Public/elog
1
0
Fork 0
mirror of https://gitea.psi.ch/ELOG/elog.git synced 2026-09-10 18:23:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Implemented "Admin restrict edit time"

Browse Source
This commit is contained in:
Stefan Ritt 2019-11-19 14:03:37 +01:00
parent b7ee024ffb
commit ab8b98c790
2 changed files with 163 additions and 76 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

174
doc/config.html
View File

@ -16,11 +16,13 @@
<body bgcolor="white" text="black" link="blue" vlink="purple" alink="red"> <body bgcolor="white" text="black" link="blue" vlink="purple" alink="red">
<div class="title"> <div class="title">
ELOG - Syntax of elogd.cfg ELOG - Syntax of elogd.cfg
</div><br> </div>
<br>
<div class="menu"> <div class="menu">
[<a class="nav" href="adminguide.html">back to Administrator's [<a class="nav" href="adminguide.html">back to Administrator's
Guide</a>] Guide</a>]
</div><br> </div>
<br>
<div class="menu"> <div class="menu">
* Server : [<a class="nav" href="#global">Global</a>] - Logbooks : * Server : [<a class="nav" href="#global">Global</a>] - Logbooks :
[<a class="nav" href="#general">General</a>] [<a class="nav" href= [<a class="nav" href="#general">General</a>] [<a class="nav" href=
@ -31,7 +33,8 @@
Control</a>] [<a class="nav" href="#flags">Flags</a>] [<a class="nav" Control</a>] [<a class="nav" href="#flags">Flags</a>] [<a class="nav"
href="#themes">Themes</a>] [<a class="nav" href= href="#themes">Themes</a>] [<a class="nav" href=
"#mirroring">Mirroring</a>] * "#mirroring">Mirroring</a>] *
</div><br> </div>
<br>
<div class="Sub"> <div class="Sub">
<i>Global and individual logbook options for an ELOG server</i> <i>Global and individual logbook options for an ELOG server</i>
</div> </div>
@ -106,7 +109,7 @@ Use Mail Subject = Location
Turn on Secure Socket Layer transport. If SSL is on, one can connect Turn on Secure Socket Layer transport. If SSL is on, one can connect
via <code><b>https://...</b></code> to the elogd daemon. If the via <code><b>https://...</b></code> to the elogd daemon. If the
<code><b>URL =</b></code> directive is used, make sure to use <code><b>URL =</b></code> directive is used, make sure to use
<code><b>https://...</code></b> instead of <code><b>http://...</code></b> <code><b>https://...</b></code> instead of <code><b>http://...</b></code>
there. The ELOG distribution contains a simple self-signed certificate there. The ELOG distribution contains a simple self-signed certificate
in the <code><b>ssl</b></code> subdirectory. One can replace this in the <code><b>ssl</b></code> subdirectory. One can replace this
certificate and key with a real ceritficate to avoid browser pop-up certificate and key with a real ceritficate to avoid browser pop-up
@ -199,7 +202,8 @@ Use Mail Subject = Location
<br> <br>
<pre> <pre>
Welcome title = &lt;img src="welcome.jpg"&gt;&lt;p&gt;&lt;font size=5 color=white&gt;Welcome to our Elog&lt;/font&gt; Welcome title = &lt;img src="welcome.jpg"&gt;&lt;p&gt;&lt;font size=5 color=white&gt;Welcome to our Elog&lt;/font&gt;
</pre><br> </pre>
<br>
This displays an image and a text below. This displays an image and a text below.
