Recent changes to bugs

Events: Schedule Similar, URL with args causes fatal error "not valid"

Laura Mengel — Thu, 09 Jan 2014 17:38:35 -0000

URL field in event: cannot use this URL in "Schedule Similar" screen form.
Click on an event and then click on "Schedule Similar" button, which goes to:
http://xyz-docdb.fnal.gov:8080/cgi-bin/MeetingModify
INC000000398992, INC000000400111

URL used: https://www.callinfo.com/prt?host=readytalk&an=8667401260&ac=7601675
Error received: "Modify an Event
There were fatal errors processing your request:
The URL https://www.callinfo.com/prt?host=readytalk&an=8667401260&ac=7601675 is not valid."

Workaround: Same URL can be added successfully in the "Modify Agenda" screen.

Able to inject HTML into URL

Anonymous — Fri, 12 Apr 2013 20:05:08 -0000

The ShowDocument and /cgi-bin/ListAllMeetings are vulnerable to HTML injection. For example, the following will generate a popup window on clients:

/DocDB/ShowDocument?docid=3660e4698</title><script>alert(1)</script>5a2aec62a0c

DeleteConfirm script dies when no document number submitted

Anonymous — Thu, 15 Nov 2007 19:59:21 -0000

If you don't specify the document number to delete, DeleteConfirm dies (tries to output error messages without having sent any headers). The following trivial patch seems to fix it, though it may not be the correct fix.

Index: DeleteConfirm

RCS file: /local/cvs/doccvs/cvs/DocDB/cgi/DeleteConfirm,v
retrieving revision 1.12.12.5
diff -r1.12.12.5 DeleteConfirm
64c64
< EndPage(@ErrorStack);
---
> #EndPage(@ErrorStack);

document access error

L. Garren — Fri, 02 Nov 2007 16:54:27 -0000

If you try to find a document that does not exist from the public database, DocDB returns the message that "the document is not public". Instead, it should tell you that the document does not exist.

Crash in "new CGI"

Eric Vaandering — Tue, 07 Aug 2007 20:21:05 -0000

The command "new CGI" can cause a crash in ProcessDocumentUpload. An easy way to reproduce this is to supply a directory name instead of a file. The error is "CGI.pm: Server closed socket during multipart read (client aborted?)." It's possible that perl 5.6.1 and CGI.pm from there fixes this.

Currently I don't know how to fix this, but I will try with updated versions of perl and CGI.pm to see if that helps.

Hide document titles for public

Anonymous — Wed, 16 May 2007 21:05:17 -0000

Public events should not display document titles for private documents. Thought this was fixed before.

broken command

L. Garren — Wed, 21 Feb 2007 18:04:15 -0000

ProcessUpload appears to be broken in version 8.3.0

The following code does not copy the file:

open (OUTFILE,">$new_dir/$short_file");
while ($bytes_read = read($long_file,$buffer,1024)) {
print OUTFILE $buffer
}
close OUTFILE;

The result of this code is an empty file named $new_dir/$short_file.

This code is exercised when uploading an archive. It does not appear to be exercised otherwise.

I have built a simple test perl script containing just those lines (and defining the variables). The script fails.

Topic check not working?

Eric Vaandering — Thu, 21 Dec 2006 20:43:04 -0000

It seems it is possible to create a document with no topics. Make sure this check is still working.

Mysql error on migrating to V8

Stephen A. Wood — Wed, 22 Nov 2006 17:13:34 -0000

I am trying to migrate from v7.7.1 to 8.2.0. Migrate8 fails with the error:

DBD::mysql::st execute failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Separator (SessionSeparatorID)
)' at line 12 at ./MigrateV8 line 125.

while trying to create the Moderator table.

The MYSQL that is I use is 5.0.21. It looks like "Separator" is a reserved keyword in Mysql 5, so maybe a different key name is needed.

Topic with no long description

Eric Vaandering — Mon, 30 Oct 2006 14:52:44 -0000

Topics with no long descriptions apparently generate
strange behavior in topic lists. Should just default to
short and not allow such topics to be entered in the
first place.