tdiary-talk Mailing List for tDiary

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Hi,

eRuby Injection Vulnerability found in tDiary 2.0.3 and 2.1.4.20061126.
See below and fix your tDiary please.

   http://sourceforge.net/forum/forum.php?forum_id=642685

Regards,
TADA Tadashi

Hi,

XSS Vulnerability found in tDiary 2.0.2 and 2.1.4.
See below and fix your tDiary please.

  http://sourceforge.net/forum/forum.php?forum_id=638868

regards.

-- 
TADA Tadashi

Hi.

tDiary 2.1.3 (unstable) released.

   http://sourceforge.net/projects/tdiary/

--
TADA Tadashi

Hi,

I released tDiary 2.0.2(stable) and 2.1.2(unstable) now. This is a
SECURITY RELEASE. Please update your diary as soon as possible.

This security fix are against to CSRF attack. See 'CSRF protection' page
in configuration menu.

download from here:
   http://sourceforge.net/project/showfiles.php?group_id=47123

Regards,
TADA Tadashi

Le mer, 19/05/2004 à 03:03 +0900, zunda a écrit :
> Hi,
> 
> > Now check the new error on http://fredix.taonix.net/diary/ :
> > 
> > `load_cgi_conf': stack level too deep (SystemStackError)
> 
> We have finally reached errors in tDiary. It seems that your
>   @data_path
> in /var/www/home/fredix/diary/tdiary.conf points to the directory where the
> tdiary.conf
> itself is. You have to set @data_path somewhere else, preferably a path which is
> not
> exposed to the Internet (that is, not under DocumentRoot of apache or
> ~public_html).
> 
> You will also have to set permission or owner of the directory which @data_path
> points
> so that apache can write and read. tDiary will run as the same user which
> apache is running as. (In case you activate SuEXEC and you have your CGIs under
> ~/public_html, the process will be running as yourself.)
> 
> I hope this helps.

Ok it works, sorry for my stupid error !

Hi,

> Now check the new error on http://fredix.taonix.net/diary/ :
> 
> `load_cgi_conf': stack level too deep (SystemStackError)

We have finally reached errors in tDiary. It seems that your
  @data_path
in /var/www/home/fredix/diary/tdiary.conf points to the directory where the
tdiary.conf
itself is. You have to set @data_path somewhere else, preferably a path which is
not
exposed to the Internet (that is, not under DocumentRoot of apache or
~public_html).

You will also have to set permission or owner of the directory which @data_path
points
so that apache can write and read. tDiary will run as the same user which
apache is running as. (In case you activate SuEXEC and you have your CGIs under
~/public_html, the process will be running as yourself.)

I hope this helps.

Regards,
zunda

PS. Is there a document describing installation of tDiary in English? If not
someone
has to prepare one... At least, it might be a good idea to add English comments
in tdiary.conf.

__________________________________________________
Do You Yahoo!?
http://bb.yahoo.co.jp/

Le mar, 18/05/2004 à 13:14 +0900, Takuya YAMAGUCHI a écrit :
> Hi, 
> 
> > ruby: Permission denied -- /var/www/home/fredix/diary/index.rb
> > (LoadError)
> > [Mon May 17 19:13:19 2004] [error] [client 62.4.18.125] Premature end of
> > script headers: /var/www/home/fredix/diary/index.rb
> 
> Do you check permission of:
> index.rb executable?

armitage:/var/www/home/fredix/diary# ls -l
total 32
-rwx-----x    1 fred     fred           55 May 16 21:51 index.rb
-rwx-----x    1 fred     fred         9954 May 16 21:51 squeeze.rb
-rw-r--r--    1 fred     fred        10622 May 16 21:51 tdiary.conf
-rwx-----x    1 fred     fred           56 May 16 21:51 update.rb

and if i change permission of index.rb :
chmod 766 index.rb

-rwxr-xr-x    1 fred     fred           55 May 16 21:51 index.rb

Now check the new error on http://fredix.taonix.net/diary/ :