</li> </li>
<li> <li>
@ -272,7 +276,7 @@ Welcome title = &lt;img src="welcome.jpg"&gt;&lt;p&gt;&lt;font size=5 color=whit
<code><b>-t</b></code> switch when starting elogd. This is necessary <code><b>-t</b></code> switch when starting elogd. This is necessary
since the password is encrypted. To set your SMPT password, enter on since the password is encrypted. To set your SMPT password, enter on
the command line: the command line:
<pre> <pre>
elogd -t &lt;your password&gt; elogd -t &lt;your password&gt;
</pre> </pre>
</li> </li>
@ -432,7 +436,8 @@ Group Windows PCs = 98, ME, NT, XP, CE
Group CE = 1.0, 2.0 Group CE = 1.0, 2.0
</pre> </pre>
</li> </li>
</ul>The logbook tabs would then look like this: </ul>
The logbook tabs would then look like this:
<p> <p>
<img src="tabs.gif"> <img src="tabs.gif">
</p> </p>
@ -476,7 +481,8 @@ Password file = admin.pwd
Admin user = bill Admin user = bill
</pre> </pre>
</li> </li>
</ul>Note that there can be a <b><code>[global]</code></b> section for each </ul>
Note that there can be a <b><code>[global]</code></b> section for each
top level group of logbooks. The rule is that a configuration setting in an top level group of logbooks. The rule is that a configuration setting in an
individual logbook section overrides a setting in the <b><code>[global individual logbook section overrides a setting in the <b><code>[global
&lt;top group&gt;]</code></b> setting, which by itsel overrides a setting &lt;top group&gt;]</code></b> setting, which by itsel overrides a setting
@ -566,7 +572,8 @@ not wanted, it can be disabled by setting <code><b>Show top groups =
<i>elog.css</i>. If different CSS'es should be used <i>elog.css</i>. If different CSS'es should be used
for different output media, this can be accomplished with a comma- for different output media, this can be accomplished with a comma-
separated list in the form separated list in the form
<code><b>CSS = &lt;file1&gt;&amp;&lt;media1&gt;,&lt;file2&gt;&amp;&lt;media2&gt;</b></code>. This will then be translated into separate style sheet <code><b>CSS = &lt;file1&gt;&amp;&lt;media1&gt;,&lt;file2&gt;&amp;&lt;media2&gt;</b></code>. This will then be
translated into separate style sheet
statements for the different media. For example a statement statements for the different media. For example a statement
<code><b>CSS = default.css&amp;screen,print.css&amp;print</b></code> <code><b>CSS = default.css&amp;screen,print.css&amp;print</b></code>
@ -617,7 +624,7 @@ not wanted, it can be disabled by setting <code><b>Show top groups =
<b><code>Date format = &lt;string&gt;</code></b><br> <b><code>Date format = &lt;string&gt;</code></b><br>
This option determines how the date is displayed from attributes which This option determines how the date is displayed from attributes which
are of type "date". The format of the string is the same as the C are of type "date". The format of the string is the same as the C
function <a href="strftime">strftime</a>, so a string of <b>%A, %B %d, function <a href="strftime.txt">strftime</a>, so a string of <b>%A, %B %d,
%Y</b> yields in a display of <b>Thursday, November 15, 2001</b> for %Y</b> yields in a display of <b>Thursday, November 15, 2001</b> for
example. example.
</li> </li>
@ -639,7 +646,8 @@ not wanted, it can be disabled by setting <code><b>Show top groups =
&lt;li&gt;&lt;a href="?cmd=new"&gt;Enter&lt;/a&gt; a new message &lt;li&gt;&lt;a href="?cmd=new"&gt;Enter&lt;/a&gt; a new message
&lt;li&gt;&lt;a href="?cmd=find"&gt;Search&lt;/a&gt; the logbook &lt;li&gt;&lt;a href="?cmd=find"&gt;Search&lt;/a&gt; the logbook
&lt;/ul&gt; &lt;/ul&gt;
</pre>The file must be present in the resource directory. Alternatively, an </pre>
The file must be present in the resource directory. Alternatively, an
absolute path can be used if the file name starts with a absolute path can be used if the file name starts with a
<b><code>"/"</code></b> (Unix) or <b><code>"\"</code></b> or <b><code>"/"</code></b> (Unix) or <b><code>"\"</code></b> or
<b><code>"x:"</code></b> (Windows). <b><code>"x:"</code></b> (Windows).
@ -652,7 +660,8 @@ not wanted, it can be disabled by setting <code><b>Show top groups =
<b><code>?cmd=xxx</code></b>. To start with the search page, one uses <b><code>?cmd=xxx</code></b>. To start with the search page, one uses
<pre> <pre>
Start page = ?cmd=Find Start page = ?cmd=Find
</pre>Please note that if another language than English is selected via the <b> </pre>
Please note that if another language than English is selected via the <b>
Language = xxx</b> option, the commands have to be in that language as Language = xxx</b> option, the commands have to be in that language as
well (like <i>"Start page = 0?cmd=Letzter"</i> for German). well (like <i>"Start page = 0?cmd=Letzter"</i> for German).
</li> </li>
@ -664,7 +673,8 @@ Start page = ?cmd=Find
&lt;h1&gt;You successfully submitted a message&lt;/h1&gt; &lt;h1&gt;You successfully submitted a message&lt;/h1&gt;
&lt;a href="?cmd=Back"&gt;Back&lt;/a&gt; to the logbook&lt;p&gt; &lt;a href="?cmd=Back"&gt;Back&lt;/a&gt; to the logbook&lt;p&gt;
&lt;a href="?cmd=New"&gt;Enter&lt;/a&gt; another message &lt;a href="?cmd=New"&gt;Enter&lt;/a&gt; another message
</pre>The file must be present in the logbook directory. Alternatively, an </pre>
The file must be present in the logbook directory. Alternatively, an
absolute path can be used if the file name starts with a absolute path can be used if the file name starts with a
<b><code>"/"</code></b> (Unix) or <b><code>"\"</code></b> or <b><code>"/"</code></b> (Unix) or <b><code>"\"</code></b> or
<b><code>"x:"</code></b> (Windows). <b><code>"x:"</code></b> (Windows).
