Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 700 of 808  Not logged in ELOG logo
icon4.gif   segfault on empty, non-writable passwd file, posted by Achim Dreyer on Mon Mar 26 13:44:23 2012 

 

Segfault when password file is empty and not writable a segmentation fault is generated when a new user tries to register:

 

root#  > passwd

root#  chown root.root passwd

root#  chmod 644 passwd

root#  grep -i usr elogd.cfg

root#


kernel: [515323.672377] elogd[31048]: segfault at 78 ip 00000000004ba780 sp 00007fff03cd2078 error 4 in elogd[400000+dc000]
 

I cannot reproduce this error when running within gdb.

 

icon5.gif   Preset Text?, posted by Grant on Mon Apr 9 15:02:24 2012 
Hi Stefan,

I'm having a problem with 'Preset Text' now behaving differently in the latest release (2.9.1)?
My config file for example has always had: 'Preset Text = This is a test.', previously 'This is a test' was put
verbatim into the text area, now it seems to think whatever follows 'Preset Text =' is always a file and I end
up with 'File <i> This is a test. <i> cannot be found'?

I did notice a 'Print warning if "preset text" file cannot be found' line in the latest release notes, does this
now mean wherever I have used the method above I will now need to make a text file to match?

I'm using them embedded in conditional attributes if that makes any difference?

Thanks for your help.
icon4.gif   wrong version number in spec file, posted by Achim Dreyer on Mon Apr 9 19:58:51 2012 

localhost$ svn diff elog.spec

Index: elog.spec
===================================================================
--- elog.spec (revision 2446)
+++ elog.spec (working copy)
@@ -2,7 +2,7 @@
 
 Name:       elog
 Summary:    elog is a standalone electronic web logbook
-Version:    2.8.1
+Version:    2.9.1
 Release:    1
 License:    GPL
 Group:      Applications/Networking
 
    icon2.gif   Re: Preset Text?, posted by Stefan Ritt on Tue Apr 10 10:08:33 2012 
> Hi Stefan,
> 
> I'm having a problem with 'Preset Text' now behaving differently in the latest release (2.9.1)?
> My config file for example has always had: 'Preset Text = This is a test.', previously 'This is a test' was put
> verbatim into the text area, now it seems to think whatever follows 'Preset Text =' is always a file and I end
> up with 'File <i> This is a test. <i> cannot be found'?
> 
> I did notice a 'Print warning if "preset text" file cannot be found' line in the latest release notes, does this
> now mean wherever I have used the method above I will now need to make a text file to match?
> 
> I'm using them embedded in conditional attributes if that makes any difference?
> 
> Thanks for your help.

Thanks for reporting this bug. I fixed it in SVN revision 2447.
    icon2.gif   Re: segfault on empty, non-writable passwd file, posted by Stefan Ritt on Tue Apr 10 15:35:07 2012 

Achim Dreyer wrote:

 

Segfault when password file is empty and not writable a segmentation fault is generated when a new user tries to register:

 

root#  > passwd

root#  chown root.root passwd

root#  chmod 644 passwd

root#  grep -i usr elogd.cfg

root#


kernel: [515323.672377] elogd[31048]: segfault at 78 ip 00000000004ba780 sp 00007fff03cd2078 error 4 in elogd[400000+dc000]
 

I cannot reproduce this error when running within gdb.

 

Thanks for reporting that bug. I fixed it in SVN revision 2448. 

icon4.gif   Forgot Password, posted by Christopher Lee on Mon Apr 16 11:10:07 2012 elogd.cfg

We seem to have a problem with retrieving user passwords using the forgot password system
This only happens when trying to use the password recovery from the first screen that forces people to log in with the following syntax:

Protect selection page = 1
Password file = XXXXX

On the first page of our elog which can be found at

http://physics.uj.ac.za/elog/

Now currently there is one page that is viewable by guests, so going to this direct link, bypasses the login at the main page
If you try login from this page, and then use the forgot password link, the email that gets sent through will then work.

The first email that gets sent through using the main login page has the following link:
https://physics.uj.ac.za/elog/?redir=%3Fcmd%3DChange+password%26oldpwd%3DYJAATGHSIRRSBLLP&uname=Tester&upassword=YJAATGHSIRRSBLLP

When clicking on the above link normally, it takes you to a NULL user

 

The email link that gets sent from the guest page, that works, looks like this:
https://physics.uj.ac.za/elog/General/?redir=%3Fcmd%3DChange+password%26oldpwd%3DSACWEHJWWHKEXLMO&uname=Tester&upassword=SACWEHJWWHKEXLMO

 

Attached is a copy of the cfg file. The last few logbooks are all actually just copies of TEMPLATE A, so I have removed all their details to make the file easier to read for now
 

    icon2.gif   Re: Forgot Password, posted by Stefan Ritt on Mon Apr 30 17:05:28 2012 

Christopher Lee wrote:

We seem to have a problem with retrieving user passwords using the forgot password system 

Thanks for reporting that bug. With the help of your config file I finally could reproduce and fix it. The fix is contained in SVN revision 2462.

    icon6.gif   Re: Forgot Password, posted by Christopher Lee on Tue May 1 09:20:00 2012 

Stefan Ritt wrote:

Christopher Lee wrote:

We seem to have a problem with retrieving user passwords using the forgot password system 

Thanks for reporting that bug. With the help of your config file I finally could reproduce and fix it. The fix is contained in SVN revision 2462.

 Thanks mate.. Glad to know it wasn't just me going insane? I'll keep an eye out for the new file

ELOG V3.1.5-3fb85fa6