gmane.network.mathopd

Re: mailing list moving to mailman

Michiel Boland — 2012-11-12T19:37:50

Thanks. :)

I see the sender is now mathopd-bounces instead of owner-mathopd, so you may 
have to update your filters. Sorry about that. I guess it's too late to change 
that now.

I'll also try to retrofit old emails into the mailman archive.

Also, since this is mailman, and I decided not to deviate too far from the 
standard, everyone now has a list password. You will need that if you want to 
make changes through the web interface*. You will get a password reminder every 
month. Or you can go to the web interface and have it mail your password to you. 
You can also turn off the monthly reminder if you want.

* http://barrytown.boland.org/mailman/listinfo/mathopd

Cheers
Michiel

Re: mailing list moving to mailman

David J. Weller-Fahy — 2012-11-12T19:25:09

* Michiel Boland <michiel< at >boland.org> [2012-11-12 12:12 -0500]:

Oooo... it's so shiny! ;)

Re: mailing list moving to mailman

Michiel Boland — 2012-11-12T16:56:50

Hi. If you see this message then that means the migration of the mathopd mailing 
list to mailman has been completed.

Welcome to the 21st century. :)

Cheers
Michiel

mailing list moving to mailman

Michiel Boland — 2012-11-05T19:27:40

Hi. Just a short note to indicate that this list is still alive. :)

I will be migrating this list from majordomo to mailman somewhere during this 
month. There will be another message when the migration is complete.

Cheers
Michiel

Re: Way to access a particular directory as user?

David J. Weller-Fahy — 2012-09-14T02:24:01

* Neale Pickett <neale< at >woozle.org> [2012-09-13 13:55 -0400]:

Indeed - I've 'fixed' the problem by changing the owner of the directory
in question, which has solved the problem for now (made it usable), and
because mailman doesn't mess with the archive file directory ownership
unless being installed, it is a usable workaround.  However, given I
like my server to do as much as possible within the framework of the OS
installed (Debian stable), I'd like to be able to tell Mathopd:
"Whenever you access anything inside this control group, use this user
to do so (since you StayRoot as requested anyway)."

This was more a "need" of convenience, rather than a "need" of ZOMG I'll
die. ;)  But I think it could be very useful.

Regards,

Re: Way to access a particular directory as user?

Neale Pickett — 2012-09-13T17:33:09

On 9/13/2012, "David J. Weller-Fahy"
<dave-lists-mathopd< at >weller-fahy.com> wrote:


I can only speculate as to what's driving this need... but have you
considered using either groups or POSIX ACLs to allow the web user read
access to whatever files are needed?

Way to access a particular directory as user?

David J. Weller-Fahy — 2012-09-13T02:29:44

I've come across a need to access a directory as a particular user, but
without running a CGI script... so...

Is there any way to act as a particular user without executing a CGI
script?  Something like "AccesUser dave" which would allow mathopd to
access the directory and/or index file as the user "dave"?

I'm pretty sure there isn't a way to do this, but wanted to make sure.

Regards,

mathopd 1.5p8 released

Michiel Boland — 2012-02-03T13:03:17

Hi. The 1.5p7 release contains yet another embarassing bug that causes a crash 
when a HTTP/1.0 request without a Host header is made.

There is a new stable and a new beta. If you are running 1.5p7 by any chance 
please upgrade immediately.

Sorry about this. I should have known better than to ship a fix immediately 
without proper testing. :(

Cheers
Michiel

security alert: directory traversal when using * in Location

Michiel Boland — 2012-02-02T21:24:02

Hi. I just released a security update for mathopd. (mathopd 1.5p7)

The problem:

If you use the * construct in your config, as in

  Control {
     Alias /
     Location /var/www/*
   }

then the * will be substituted with the value of the Host header that was 
supplied by the client. However this occurs after path translation, and without 
input verification could lead to directory traversal, exposing files outside of 
/var/www.

If you are still using Mathopd, and use the * feature, you should upgrade as 
soon as possible.

If you do not use the * feature, than you are not at risk. But you may still 
want to upgrade.

Vulnerable versions of the software: all 1.4 versions, and all 1.5 versions 
prior to 1.5p7

Thanks to Mateusz Goik for pointing this out.

Cheers
Michiel

302 redirect patch

carbonated beverage — 2011-12-14T05:12:44

Hi all,

I recently had to deal with somewhat brain-dead web crawler -- it didn't
pay attention to 302 return codes and rejected the body when there was no
<html> tag.

Hence, this mini patch to get the 302 return codes to generate an HTML
meta refresh tag, as well as adding html/head/body tags.

is mathop subject to log escape sequence injection vulnerabilites?