@ -749,7 +759,8 @@ Start page = ?cmd=Find
<li> <li>
<b>Help</b> - General help <b>Help</b> - General help
</li> </li>
</ul><br> </ul>
<br>
<br> <br>
The commands are always in English, independent of the The commands are always in English, independent of the
<code><b>language = ...</b></code> setting, and are automatically <code><b>language = ...</b></code> setting, and are automatically
@ -758,7 +769,8 @@ Start page = ?cmd=Find
If this option is not present, following default is used:<br> If this option is not present, following default is used:<br>
<pre> <pre>
Menu commands = List, New, Edit, Delete, Reply, Duplicate, Find, Config, Help Menu commands = List, New, Edit, Delete, Reply, Duplicate, Find, Config, Help
</pre><br> </pre>
<br>
</li> </li>
<li> <li>
<b><code>Copy to = &lt;logbook list&gt;</code></b> <b><code>Copy to = &lt;logbook list&gt;</code></b>
@ -878,7 +890,8 @@ Guest menu commands = List, Find, Login, Help
selection page like: selection page like:
<pre> <pre>
&lt;center&gt;&lt;a href="/"&gt;Main page&lt;/a&gt;&lt;/center&gt; &lt;center&gt;&lt;a href="/"&gt;Main page&lt;/a&gt;&lt;/center&gt;
</pre>Or it can contain other useful links. If a file is specified, it must be </pre>
Or it can contain other useful links. If a file is specified, it must be
present in the logbook directory. Alternatively, an absolute path can be used present in the logbook directory. Alternatively, an absolute path can be used
if the file name starts with a <b><code>"/"</code></b> (Unix) or <b><code> if the file name starts with a <b><code>"/"</code></b> (Unix) or <b><code>
"\"</code></b> or <b><code>"x:"</code></b> (Windows). "\"</code></b> or <b><code>"x:"</code></b> (Windows).
@ -942,6 +955,13 @@ Guest menu commands = List, Find, Login, Help
ensure that old entries cannot be modified. Hours can also be ensure that old entries cannot be modified. Hours can also be
fractional, like 0.5 for 30 min. fractional, like 0.5 for 30 min.
</li> </li>
<li>
<b><code>Admin restrict edit time = &lt;hours&gt;</code></b><br>
Same option for admin users. This can be useful if normal users are
not allowed to change entries after "restrict edit time", but an admin
user should be allowed to do so. Setting this to zero disables any
restriction for admin users and they can edit entries forever.
</li>
<li> <li>
<b><code>Max content length = &lt;bytes&gt;</code></b><br> <b><code>Max content length = &lt;bytes&gt;</code></b><br>
This option restricts the size of attachments. When very large This option restricts the size of attachments. When very large
@ -994,10 +1014,12 @@ Guest menu commands = List, Find, Login, Help
with the original image size, and can then be resized and rotated with the original image size, and can then be resized and rotated
interactively with the image manipulation buttons:<p> interactively with the image manipulation buttons:<p>
<img src="thumbnail.png"><p> <img src="thumbnail.png">
<p>
Setting <b><code>Thumbnail size = 0</code></b> turns off the thumbnail Setting <b><code>Thumbnail size = 0</code></b> turns off the thumbnail
creation.<p> creation.
<p>
</li> </li>
<li> <li>
<b><code>Thumbnail options = &lt;options&gt;</code></b><br> <b><code>Thumbnail options = &lt;options&gt;</code></b><br>
@ -1006,7 +1028,8 @@ Guest menu commands = List, Find, Login, Help
used is the <b>-density</b> option to increase the image quality when used is the <b>-density</b> option to increase the image quality when
converting from PDF or EPS files.<p> converting from PDF or EPS files.<p>
</li> </li>
</ul><a name="attrib" id="attrib"></a> </ul>
<a name="attrib" id="attrib"></a>
<hr> <hr>
<div class="section"> <div class="section">
Attributes Attributes
@ -1027,8 +1050,9 @@ Guest menu commands = List, Find, Login, Help
<li>Locked by <li>Locked by
<li>Attachment <li>Attachment
<li>Path <li>Path
</ul><p> </ul>
since these are used internally by elog. <p>
since these are used internally by elog.
</li> </li>
<li> <li>
<b><code>Options &lt;attribute&gt; = &lt;list&gt;</code></b><br> <b><code>Options &lt;attribute&gt; = &lt;list&gt;</code></b><br>
@ -1068,7 +1092,8 @@ Options town = San Francisco, "Paris, Texas", "Paris, France"
checked for an entry. The attribue value then becomes checked for an entry. The attribue value then becomes
<pre> <pre>
&lt;value1&gt; | &lt;value2&gt; | ... &lt;value1&gt; | &lt;value2&gt; | ...