`load_cgi_conf': stack level too deep (SystemStackError)

> each path directory readable?

armitage:/var/www/home/fredix# ls -ld diary/
drwxr-xr-x    2 fred     fred           88 May 16 21:51 diary/

> Is suexec.log empty?

yes 

Hi, 

> ruby: Permission denied -- /var/www/home/fredix/diary/index.rb
> (LoadError)
> [Mon May 17 19:13:19 2004] [error] [client 62.4.18.125] Premature end of
> script headers: /var/www/home/fredix/diary/index.rb

Do you check permission of:
index.rb executable?
each path directory readable?

Is suexec.log empty?

Regards,

--
YAMAGUCHI Takuya(ta...@ya...)

Le lun, 17/05/2004 à 10:22 +0900, Takuya YAMAGUCHI a écrit :
> Hi, 
> 
> > Does somebody know where the error log
> > is on a debian?
> 
> See /var/log/apache/*.log.
> It's important to check suexec.log as well as error.log 
> using debian.

ruby: Permission denied -- /var/www/home/fredix/diary/index.rb
(LoadError)
[Mon May 17 19:13:19 2004] [error] [client 62.4.18.125] Premature end of
script headers: /var/www/home/fredix/diary/index.rb

Hi, 

> Does somebody know where the error log
> is on a debian?

See /var/log/apache/*.log.
It's important to check suexec.log as well as error.log 
using debian.

--
YAMAGUCHI Takuya(ta...@ya...)

Hi,

> I have installed tdiary 1.5.6 with a debian SID package. Like you see
> here http://fredix.taonix.net/diary/

I saw the 500 Internal Server Error. First thing you might want to check
is the error log of the www server. Does somebody know where the error log
is on a debian?

zunda

__________________________________________________
Do You Yahoo!?
http://bb.yahoo.co.jp/

Hi,

I have installed tdiary 1.5.6 with a debian SID package. Like you see
here http://fredix.taonix.net/diary/ i have some problem. Can somebody
help me ?
Thanks.

Hi,

We have just released tDiary 1.5.7. This release is release cadidate of
2.0. See release notes below.

Have fun!
tDiary Development Team

release note of core module -------------------------

* Filter
  * You can add filtering rule against TSUKKOMI and referer spam.

* Enpowered category
  * support category index. more information, more speed.

* Changed plugin selection feature
  * In multiple plugin path condition, it will use first finded plugin
    file when same files existed.

* some misc tools moved to contrib package.

* Updating plugin development features
  * update_proc was called in the last.
  * update_proc will work under secure mode always.
  * added Config#base_url method.

* fixed many bugs.

release note of plugin ------------------------

* referer_scheme.rb: new plugin, more feature for referer list.
* recent_trackback3.rb: new plugin, listing recent TrackBacks.
* trackback/bookmarklet.js: new plugin, a bookmarklet for sending TrackBack.
* edit.rb: removed. (included in core)
* amazon.rb: add some preferences.
* output_rdf.rb: can specify image.
* category.rb: support index and icons.
* tb-send.rb: Section specified TrackBack, TrackBack to some sites in one time.
* highlight.rb: support CSS, changing default color.

release note of theme -----------------

* new themes
  * bluely
  * gray2
  * old-pavement

release note of BlogKit -------------------

* whatsnew-list.rb: support preferences and generate good RDF.
* blog-style.rb: disable section TrackBack feature in tb-send.rb.

adulau, welcome and thank you for your new project!

1. Documents translation

Do you think to start translation with English documents? Now, Japanese
users are trying to translate Japanese documents to English, but not
competed. You can pick up some English documents here:

   http://tdiary-users.sourceforge.jp/cgi-bin/wiki.cgi?FrontPage_en

And we have official Wiki sites for tDiary documents.

   Japanese: http://docs.tdiary.org/ja/
   English:  http://docs.tdiary.org/en/

These sites have some documents about plugins and styles.

