELOG 2.6.0-1 is <link rel="stylesheet" type="text/css" href="http://localhost:8080/demo/default.css">).


So what is your problem? Can't you access http://localhost:8080/demo/default.css ?

If so, you could use an
URL = http://{your host}:8080/

option in your config file, where you replace {your host} with your real host name.
ELOG V3.1.5-3fb85fa6