</pre>In the "<i>find</i>" page only one of these values can be specified, </pre>
In the "<i>find</i>" page only one of these values can be specified,
which is then treated as a substring in the search filter. which is then treated as a substring in the search filter.
</li> </li>
<li> <li>
@ -1079,7 +1104,8 @@ Options town = San Francisco, "Paris, Texas", "Paris, France"
<pre> <pre>
Attributes = Author, Icon, Subject... Attributes = Author, Icon, Subject...
IOptions Icon = icon1.gif, icon2.gif, icon3.gif, ... IOptions Icon = icon1.gif, icon2.gif, icon3.gif, ...
</pre>New icons are welcome and should be sent back to the author to be </pre>
New icons are welcome and should be sent back to the author to be
incorporated in the next version. incorporated in the next version.
</li> </li>
<li> <li>
@ -1120,7 +1146,8 @@ IOptions Icon = icon1.gif, icon2.gif, icon3.gif, ...
login name for the author field like: login name for the author field like:
<pre> <pre>
Preset Author = $long_name Preset Author = $long_name
</pre>If the attribute should be locked at the Web submission, use the </pre>
If the attribute should be locked at the Web submission, use the
"<i>Locked Attributes = ...</i>" option. If a preset value is given for an "<i>Locked Attributes = ...</i>" option. If a preset value is given for an
attribute which has an options list, the preset value is selected in the drop attribute which has an options list, the preset value is selected in the drop
down box by default.<br> down box by default.<br>
@ -1247,13 +1274,15 @@ Preset on first reply Subject = Re: $Subject
<b><code>Delete</code></b> to display a column with a delete icon <b><code>Delete</code></b> to display a column with a delete icon
to directly delete and entry to directly delete and entry
</li> </li>
</ul><br> </ul>
<br>
The restriction to certain attributes can be helpful if many attributes The restriction to certain attributes can be helpful if many attributes
are defined in a logbook, which usually makes the table too big to fit are defined in a logbook, which usually makes the table too big to fit
in the browser. The default is<br> in the browser. The default is<br>
<pre> <pre>
List display = ID, Date, &lt;all attributs&gt; List display = ID, Date, &lt;all attributs&gt;
</pre>Which displays the message number, date, and all attributes. The display </pre>
Which displays the message number, date, and all attributes. The display
of the message body is controlled by the <b><code>Display mode</code></b> and of the message body is controlled by the <b><code>Display mode</code></b> and
<b><code>Summary lines</code></b> options. If a search goes over "all <b><code>Summary lines</code></b> options. If a search goes over "all
logbooks", an additional colums with the logbook name of each entry is added in logbooks", an additional colums with the logbook name of each entry is added in
@ -1293,7 +1322,8 @@ List display = ID, Date, &lt;all attributs&gt;
<li> <li>
<b>$message id</b>: The message ID <b>$message id</b>: The message ID
</li> </li>
</ul><br> </ul>
<br>
A typical example would be<br> A typical example would be<br>
<pre> <pre>
Thread display = $subject, posted by $author on $entry time Thread display = $subject, posted by $author on $entry time
@ -1327,7 +1357,8 @@ Thread display = $subject, posted by $author on $entry time
<li> <li>
<b>$message id</b>: The message ID <b>$message id</b>: The message ID
</li> </li>
</ul><br> </ul>
<br>
A typical example would be<br> A typical example would be<br>
<pre> <pre>
RSS Title = $subject, posted by $author on $entry time RSS Title = $subject, posted by $author on $entry time
@ -1387,12 +1418,14 @@ RSS Title = $subject, posted by $author on $entry time
<b>$shell(&lt;command&gt;)</b>: &lt;command&gt; gets passed to the <b>$shell(&lt;command&gt;)</b>: &lt;command&gt; gets passed to the
operating system shell and the result is taken for substitution. operating system shell and the result is taken for substitution.