If you want to put French documents you translated to the Wiki, I can
make http://docs.tdiary.org/fr/. Then we will be able to coordinate
about translate project on the Wiki.

2. Other resources translation

tDiary 1.5.6 has i18n framework (see directories 'skel' and 'plugin/en').
If you want to run tDiary in French, these resources will have to be
translated.

--
TADA 'sho' Tadashi

Alexandre Dulaunoy <ad...@fo...> wrote:
>Hello All,
>
>I would like to know  what is the current procedure for translation[1]
>in the tdiary project ? Is there a specific way to do it (for example,
>like the GNU page on the subject[2] ? I would like to start the french
>translation of the README file.
>
>Thanks,
>
>Have a nice day,
>
>adulau
>
>[1] This is  not really translation because we  will have difficulties
>    to  find   people  with  Japanese  knowledge.  It   will  be  more
>    an adaptation of the technical documents.
>
>[2] http://www.gnu.org/server/translations/trans-coordinator.html
>-- 
>** Alexandre Dulaunoy (adulau) **** http://www.foo.be/ **** 0x44E6CBCD
>**/ "To  disable the  Internet to  save EMI  and Disney  is  the moral
>**/ equivalent of burning down the library of Alexandria to ensure the
>**/ livelihood of monastic scribes." Jon Ippolito.

Hello All,

I would like to know  what is the current procedure for translation[1]
in the tdiary project ? Is there a specific way to do it (for example,
like the GNU page on the subject[2] ? I would like to start the french
translation of the README file.

Thanks,

Have a nice day,

adulau

[1] This is  not really translation because we  will have difficulties
    to  find   people  with  Japanese  knowledge.  It   will  be  more
    an adaptation of the technical documents.

[2] http://www.gnu.org/server/translations/trans-coordinator.html
-- 
** Alexandre Dulaunoy (adulau) **** http://www.foo.be/ **** 0x44E6CBCD
**/ "To  disable the  Internet to  save EMI  and Disney  is  the moral
**/ equivalent of burning down the library of Alexandria to ensure the
**/ livelihood of monastic scribes." Jon Ippolito.

Hi,

This is zunda, who wrote weather.rb.

 --- Lazarus Long <la...@ov...> writes：
> On Wed, Dec 03, 2003 at 08:33:13PM +0000, Lazarus Long wrote:
>  > At long last, I seem to have configured weather.rb to be used.
>  > But how do I make the weather show up in a diary entry?

Did we miss the first e-mail? Anyway,

> This is not properly documented at all.  I should not have to read
> source code to figure out how to use something.  Not knowing ruby, it
> was obviously just a guess.  A guess that failed.

At first I apologize that I have been too lazy to prepare the
English version of the document. I will edit the Wiki page
soon.

For tDiary 1.5.6 or later, plug-ins are generally designed to work
with minimum configuration by the user. I imagine you already know
this, but others may not. Basically, you have to:
(1) follow the "Append" or "Edit" link in the diary
(2) follow the "Preference" link
(3) follow the "Plugin selection" link
(4) Check the plug-ins you want to use. You can read the document
    by following the link on the plug-in file names there, if you
    are lucky enough, or otherwise you will see an empty Wiki page ;(
(5) Push OK button.

These steps let tDiary read the plug-in files. You will be able to use
methods like <%=fn 'footnote here' %> when you enable footnote.rb.
(For this we really need to have proper documentation which is still
missing for most of plug-ins...)

Another kind of plug-ins, like weather.rb, has to be configured before it
makes effect on your diary. For these plug-ins, a configuration menu is
generally offered. For weather.rb:
(6) follow the "Weather-of-today" link in "Preference" view
(7) read the description
(8) enter the URL where you want to take the weather data from
This should show the weather next time you edit or append your diary.

I would like to hear how we can improve usability of the plug-ins.

