SARG ChangeLog Nov-28-2010 Version 2.3.2-pre1 - Add support for sorttable.js (http://www.kryogenix.org/code/browser/sorttable/) to dynamically sort some tables (thanks to Éric). - Add the two command line options --lastlog and --keeplogs to set the number of reports to keep or to keep all the reports respectively (thanks to Emmanuel Lacour for the suggestion). - Report the user ID in the e-mail report. Sep-18-2010 Version 2.3.1 - Remove the distinct printf for the alpha architecture as it doesn't work anymore and is not necessary anyway. - Don't abort if "onload" or "script" is found in the user agent string. - Take the configured locale path into account when installing sarg. - Fix the realtime and e-mail reports. - Allow for the translation of the sort criterion on the report pages. - The mail_utility command isn't quoted any more so it is possible to add some command line arguments. - Fix a wrongly reported error if the two "hours" and "weekdays" options are enabled in sarg.conf (thanks to guyizsolt). - Add a link on the denied page to link the page to the corresponding user. - Fix a problem with the progress indicator when reading from a compressed log file. - Report an error if the output directory is a subdirectory of the temporary directory. - Use a more robust protection against an attack using javascript in the useragent string. - Prevent a segfault if the parameter passed to command line option -d is invalid (thanks to ItalianPenguin). - Check for the return code of the tail command to generate the realtime report. - Escape the invalid characters in the LDAP search string instead of truncating it at the first invalid character (thanks to mouchar for reporting the problem and testing the fix). Jun-21-2010 Version 2.3 - LDAP usertab added. Now you can have your users in a LDAP Server. Use these tags in sarg.conf: LDAPHost, LDAPPort, LDAPBindDN, LDAPBindPW, LDAPBaseSearch, LDAPFilterSearch - Parse the string flags from sarg.conf once during the reading of sarg.conf instead of manipulating and duplicating the tests of the strings where they are used. - Useragent report limited to requested date range. - Link to external css file instead of including it verbatim in each HTML file (thanks to Maxim Britov). - Enable gettext configuration for autotools. - Use gettext translations instead of the custom languages files. - Keep the user name unchanged in the report (suppress the replacement of some characters by underscores). - Try to resolve a user's IP address only once and store the result. It can speed up the processing a lot. - Resolve IPv6 addresses (to be tested). - Don't limit the maximum length of a URL (the only limit is that a single line of text from the log file must fit in memory). - The creation of the datafile is working again. - Use a template to build the .htaccess file of each report. - Accept spaces in the replacement label of the usertab file (thanks to Alex Sav). - Change the version number of the release candidate to conform to the numbering of the translationproject.org. - Store the period internaly and get rid of the sarg-period file. - Display the period using the locale's month name in the HTML files. - Check the correct writing of the HTML files (thanks to Markus Elfring). - Use the word "Redirector" instead of mentioning explicitly squidGuard in the reports as at least Rejik is compatible with sarg (thanks to Maxim Britov). - The date range passed as argument is not restricted to the actual range covered by the log files any more. - Fix the exclusion of status codes to exclude more than one code. - Accept date ranges for -d command line option as day-n, week-n and month-n where n is the number of backward days, weeks and months to report. - Strengthen the making of the report file name to drastically limit the characters from the user ID that can appear in the file name. The presence of an unescaped backquote in the user ID would execute the rest of the name as a shell command (fixes bug #2997707 reported by anonymous). - Purge the content of sarg-general to free a lot of disk space. - Use parameteric dimensions in the graph creation instead of hard coded constants. - Remove the temporary file and sorting in graph creation. - Add the redirector_log option in sarg.conf to read a log file created by squidGuard or Rejik (thanks to Maxim Britov for pointing out this missing option). - Allow up to 64 redirector log files to be passed through the command line option -L and the sarg.conf option redirector_log. - Configuration option squidguard_log_format renamed into redirector_log_format for equity with the various redirectors that can be used with sarg. - Read a compressed log file through a pipe. - The graph was wrong. The bars were not reaching the correct height with respect to the Y axis. - Use a computed logarithmic scale for the Y axis when plotting bytes