</li> </li>
</ul><br> </ul>
<br>
Following example use this feature to add the remote host name to the Following example use this feature to add the remote host name to the
author:<br> author:<br>
<pre> <pre>
Subst Author = $author from $remote_host Subst Author = $author from $remote_host
</pre><br> </pre>
<br>
Following example substitutes an attribute with the contents of a Following example substitutes an attribute with the contents of a
file:<br> file:<br>
<pre> <pre>
@ -1407,19 +1440,22 @@ Subst Author = $author from $remote_host
statement statement
<pre> <pre>
Subst Number = XYZ-##### Subst Number = XYZ-#####
</pre>results in automatically created attributes <i>"Number"</i> of the form </pre>
results in automatically created attributes <i>"Number"</i> of the form
<pre> <pre>
XYZ-00001 XYZ-00001
XYZ-00002 XYZ-00002
XYZ-00003 XYZ-00003
</pre>and so on. In addition to the #'s one may specify format specifiers which </pre>
and so on. In addition to the #'s one may specify format specifiers which
are passed to the <a href="strftime.txt"> are passed to the <a href="strftime.txt">
strftime</a> function. This allows to create tags wich contain the strftime</a> function. This allows to create tags wich contain the
current year, month and so on. Once the date part of the attribute current year, month and so on. Once the date part of the attribute
changes, the index restarts from one. The statement changes, the index restarts from one. The statement
<pre> <pre>
Subst Number = XYZ-%Y-%b-### Subst Number = XYZ-%Y-%b-###
</pre>results in automatically created attributes <i>"Number"</i> of the form </pre>
results in automatically created attributes <i>"Number"</i> of the form
<pre> <pre>
XYZ-2005-Oct-001 XYZ-2005-Oct-001
XYZ-2005-Oct-002 XYZ-2005-Oct-002
@ -1595,8 +1631,8 @@ Style importance severe = background-color:red
</pre> </pre>
For possible formattings, please refer to some CSS documentation. You can For possible formattings, please refer to some CSS documentation. You can
change the colors, font styles and sizes. The style is then valid for the change the colors, font styles and sizes. The style is then valid for the
whole row of that entry.<br /> whole row of that entry.<br/>
<br /> <br/>
For empty attributes one can specify "", such as For empty attributes one can specify "", such as
<pre> <pre>
Style importance "" = background-color:red Style importance "" = background-color:red
@ -1626,12 +1662,14 @@ Cell Style Status Under Process = background-color:yellow
<br> <br>
<pre> <pre>
http://any.company.com/telbook.cgi?search=&lt;name&gt; http://any.company.com/telbook.cgi?search=&lt;name&gt;
</pre>where &lt;name&gt; has to be replaced by a search string. Now one can </pre>
where &lt;name&gt; has to be replaced by a search string. Now one can
construct an automatic telephonebook lookup with following options:<br> construct an automatic telephonebook lookup with following options:<br>
<pre> <pre>
Attributes = Name, Telephone, ... Attributes = Name, Telephone, ...
Display Telephone = &lt;a href="http://any.company.com/telbook.cgi?search=$Name"&gt;$Name's telephone number&lt;/a&gt; Display Telephone = &lt;a href="http://any.company.com/telbook.cgi?search=$Name"&gt;$Name's telephone number&lt;/a&gt;
</pre>The attribute <b><code>Telephone</code></b> is now automatically </pre>
The attribute <b><code>Telephone</code></b> is now automatically
constructed from the attribute <b><code>Name</code></b> and consists of a link constructed from the attribute <b><code>Name</code></b> and consists of a link
to the company's telephonebook. The advantage of this system is if the URL of to the company's telephonebook. The advantage of this system is if the URL of
the telephonebook changes one day, only one statement in the config file has to the telephonebook changes one day, only one statement in the config file has to
@ -1658,7 +1696,8 @@ Display Telephone = &lt;a href="http://any.company.com/telbook.cgi?search=$Name"
writes a notification into some file: writes a notification into some file:
<pre> <pre>
Execute new = echo "New message wiht ID $message id of type $type from $long_name on $remote_host" &gt;&gt; /tmp/elog.log Execute new = echo "New message wiht ID $message id of type $type from $long_name on $remote_host" &gt;&gt; /tmp/elog.log
</pre><br> </pre>
<br>
It should be noted that this feature can impose a security problem. If It should be noted that this feature can impose a security problem. If
someone can edit the elogd.cfg through the <b><code>Config</code></b> someone can edit the elogd.cfg through the <b><code>Config</code></b>
command of elogd, that person can put malicious code into elogd.cfg and command of elogd, that person can put malicious code into elogd.cfg and
@ -1687,7 +1726,8 @@ Execute new = echo "New message wiht ID $message id of type $type from $long_nam
ID display = TAG-$message id ID display = TAG-$message id
</pre> </pre>
</li> </li>
</ul>would display the entry ID as "TAG-1","TAG-2", ... and so on. </ul>
would display the entry ID as "TAG-1","TAG-2", ... and so on.
</li> </li>
<li> <li>
<b><code>Prepend on reply = &lt;string&gt;</code></b><br> <b><code>Prepend on reply = &lt;string&gt;</code></b><br>
@ -1723,7 +1763,8 @@ ID display = TAG-$message id
together with other attributes, since it is sorted as the primary together with other attributes, since it is sorted as the primary
key anyhow. key anyhow.