Cheers,
zunda

PS: it would be interesting to read Ruby scripts :) Most of the
plug-ins are in misc/plugin directory. There, we have the body of the
plug-in, and language dependent part are under ja/ or en/ directory.
They are instance_eval'ed from tdiary.rb or 01sp.rb. Please read them
and edit them if you want :)

__________________________________________________
Do You Yahoo!?
Yahoo! BB is Broadband by Yahoo!
http://bb.yahoo.co.jp/

On Wed, Dec 03, 2003 at 08:33:13PM +0000, Lazarus Long wrote:
 > At long last, I seem to have configured weather.rb to be used.
 > But how do I make the weather show up in a diary entry?

[12]Wednesday, December 03, 2003

   [13]_ @Weather-of-today
   [[14]Add a TSUKKOMI]

Obviously that didn't work.  That's what I guessed at after reading
weather.rb.

This is not properly documented at all.  I should not have to read
source code to figure out how to use something.  Not knowing ruby, it
was obviously just a guess.  A guess that failed.

-- 
Please (OpenPGP) encrypt all mail whenever possible. Request the following
Public Keys for Lazarus Long <la...@ov...>

  Type    Bits/KeyID    Fingerprint                   DSA KeyID: vvvv vvvv
ElGamal: 2048g/3E028FE1 4146 29A5 AE66 2E11 7307  F3B4 03A4 DD1D 3F8F 30DF

Hi,

tDiary 1.5.6 has a security hole on the condition below:

   * in secure mode (@secure = true) AND
   * using output_rdf.rb or tb-send.rb plugins.

Diary writers on this condition can access to resources of the web
server.

How to fix this hole:

   * remove output_rdf.rb and tb-send.rb OR
   * replace recent 'tdiary.rb' file.

You can get recent 'tdiary.rb'  (Revision 1.159) from sf.net:

   * http://cvs.sourceforge.net/viewcvs.py/tdiary/core/tdiary.rb/?rev=1.159&view=auto

--
tDiary Development Team
TADA Tadashi

Hi,

We have just released tDiary 1.5.6. See release notes below.

Have fun!
tDiary Development Team

release note of core module -------------------------

Major new features:

* I18n framework support
  Separated language dependent code to tdiary/lang/LANG.rb, skel/*.rhtml.LANG
  and plugin/LANG/*.rb. In default, you can use English. only setting @lang 
  variable in tdiary.conf to 'en' (00lang.en.rb plugin was obsoleted). 

  Then some plugin was separated main code and language resources. When
  installing a plugin, you have to notice to language resources in plugin/LANG
  directory. 
  But now you have not to copy plugin files, because you can select plugins
  via web browser, see below. 

* Plugin install from your browser 
  01sp.rb added into plugin. This is a plugin to "select plugin". You can
  select plugins you want to use from your browser. Set @options['sp.path']
  variable tdiary.conf to PATH OF PLUGINS, you can find a new preference
  page.

* document site in available 
  http://docs.tdiary.org/en/ as English documentation site of tDiary. Plugin 
  document and Style document will be in this site. You can see it as link in
  Update form or Select Plugin page. This site is built by Wiki. Please write
  some documents. 

Minor new features:

* @cache_path support in tdiary.conf.
* @referer_day_only in tdiary.conf.
* @options['bot'] as search engine robot in tdiary.conf.

release note of plugin ------------------------

New features:

* i18n support
  Some plugins was supported i18n framework. Internationalized plugins have 
  main code (plugin/*.rb) and language recourses (plugin/LANG/*.rb). You have
  to copy these files to right directory. 

  But you dose not need copy to install plugin yet. "Select plugins" plugin 
  was supported. When you set @options['sp.path'] variable in tdiary.conf to 
  your plugin directory, you can select plugins you want to use by your browser.

New plugins:

* append-css.rb: add fragments into theme.
* search_control.rb: control search engine robots.
* random_google.rb: find related pages in Google.
* sn.rb: add serial number in section anchor.
* highlight.rb: highlight subtitle when jump from other pages.