Lars Täuber — 2010-05-14T07:40:12

Hi again,

I don't know if mathopd isn't tested against this or is not subject to this:

http://packetstormsecurity.org/1001-exploits/log-inject.txt

There are only webservers listed that are vulnerable to this.

What about mathopd?

Lars

Re: standard error page per virtual host

Lars Täuber — 2010-05-14T07:33:41

Hallo Juergen,


Juergen Daubert <jue< at >jue.li> schrieb:

thanks alot. That is exactly what i was looking for.


Thanks for this too. Is shortens my reading time significantly.



This is not a problem, because every domain uses a different file.

best regards
Lars

Re: standard error page per virtual host

Juergen Daubert — 2010-05-13T08:56:43

Hello,


Yes, see http://www.mathopd.org/wiki?ErrorFile


Setup virtual hosts and use the Error404File directive within a Control
block:

 Virtual {
     Control { 
         Host abc.domain.org
         Alias /
         Location /srv/www/abc.domain.org/index.html
         Error404File /srv/www/abc.domain.org/index.html
     }
 }

Unfortunately you have to do that for every host, because Error404File
cannot expand the * wildcard like Location does, see the Location
wiki-page to see what I mean: http://www.mathopd.org/wiki?Location

One possibility to solve this might be to use a CGI script insatead of 
a static page for Error404File that reads the REQUEST_URI environment 
variables and redirects the user to the right error-page. 
See http://www.mathopd.org/wiki?CGI/EnvironmentVariables


HTH and regards
Juergen

standard error page per virtual host

Lars Täuber — 2010-05-12T12:04:27

Hi there!

I'm new to mathopd but I thought it could serve all my wishes.

The question is: Does mathopd support setting standard error pages?

I have a small energy saving webserver that still runs when all other webservers are shut down due to power out. This server is backuped by an ups.
It will be configured to take over the ip addresses of the shut down webservers and should serve a single static webpage for each virtual host configuration.

The question is can mathopd redirect all requests to a single html file?

e.g.

http://abc.domain.org/xyz/file.html 
should not generate a 404 error page but reply the standard file:
/srv/www/abc.domain.org/index.html

And so for _all_other_ URLs under abc.domain.org
So it's a kind of universal redirect.

If you don't understand what I mean just ask. English is not my mother tongue.

Best regards
Lars

Re: Upload file support in mathopd

Rabindra Paikaray — 2010-03-02T09:52:53

Hi Michiel ,

I am pasting here my piece of code here in php
Which I am using for upload . it works for normal HTTP.
But with HTTPS it does not work for files of format other than .txt

My Code Below
FORM HANDLER
------------------------------
<html>
<body>
<form action="upload.php" method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="upload" id="file" />
<br />
<input type="submit" name="submit" value="Submit" />
</form>
</body>
</html>

UPLOAD HANDLER
-----------------------------------
<?php
if ($_FILES['upload']['error'] == 0)
{
     $fileName = $_FILES['upload']['name'];
     echo $filName;
     echo "Upload ok\n";
     if ($_FILES['upload']['size'] > 0)
     {
        echo  $_FILES['upload']['tmp_name'];
        $tmpName=$_FILES['upload']['tmp_name'];
     }
    move_uploaded_file($tmpName, "/tmp/testdoc");
}
?>

Thanks
Rabindra

On Thu, Feb 25, 2010 at 12:43 PM, Rabindra Paikaray
<rabipaikaray< at >gmail.com>wrote:

Re: Upload file support in mathopd

Rabindra Paikaray — 2010-02-25T07:13:20

Hi Michiel ,
Thanks for your reply.
I was trying the upload with php script .
It is working nicely for all kinds of file format if I am using the normal
http.
If I am using the https (mathopd applied by the SSL patch provided) upload
is happening . But when I am opening the file it's telling that unknown mime
type.
data integrity lost.
Any idea about this.


Thanks
Rabindra


On Wed, Feb 25, 2009 at 11:10 PM, Michiel Boland <michiel< at >boland.org> wrote:

mattoclf bug, question on proper fix

carbonated beverage — 2009-10-14T06:44:28

Hi all,

Recently, I was wondering why I was getting an odd failure from mattoclf
in my cron mails -- so I went digging.  Apparently, when the parameter $5
(the request's Host:) ends up being '-', gawk will puke -- it translates to:
printf <format> <args>  > -

This can be reproduced in the logs by:
telnet www.example.com 80
GET /index.html HTTP/1.0

mathopd will spit out a 400, and the log will have, with one field per line:
$1: Wed Oct 14 06:38:50 2009
$2: -
$3: 10.0.0.1
$4: 33886
$5: -
$7:GET
$8:/index.html
$9:400
etc.

Updating mattoclf to translate the - to "invalid" fixed it for me.  However,
I don't know what the expected results are for most people using log parsers.

Comments?