</li> </li>
</ul><a name="conditional" id="conditional"></a> </ul>
<a name="conditional" id="conditional"></a>
<hr> <hr>
<div class="section"> <div class="section">
Conditional attributes Conditional attributes
@ -2240,12 +2281,12 @@ Options Location = Main Building{a}, New Building{b}, Old Building{c}
<p> <p>
Beside the Kerberos authentication, elogd version 3.0 and higher can be configured to accept a authentication done Beside the Kerberos authentication, elogd version 3.0 and higher can be configured to accept a authentication done
by the webserver. by the webserver.
</p>
<ul> <ul>
<li> <li>
<b><code>Authentication = Webserver</code></b> <b><code>Authentication = Webserver</code></b>
</li> </li>
</ul> </ul>
</p>
<p> <p>
You can also combine it with other authentication methods as shown for Kerberos. You can also combine it with other authentication methods as shown for Kerberos.
</p> </p>
@ -2260,7 +2301,8 @@ Options Location = Main Building{a}, New Building{b}, Old Building{c}
</h2> </h2>
<p> <p>
LDAP (lightweight Directory Access Protocol) has been implemented by LDAP (lightweight Directory Access Protocol) has been implemented by
vykozlov in a separate branch at <a href="https://github.com/vykozlov/elog-ldap">https://github.com/vykozlov/elog-ldap</a>. The code has been merged into this distribution on vykozlov in a separate branch at <a href="https://github.com/vykozlov/elog-ldap">https://github.com/vykozlov/elog-ldap</a>.
The code has been merged into this distribution on
an as-is basis. Following info has copied from the link above:</p> an as-is basis. Following info has copied from the link above:</p>
<p> <p>
@ -2296,7 +2338,8 @@ Options Location = Main Building{a}, New Building{b}, Old Building{c}
PAM authentication PAM authentication
</h2> </h2>
<p> <p>
PAM (Pluggable authentication modules) support has been implemented by Jan Christoph Terasa as a separate branch at <a href="https://bitbucket.org/ritt/elog/branch/pam">https://bitbucket.org/ritt/elog/branch/pam</a>. PAM (Pluggable authentication modules) support has been implemented by Jan Christoph Terasa as a separate branch at
<a href="https://bitbucket.org/ritt/elog/branch/pam">https://bitbucket.org/ritt/elog/branch/pam</a>.
<p> <p>
To use PAM in elogd, do the following: To use PAM in elogd, do the following:
@ -2304,7 +2347,8 @@ PAM (Pluggable authentication modules) support has been implemented by Jan Chris
<ul> <ul>
<li> <li>
Compile <b><code>elogd</code></b> with PAM support, by either setting <b><code>USE_PAM = 1</code></b> in the <b><code>Makefile</code></b>, or by specifying it when invoking <b><code>make</code></b> Compile <b><code>elogd</code></b> with PAM support, by either setting <b><code>USE_PAM = 1</code></b> in the
<b><code>Makefile</code></b>, or by specifying it when invoking <b><code>make</code></b>
</li> </li>
<li> <li>
Enable PAM authentication in <b><code>elogd.cfg</code></b>: Enable PAM authentication in <b><code>elogd.cfg</code></b>:
@ -2313,16 +2357,25 @@ PAM (Pluggable authentication modules) support has been implemented by Jan Chris
<li><b><code>Password file = elogd.passwd</code></b></li> <li><b><code>Password file = elogd.passwd</code></b></li>
<li><b><code>Self register = 3</code></b></li> <li><b><code>Self register = 3</code></b></li>
</ul> </ul>
The <b><code>Password file</code></b> is used to store the user names and email addresses of PAM authenticated users, since this information can not be (universally) requested via PAM. For security reasons the password file does <b>not</b> store a hash of the user password. The <b><code>Password file</code></b> is used to store the user names and email addresses of PAM authenticated
users, since this information can not be (universally) requested via PAM. For security reasons the password file
does <b>not</b> store a hash of the user password.
Self registration has to be enabled (<b><code>Self register &ge; 1</code></b>) to use PAM authentication. Self registration has to be enabled (<b><code>Self register &ge; 1</code></b>) to use PAM authentication.