Update plugins:

* squeeze.rb, output_rdf.rb: activated by TrackBack received.
* amazon.rb, kw.rb: support preferences page.
* whatsnew.rb: support apply_plugin.
* disp_referrer.rb: replaced by disp_referrer2.rb.
* speed_comment.rb: support cookies.
* tb-show.rb, tb-send.rb: move from plugin/trackback directory to plugin/.
* image.rb: show image size.

Obsoleted plugins:

* referer-utf.rb: UTF-8-ed referer can support by i18n framework.
* nazo.rb: replaced by highlight.rb.

release note of theme -----------------

New features:

* All themes become to look better in many browser. We recommend to replace
  with new themes.

New themes:

* himawari
* sepia

release note of BlogKit -------------------

New features:

* i18n framework support. see release of tDiary core package.
* plugins/blog-category.rb: making category plugin.

Updated:

* plugin/title-navi.rb: over months navigation.

Hi,

tDiary Development Team have found 2 security hole in plugins:

  * tb-show.rb: Show TrackBacks.
  * comment_rank.rb: Show ranking of TSUKKOMIs.

You can get fixedt files from sf.net:

  * http://cvs.sourceforge.net/viewcvs.py/tdiary/plugin/

Regards,
TADA Tadashi

On Fri, 02 May 2003 10:11:13 +0900 (JST), Takuya YAMAGUCHI=
 wrote:
> Hi,
> 
> Your tdiary.conf looks no problem.
> 
> I'm afraid I haven't use the latest version of tDiary from=
 CVS,
> if you can, could you use '1.5.3'? or use old version of Ruby
> (i.e. 1.6.7)?

I just changed my tDiary to 1.5.3; I cannot, for a variety of
reasons, switch to Ruby 1.6.x. Unfortunately, the error still
happens. I'm at a loss. When I was running on 1.6.x, tDiary=
 worked
more or less fine, but the TSUKKOMI didn't work at all (I got=
 really
ugly crashes there). Of the Ruby blogs available, I like tDiary
best -- it uses a flat-file backend (and thus doesn't require=
 any
of my mySQL space), but I can't get it running reliably enough=
 for
me to actually use...

I have only applied the 1.5.3 blogkit and plugins. Everything=
 else
is sitting in a directory for me to play with as I wish.

-austin
-- Austin Ziegler, au...@ha... on 2003.05.01 at=
 22:16:12

Hi,

Your tdiary.conf looks no problem.

I'm afraid I haven't use the latest version of tDiary from CVS,
if you can, could you use '1.5.3'? or use old version of Ruby
(i.e. 1.6.7)?
Blogkit runs with no problem on my website. The versions are
tdiary 1.5.3 and ruby 1.6.7(I use debian woody stable :-).

Another way, please re-check your plugins are correct 
latest version of CVS. For example, file date, file size...
I heard most of CVS plugins are much severe other product
versions.

I'm sorry for my broken English.

--
Regards,
Takuya YAMAGUCHI

From: Austin Ziegler <au...@ha...>
Subject: [tDiary-talk] tDiary woes...
Date: Thu, 1 May 2003 11:58:04 -0400

> I've installed the latest CVS versions of tDiary and Ruby with the 
> blogkit for that version. I am, for the most part, using the 
> defaults. I'm not using "secure" mode at all. When I attempt to add 
> an entry, I get the following error:
> 
> (eval):99:in `instance_eval': undefined method `each_with_index' for 
> nil (NoMethodError)
> 
> ./tdiary.rb:617:in `eval_src'
> ./tdiary.rb:78:in `join'
> ./tdiary.rb:78:in `safe'
> ./tdiary.rb:616:in `eval_src'
> ./tdiary.rb:819:in `do_eval_rhtml'
> ./tdiary.rb:770:in `eval_rhtml'
> update.rb:56
> 
> The file ~/diary/2003/200304.td2 is created with the information I 
> expect, though. ~/diary/cache/200304.parser is present. When I delete
> that, update form returns. It returns when I click on "Index" and get
> the following message:
> 
> ./tdiary.rb:346:in `require': loading from unsafe path  
> .:/home/halostatue/lib/ruby/site_ruby/1.8:/home/halostatue/lib/ruby/si
> te_ruby/1.8/i686-linux:/home/halostatue/lib/ruby/site_ruby:/home/halos
> tatue/lib/ruby/1.8:/home/halostatue/lib/ruby/1.8/i686-linux:. 
> (SecurityError)
> 
> ./tdiary.rb:617:in `eval_src'
> ./tdiary.rb:78:in `join'
> ./tdiary.rb:78:in `safe'
> ./tdiary.rb:616:in `eval_src'
> ./tdiary.rb:819:in `do_eval_rhtml'
> ./tdiary.rb:770:in `eval_rhtml'
> index.rb:69
> 
> This happens whether or not I remove the *.parser file from the 
> cache.
> 
> Have you seen this before? What am I doing wrong? If you need, I can 
> package up the whole shebang. If you want to test, by the way, I'm 
> temporarily removing the password protection on update. I have also 
> removed the offending data so that you can get anything at all...

