Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 716 of 796  Not logged in ELOG logo
ID Date Iconup Author Author Email Category OS ELOG Version Subject
  69374   Sun Jun 20 14:38:06 2021 Reply Christian Ospelkauschristian.ospelkaus@iqo.uni-hannover.deQuestionAll3.1.3Re: when using webserver authentication, how can I restrict the users that can edit any given elog?

Dear all,

I figured it out. Current global config is (using kerberos instead)

[global]
port = 8081
Default encoding = 0
SSL = 0
Authentication = Kerberos
URL = https://my_url_here/
interface = 127.0.0.1
Password file = global.pwd
SMTP host = my_mail_host
Logfile = /var/log/elog.log
Logging level = 3
User = elog
Grp = elog

Best,

Christian

 

 

Christian Ospelkaus wrote:

Dear elog users & developers,

the subject line says it all: when using webserver authentication, how is it possible to restict access of users to any given elog? Only using the apche rules? Admin user and Login user do not seem to be doing anything for me. I am using elog as packaged by debian for buster, using an apache ssl proxy. Thank you for providing this software,

Christian

 

  69376   Wed Jun 23 14:08:15 2021 Reply Maximmaxsimuus69@gmail.comQuestionWindows3.1.4-3Re: Problem with a self-compiled code.

Good afternoon Sebastian!
Thank you very much for your help.

Sebastian Schenk wrote:

Hello Maxim,

I just stumbled on a similar issue. Also with a self-compiled elogd on Ubuntu.

We also use a custom css and by clicking on the "New" or "Reply" or "Duplicate" the elog generates the entry editor.
On the first load of this page the link to the css file is sometimes corrupted by having some garbage characters in it.
<link rel="stylesheet" type="text/css" href="ƒŒüthemes/name.css">

I found the bug in the code and made a PR on the bitbucket. Here is the commit to fix it yourself.
https://bitbucket.org/merrx/elog/commits/cea193ded7161bb6d1f67725ca109d2d4341128a

Best wishes,
Sebastian

Maxim wrote:

Dear, sir! There is a problem with a configuration file.

The code was compiled by Cygwin (gcc-core, gcc-g++, make, gdb, libssl-dev).  After a compilation a reference to our own css-file was written in configuration file and css-file was included in a folder “themes/default” of the project.

The problem is that in running elog-3.1.4-1 (and upper versions) css-file name in a code of a page has some random symbols before file-name, for example: <link rel="stylesheet" type="text/css" href="ø9öÿeLogOUK.css">. It was found that the problem is resolved if a string “Password file=passwd” is deleted, but in this case it is impossible to set passwords to the users.

Here is an example of configuration file which is taken from the forum and just one string (CSS=elogOUK.css) has added to the code

____________________________________________________________________

What can be done to resolve this problem?

 

 

  69378   Mon Jun 28 14:53:44 2021 Reply Sebastian Schenksebastian.schenk@physik.uni-halle.deQuestionLinux3.13Re: Drop attachments here...

I can't confirm this behavoiur. In our instance, every user can use the attachment function of the elog.
Either through "Drag&Drop" or "Browse&Upload" in the entry editor.

What do you mean by "root" user?
The elog can have serveral admin users, but this behaviour is equal for admin and non-admin users.
You should not run the elog server as user "root" of the machine for security reason, but also for issues with file permissions.

Xuan Wu wrote:

The function of "Drop attachments here..." is only for root user? I'd like it could be used by all users.

 

  69379   Mon Jun 28 18:41:31 2021 Reply Xuan Wuwux@ihep.ac.cnQuestionLinux3.13Re: Drop attachments here...

I just used my own account to test the "Drag&Drop" function in this forum ,  and it failed.  In our case, we need to upload ten more images into logbook at once, it's more effective to use "Drag&Drop" than "Browse&Upload" feature for "Browse&Upload" only can choose one attachment at once, but "Drag&Drop" can choose several attachments at once. The admin user can use this feature, but non-admin user not in our site. I did run the elog server as  user "root". I'm not sure it is related to the problem.

Sebastian Schenk wrote:

I can't confirm this behavoiur. In our instance, every user can use the attachment function of the elog.
Either through "Drag&Drop" or "Browse&Upload" in the entry editor.

What do you mean by "root" user?
The elog can have serveral admin users, but this behaviour is equal for admin and non-admin users.
You should not run the elog server as user "root" of the machine for security reason, but also for issues with file permissions.

Xuan Wu wrote:

The function of "Drop attachments here..." is only for root user? I'd like it could be used by all users.

 

 

  69380   Tue Jun 29 15:21:06 2021 Reply Sebastian Schenksebastian.schenk@physik.uni-halle.deQuestionLinux3.13Re: Drop attachments here...

In my testings I didn't found this behaviour, but my collegues also reported this issue.
So I searched for the difference between my test setup and the production logbooks.

I believe the "restrict edit = 1" config option may be responsible for this behaviour.
I had the browser console running in the background and "Drag&Drop" send an XHR request,
which failed with the message: "Only user can edit this entry".
This message is tied to the "restrict edit" option as far as I know.
So I tried removing the option and upload via "Drag&Drop" started to work as intended.
This behaviour only occurs for non-admin users, as admin users are not affected by

Can you verify this?
I can verify to get the same error message in this elog forum in the browser console.