</li> </li>
<li> <li>
To be able to use PAM, the PAM module in <b><code>elogd</code></b> needs to be able to access the authentication facilities on the system (e.g. be able to read <code>/etc/shadow</code>). This can be achieved by either running <b><code>elogd</code></b> as <code>root</code>, or by specifying the appropriate SUID/GUID values for the binary.</br> To be able to use PAM, the PAM module in <b><code>elogd</code></b> needs to be able to access the authentication
<font color="red"><b>WARNING:</font> When running elogd as root, be careful when using the <code>-x</code> option to enable execution of commands via <code>$shell</code>, since the commands will be executed using the access rights of the user running <code>elogd</code>!</b> facilities on the system (e.g. be able to read <code>/etc/shadow</code>). This can be achieved by either running
<code><b>elogd</b></code> as <code>root</code>, or by specifying the appropriate SUID/GUID values for the
binary.</br>
<span style="color:red"><b>WARNING:</b></span> When running elogd as root, be careful when using the <code>-x</code> option
to enable execution of commands via <code>$shell</code>, since the commands will be executed using the access
rights of the user running <code>elogd</code>!</b>
</li>
</ul> </ul>
<p> <p>
Please note that it is not possible to change the PAM password within ELOG. Instead, please use the available methods on the system Please note that it is not possible to change the PAM password within ELOG. Instead, please use the available methods
on the system
</p> </p>
@ -2412,7 +2465,7 @@ PAM (Pluggable authentication modules) support has been implemented by Jan Chris
for the "<i>From:</i>" field in the email. Since more and more email for the "<i>From:</i>" field in the email. Since more and more email
servers do not accept invalid <i>"From:"</i> addresses in order to reduce servers do not accept invalid <i>"From:"</i> addresses in order to reduce
spam mail, it might be important that a "real" email address is used in spam mail, it might be important that a "real" email address is used in
the <i>"From:"</i> field. If <b><code>Use Email From</code></b> is the <i>"From:"</i> field. If <b><code>Use Email From</code></b> is
present, it is always used. If not, the email address of the currently present, it is always used. If not, the email address of the currently
logged in user is used for the <i>"From:"</i> field. If no user is logged logged in user is used for the <i>"From:"</i> field. If no user is logged
in, or the current user has not specified a email address in the password in, or the current user has not specified a email address in the password
@ -2442,7 +2495,7 @@ PAM (Pluggable authentication modules) support has been implemented by Jan Chris
</p> </p>
<p> <p>
The option <b><code>Use Email URL = &lt;URL&gt;</b></code> can be used to The option <code><b>Use Email URL = &lt;URL&gt;</b></code> can be used to
set the URL of the ELOG logbook used in email notifications. This can be set the URL of the ELOG logbook used in email notifications. This can be
useful if no <b><code>URL = ...</code></b> statement is used form some useful if no <b><code>URL = ...</code></b> statement is used form some
reason. reason.
@ -2542,7 +2595,7 @@ PAM (Pluggable authentication modules) support has been implemented by Jan Chris
</li> </li>
<li> <li>
<b><code>Allowed encoding = &lt;n&gt;</code></b><br> <b><code>Allowed encoding = &lt;n&gt;</code></b><br>
Allowed encoding options. <b><code>&lt;n&gt;</b></code> can be the sum of Allowed encoding options. <code><b>&lt;n&gt;</b></code> can be the sum of
following flags: following flags:
<ul> <ul>
<li>1 : Plain <li>1 : Plain
@ -2553,7 +2606,7 @@ PAM (Pluggable authentication modules) support has been implemented by Jan Chris
</li> </li>
</ul> </ul>
To allow plain and HTML encoding for example, set To allow plain and HTML encoding for example, set
<b><code>&lt;n&gt;</b></code> to 5. Default is <b>7</b>. Note that <code><b>&lt;n&gt;</b></code> to 5. Default is <b>7</b>. Note that
allowing HTML encoding may cause some security risk, since an elog allowing HTML encoding may cause some security risk, since an elog
entry may contain malicious scripting code. It should therefor only entry may contain malicious scripting code. It should therefor only
be allowed for installations where it is really needed and with no be allowed for installations where it is really needed and with no
@ -2625,7 +2678,8 @@ PAM (Pluggable authentication modules) support has been implemented by Jan Chris
</li> </li>
<li>64: Send names of optional attachments <li>64: Send names of optional attachments
</li> </li>
</ul>So to send for example only the attributes and the URL, set </ul>
So to send for example only the attributes and the URL, set
&lt;n&gt; to <b>6</b>. Default is <b>63</b> (send everything). &lt;n&gt; to <b>6</b>. Default is <b>63</b> (send everything).
</li> </li>
<li> <li>
@ -2640,7 +2694,8 @@ PAM (Pluggable authentication modules) support has been implemented by Jan Chris
</li> </li>
<li>4 : Full HTML page as shown in elog <li>4 : Full HTML page as shown in elog
</li> </li>
</ul>So to send email in plain text and full HTML, set &lt;n&gt; to </ul>
So to send email in plain text and full HTML, set &lt;n&gt; to
<b>5</b>. Some email clients have the possibility then to switch from <b>5</b>. Some email clients have the possibility then to switch from
one view to the other. Default is <b>2</b>. one view to the other. Default is <b>2</b>.
</li> </li>
@ -2704,7 +2759,8 @@ PAM (Pluggable authentication modules) support has been implemented by Jan Chris
<b>3</b>: Messages and replies are displayed together with the full <b>3</b>: Messages and replies are displayed together with the full
message body. message body.