I've installed the latest CVS versions of tDiary and Ruby with=
 the 
blogkit for that version. I am, for the most part, using the 
defaults. I'm not using "secure" mode at all. When I attempt to=
 add 
an entry, I get the following error:

(eval):99:in `instance_eval': undefined method `each_with_index'=
 for 
nil (NoMethodError)

./tdiary.rb:617:in `eval_src'
./tdiary.rb:78:in `join'
./tdiary.rb:78:in `safe'
./tdiary.rb:616:in `eval_src'
./tdiary.rb:819:in `do_eval_rhtml'
./tdiary.rb:770:in `eval_rhtml'
update.rb:56

The file ~/diary/2003/200304.td2 is created with the information=
 I 
expect, though. ~/diary/cache/200304.parser is present. When I=
 delete
that, update form returns. It returns when I click on "Index" and=
 get
the following message:

./tdiary.rb:346:in `require': loading from unsafe path  
.:/home/halostatue/lib/ruby/site_ruby/1.8:/home/halostatue/lib/ru=
by/si
te_ruby/1.8/i686-linux:/home/halostatue/lib/ruby/site_ruby:/home/=
halos
tatue/lib/ruby/1.8:/home/halostatue/lib/ruby/1.8/i686-linux:. 
(SecurityError)

./tdiary.rb:617:in `eval_src'
./tdiary.rb:78:in `join'
./tdiary.rb:78:in `safe'
./tdiary.rb:616:in `eval_src'
./tdiary.rb:819:in `do_eval_rhtml'
./tdiary.rb:770:in `eval_rhtml'
index.rb:69

This happens whether or not I remove the *.parser file from the 
cache.

Have you seen this before? What am I doing wrong? If you need, I=
 can 
package up the whole shebang. If you want to test, by the way,=
 I'm 
temporarily removing the password protection on update. I have=
 also 
removed the offending data so that you can get anything at=
 all...

Thanks in advance for your help,
-austin

Versions:
tDiary version 1.5.3.20030422
ruby 1.8.0 (2003-04-27) [i686-linux]

plugins/
00default.rb
00lang.en.rb
archive.rb
blog-style.rb
edit.rb
lm.rb
recent-entry2.rb
title-navi.rb
whatsnew-list.rb

tdiary.conf is attached.

Thanks for your help,
-austin
-- Austin Ziegler, au...@ha... on 2003.05.01 at=
 00:02:25

2003	Jan	Feb	Mar	Apr	May (3)	Jun	Jul	Aug	Sep	Oct	Nov (3)	Dec (2)
2004	Jan (2)	Feb	Mar	Apr	May (9)	Jun	Jul	Aug	Sep	Oct	Nov	Dec
2005	Jan	Feb	Mar	Apr	May	Jun	Jul (1)	Aug	Sep (1)	Oct	Nov	Dec
2006	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov (1)	Dec (1)

tdiary-talk Mailing List for tDiary

tDiary project was moved to GitHub. See https://github.com/tdiary/

tdiary-talk — talking about tDiary in English