Xuan Wu wrote:

I just used my own account to test the "Drag&Drop" function in this forum ,  and it failed.  In our case, we need to upload ten more images into logbook at once, it's more effective to use "Drag&Drop" than "Browse&Upload" feature for "Browse&Upload" only can choose one attachment at once, but "Drag&Drop" can choose several attachments at once. The admin user can use this feature, but non-admin user not in our site. I did run the elog server as  user "root". I'm not sure it is related to the problem.

Sebastian Schenk wrote:

I can't confirm this behavoiur. In our instance, every user can use the attachment function of the elog.
Either through "Drag&Drop" or "Browse&Upload" in the entry editor.

What do you mean by "root" user?
The elog can have serveral admin users, but this behaviour is equal for admin and non-admin users.
You should not run the elog server as user "root" of the machine for security reason, but also for issues with file permissions.

Xuan Wu wrote:

The function of "Drop attachments here..." is only for root user? I'd like it could be used by all users.

 

 

 

  69381   Tue Jun 29 20:13:36 2021 Reply Sebastian Schenksebastian.schenk@physik.uni-halle.deQuestionLinux3.13Re: Drop attachments here...

I could figure out the bug. A fix can be found in this commit.
https://bitbucket.org/merrx/elog/commits/c3e3c4af9666006558aaf26d8f4841800e69f9af

Sebastian Schenk wrote:

In my testings I didn't found this behaviour, but my collegues also reported this issue.
So I searched for the difference between my test setup and the production logbooks.

I believe the "restrict edit = 1" config option may be responsible for this behaviour.
I had the browser console running in the background and "Drag&Drop" send an XHR request,
which failed with the message: "Only user can edit this entry".
This message is tied to the "restrict edit" option as far as I know.
So I tried removing the option and upload via "Drag&Drop" started to work as intended.
This behaviour only occurs for non-admin users, as admin users are not affected by

Can you verify this?
I can verify to get the same error message in this elog forum in the browser console.

Xuan Wu wrote:

I just used my own account to test the "Drag&Drop" function in this forum ,  and it failed.  In our case, we need to upload ten more images into logbook at once, it's more effective to use "Drag&Drop" than "Browse&Upload" feature for "Browse&Upload" only can choose one attachment at once, but "Drag&Drop" can choose several attachments at once. The admin user can use this feature, but non-admin user not in our site. I did run the elog server as  user "root". I'm not sure it is related to the problem.

Sebastian Schenk wrote:

I can't confirm this behavoiur. In our instance, every user can use the attachment function of the elog.
Either through "Drag&Drop" or "Browse&Upload" in the entry editor.

What do you mean by "root" user?
The elog can have serveral admin users, but this behaviour is equal for admin and non-admin users.
You should not run the elog server as user "root" of the machine for security reason, but also for issues with file permissions.

Xuan Wu wrote:

The function of "Drop attachments here..." is only for root user? I'd like it could be used by all users.

 

 

 

 

  69382   Tue Jun 29 20:20:38 2021 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux3.13Re: Drop attachments here...

Looks good, I merged the pull request.

  69383   Wed Jun 30 04:38:21 2021 Reply Xuan Wuwux@ihep.ac.cnQuestionLinux3.13Re: Drop attachments here...

Excellent, Thanks!

Sebastian Schenk wrote:

I could figure out the bug. A fix can be found in this commit.
https://bitbucket.org/merrx/elog/commits/c3e3c4af9666006558aaf26d8f4841800e69f9af

Sebastian Schenk wrote:

In my testings I didn't found this behaviour, but my collegues also reported this issue.
So I searched for the difference between my test setup and the production logbooks.

I believe the "restrict edit = 1" config option may be responsible for this behaviour.
I had the browser console running in the background and "Drag&Drop" send an XHR request,
which failed with the message: "Only user can edit this entry".
This message is tied to the "restrict edit" option as far as I know.
So I tried removing the option and upload via "Drag&Drop" started to work as intended.
This behaviour only occurs for non-admin users, as admin users are not affected by

Can you verify this?
I can verify to get the same error message in this elog forum in the browser console.

Xuan Wu wrote:

I just used my own account to test the "Drag&Drop" function in this forum ,  and it failed.  In our case, we need to upload ten more images into logbook at once, it's more effective to use "Drag&Drop" than "Browse&Upload" feature for "Browse&Upload" only can choose one attachment at once, but "Drag&Drop" can choose several attachments at once. The admin user can use this feature, but non-admin user not in our site. I did run the elog server as  user "root". I'm not sure it is related to the problem.

Sebastian Schenk wrote:

I can't confirm this behavoiur. In our instance, every user can use the attachment function of the elog.
Either through "Drag&Drop" or "Browse&Upload" in the entry editor.

What do you mean by "root" user?
The elog can have serveral admin users, but this behaviour is equal for admin and non-admin users.
You should not run the elog server as user "root" of the machine for security reason, but also for issues with file permissions.

Xuan Wu wrote:

The function of "Drop attachments here..." is only for root user? I'd like it could be used by all users.

 

 

 

 

 

ELOG V3.1.5-2eba886