</li> </li>
</ul>The default is <b>1</b>. </ul>
The default is <b>1</b>.
</li> </li>
<li> <li>
<b><code>Hidden = 0|1</code></b><br> <b><code>Hidden = 0|1</code></b><br>
@ -3076,7 +3132,8 @@ elogd -v -C http://master.your.domain
Once every hour from 7:00 to 18:00 from Monday to Friday Once every hour from 7:00 to 18:00 from Monday to Friday
</td> </td>
</tr> </tr>
</table><br> </table>
<br>
<br> <br>
Valid ranges for each value are:<br> Valid ranges for each value are:<br>
<br> <br>
@ -3121,7 +3178,8 @@ elogd -v -C http://master.your.domain
0-6 with 0=Sunday, 1=Monday, etc. 0-6 with 0=Sunday, 1=Monday, etc.
</td> </td>
</tr> </tr>
</table><br> </table>
<br>
<br> <br>
If mirroring is turned on, it is advisable to use the If mirroring is turned on, it is advisable to use the
<b><code>Logfile =</code></b> option to turn on logging, so that <b><code>Logfile =</code></b> option to turn on logging, so that

65
src/elogd.c
View File

@ -10026,16 +10026,31 @@ void show_edit_form(LOGBOOK * lbs, int message_id, BOOL breply, BOOL bedit, BOOL
} }
/* check for editing interval */ /* check for editing interval */
if (bedit && getcfg(lbs->name, "Restrict edit time", str, sizeof(str))) { if (is_admin_user(lbs, getparam("unm"))) {
for (i = 0; i < *lbs->n_el_index; i++) if (bedit && getcfg(lbs->name, "Admin Restrict edit time", str, sizeof(str))) {
if (lbs->el_index[i].message_id == message_id) for (i = 0; i < *lbs->n_el_index; i++)
break; if (lbs->el_index[i].message_id == message_id)
break;
if (i < *lbs->n_el_index && time(NULL) > lbs->el_index[i].file_time + atof(str) * 3600) { if (i < *lbs->n_el_index && time(NULL) > lbs->el_index[i].file_time + atof(str) * 3600 && atof(str) > 0) {
sprintf(str, loc("Entry can only be edited %1.2lg hours after creation"), atof(str)); sprintf(str, loc("Entry can only be edited %1.2lg hours after creation"), atof(str));
show_error(str); show_error(str);
xfree(text); xfree(text);
return; return;
}
}
} else {
if (bedit && getcfg(lbs->name, "Restrict edit time", str, sizeof(str))) {
for (i = 0; i < *lbs->n_el_index; i++)
if (lbs->el_index[i].message_id == message_id)
break;
if (i < *lbs->n_el_index && time(NULL) > lbs->el_index[i].file_time + atof(str) * 3600) {
sprintf(str, loc("Entry can only be edited %1.2lg hours after creation"), atof(str));
show_error(str);
xfree(text);
return;
}
} }
} }
@ -23113,15 +23128,29 @@ void submit_elog(LOGBOOK * lbs)
/* check for editing interval */ /* check for editing interval */
if (bedit && getcfg(lbs->name, "Restrict edit time", str, sizeof(str))) { if (is_admin_user(lbs, getparam("unm"))) {
for (i = 0; i < *lbs->n_el_index; i++) if (bedit && getcfg(lbs->name, "Admin Restrict edit time", str, sizeof(str))) {
if (lbs->el_index[i].message_id == atoi(getparam("edit_id"))) for (i = 0; i < *lbs->n_el_index; i++)
break; if (lbs->el_index[i].message_id == atoi(getparam("edit_id")))
break;
if (i < *lbs->n_el_index && time(NULL) > lbs->el_index[i].file_time + atof(str) * 3600) {
sprintf(str, loc("Entry can only be edited %1.2lg hours after creation"), atof(str)); if (i < *lbs->n_el_index && time(NULL) > lbs->el_index[i].file_time + atof(str) * 3600 && atof(str) > 0) {
show_error(str); sprintf(str, loc("Entry can only be edited %1.2lg hours after creation"), atof(str));
return; show_error(str);
return;
}
}
} else {
if (bedit && getcfg(lbs->name, "Restrict edit time", str, sizeof(str))) {
for (i = 0; i < *lbs->n_el_index; i++)
if (lbs->el_index[i].message_id == atoi(getparam("edit_id")))
break;
if (i < *lbs->n_el_index && time(NULL) > lbs->el_index[i].file_time + atof(str) * 3600) {
sprintf(str, loc("Entry can only be edited %1.2lg hours after creation"), atof(str));
show_error(str);
return;
}
} }
} }