ELOG Eletronic Web Logbook

File Release Notes and Changelog

Release Name: 2.5.7

Notes: Major security fix

---

Changes: - Fixed buffer overflow which was already exploited to obtain shell access - Fixed security bug which allowed to download a config file containing a write password without supplying this password first - Solved bug with 'fixed' ROptions attributes - Added missing 'alt' tags to images - Use admin user email in 'from' field if nothing else is availabe - 'Preset attribute' now also works with conditional attributes - Fixed wrong '%S' instead of '%s' in charset - Do not display .EPS files inline as ASCII files - Fixed problem with conditional attributes in French - Removed superfloous 'mailto:' in substitution - Added highlighting for search results in attributes - Fixed bug yielding in wrong search results - Implemented 'Mirror exclude' - Switched from GIF to PNG - Remove any CR/LF from attributes submitted from browser - Implemented OR'ing of MOptions values in find page - Display thread in single entry page if present - Implemented 'show attributes' - Made extendable attributes work with MOptions - Added message_id and date to CSV export - Made extendable attributes work with conditional attributes - Logbook hierarchy can now be deeper than two levels - Cancel button on 'create new logbook' now also works without password files - Fixed non-functioning Cancel button in 'create new logbook' - Changed date format to RFC-822 in RSS feed - Fixed endless loop with handcrafted POST header - Changed locale to 'C' for email header date - Use hostname from -n parameter for redirection if given - Fixed attribute substitutions in 'use email from' - Fixed problem with invalid RFC2822 date in email header for different locale - Implemented 'sort attribute' - Look for parameters first under conditions, then unconditional if not found - Fixed bug in XML export - Implemented USERLIST as attribute type - Increased NAME_LENGTH to 1500, requires a stack size of 4MB - Changed charset for RSS feeds - Fixed wrong link if last entry in logbook has been moved - Display ASCII attachments inline, with possibility to hide them - Implemented regular expressions in search - Implemented RSS feeds - Added synchronization from command line of elogd - Fixed ~20 bugs - Implemented cloning to set-up a mirror server - Fixed problem with 'preset text' under conditional attributes - Added JavaScript code onunload() if locking is used, to avoid stale locks - Made substituions work correctly with date attributes - Implemented deletion of logbooks through web interface - Implemented renaming of logbooks through web interface - Fixed email notification problem if URL does not contain a trailing '/' - Redirect login screen if URL does not match the one in the config file - Extract and use 'X-Forwarded-Host:' - Do a el_index_logbooks on HUP signal under Unix - Added $utcdate - Fixed problem of password change when using crypt() - Admin user has to supply own old password on password change - Omit 'preset text' on edit of entries - Added error display if max. number of attribute options gets exceeded - Implemented 'show top groups' flag - Fixed problem that admin user of top group could change global section - Added 'fix text' flag - Fixed problem with options list containing several quotation marks - Implemented synchronizing during cloning - Don't evaluate 'preset xxx' on replies - Implemented 'preset on reply' - Implemented 'tooltip <attribute>' - Use 'format <attrib> = 1' also in entry form - Implemented 'max content length' - Advanced message handling implemnted by Recai Oktas, usage of syslog under Unix and Event Log under Windows - Added size parameter to getcfg() to avoid buffer overflows - Fixed bugs with https:// in URL - Supply full path to elogd.cfg when running elogd as windows service - entry deletion during synchronization now uses confirmation - Fixed problem that attachments could not be deleted - Fixed wrong date on date attributes on edit/reply if attribute is fixed - Increased possible size of 'welcome title' to 10000 chars - Made p<attribute>=value work again - Fixed problem with {..} in attributes - Implemented favicon (little icon displayed next to bookmarks in Mozilla browser) - Several problems and bugs with quick filters fixed - Implemented "protect selection page" - Implemented text body CSV import - Changed redirection to absolute path (as defined in HTTP standard) - Allow ',', '.' and '-' in numeric format - Added <hr> and <br> to be recognized as HTML in attributes - Fixed stack overflow under Windows on resubmit of entry - Added NT/XP service functionality - Improved synchronization speed - Implemented 'display <attribute>' - Implemented XML encoding - Implemented CSV import and XML export - Implemented 'guest list display' - Implemented 'extendable options' for MOptions - Conditional attributes get evaluated correctly during editing of existing entries - Fixed crashing elogd in threaded display - Implemented option 'guest display' - Implemented OR's and AND's of several conditions - Change POST action to './' for OS-X IE - Strip HTML from title bar and summary display - Fixed bug with MOptions and conditional attributes - Implemented 'ID display' - Fixed bug with supressed email notification box and conditional attributes - Substitutions now also work with 'preset text' - Added Prepend/Append on Edit/Reply - Substitution of $message id and $entry time now works on all possible places - Allocate heap memory in display_line - Fixed bug with date attribute email notification - Fixed bug with top text - Added 'edit' and 'delete' to 'list display' - Added CSV import page - Show attribute values as HTML if the contain <a> or <img> in listing - Fixed bug with 'start page = 0?cmd=Last - Fixed bug in el_decode, added <label> to buttons - Expand substitutions with 'preset' and conditional attributes - Automatic hot links terminated with a '.' get correctly displayed - Made 'subst <attrib> = $<attrib>' work correctly - Removed javaEnabled() - Improved synchronization algorithm. Conflicting entries are properly copied if one of them got deleted - Made 'main tab' work with top level groups - Avoid last '\0' in flush_return_buffer() - Added CSV output - During synchronization, display link to received entries - Implemented calendar - Added entry counter - Added form validation via JavaScript - Do not renumber entries which are identical - Fixed bug with "find in all logbooks" under foreign languages - Fixed bug wiht "last submission" display - Change CRLF -> CR when saving elogd.cfg under Unix - Changed "entry date" to "entry time" - Changed "Date format" to "Time format" - Implemented "Type <attrib> = date" - Implemented search and quick filter facilities for date attributes - Added Japanese language support