data instead of a fixed scale. - Show the time when plotting the elapsed time. - Fix the reporting of only one user with command line option -u. - Output both date/time textual and graphical reports. - Sarg log file now stores the date in the format dd/mm/yyyy and doesn't change it depending on the current date representation selected in sarg.conf. It will break existing sarg log files. - Intermediary log files store the date as dd/mm/yyyy irrespective of the current date representation in sarg.conf. - Fix a regression to accept any directory name length in the index. - Change the CSS template file and cleanup of the hardcoded styles (thanks to Maxim Britov). - Accept unlimited line length when converting or splitting the log file. - Use long options on the command line. - Sarg can output the internal css inlined in the reports. It replaces the css.tpl distributed with the sources. - Command line option -l is optional. The input log files may be named on the command line without prefixing them with -l. It allows the use of wildcards in the command line. - Accept unlimited URL length in the redirector log (thanks to Joseph L Casale). - Replace redirector_ignore_date by redirector_filter_out_date that behave as the name implies. - Replace dansguardian_ignore_date by dansguardian_filter_out_date that behave as the name implies. Feb-10-2010 Version 2.2.7.1 - Fixed compilation error reported by some compilers due to an sizeof in a fprintf (thanks to Maxim Britov and Renato Botelho). - The path to the font used to create the graphs can be set in sarg.conf. - The installation of our fonts can be disabled with --disable-fontdir. Feb-05-2010 Version 2.2.7 - Extra compile and run time protection (FORTIFY_SOURCE) fixed in configure. - Use tabulations as columns separator in intermediary files to avoid problems when a field of the log contains a space. - Input log file type detection partly rewritten to clearly distinguish which type is processed where. - Read the input log file from standard input if log file name is -. - Use string pointers in getword instead of copying the strings over and over. - Use LC_TIME to format some dates and times in the report according to the selected locale. - Sarg.conf can list up to 255 access.log files. - Downloaded files suffixes are matched against a sorted list and use a dichotomic search. - Added getword_atoll to read a number directly from a file without an intermediary string storage. - Use boolean to enable the options instead of string compares. - Accept an absolute path for the language file in sarg.conf. - Experimental: Can show the backtrace of the program when a getword loop is detected to help in locating the origin of the error. - Protect the creation of the index against invalid directories. - Only copy the files (not the subdirs) when creating the directory with the images to include in the reports. - Directories deleted without using the rm system command. - Index created using an internal sort algorithm instead of a system call. - Fixed Debian bug #408577 (changed exclude_hosts to exclude subdomains and IPv4 subnets). - Replace --enable-htmldir by --enable-sargphp to avoid confusion on the name (thanks to Peter Nixon). - Installation of sarg-php can be disabled with --disable-sargphp. - Fixed empty entries in squidGuard log when the URL doesn't start with protocol://. - Fixed regressions in creation and reading of a sarg parsed log (thanks to Joao Alves). - Does not report URLs consisting of only a host name ending with .com as a downloaded file. - Mangle the $ and @ signs in user ID to make the resulting file name valid in shell commands. - Fixed a regression in the default value of --enable-sargphp. - Increase the maximum size of a line read from access.log and detect longer lines that were silently splitted in previous versions. Jan-06-2010 Version 2.2.6.1 - Remove unnecessary dependency on off_t. - Configuration doesn't fail if rlim_t is not available. - Test for the availability of -Werror=implicit-function-declaration and -Werror=format flags in gcc (thanks to Murilo Moreira de Oliveira and pjetko). - Fix sort delimiter when reading useragent log (thanks to Maxim Britov). - Fix user agent report font size and statistics on user agent. - Test for the availability of -Werror=format-security in gcc (thanks to Maxim Britov). - Test the existence of bzero with autoconf and don't redefine it (thanks to Maxim Britov). - Remove warnings if libgd is not available. - The date stored in sarg-date is now stored in a more machine readable form (thanks to rcastanheira for pointing this out). - The date read from sarg-date was not properly parsed and would produce a wrongly sorted index across a year change (thanks to rcastanheira for pointing this out). - my_mkdir changed to avoid the use of getword, be simpler and, maybe, work reliably on windows. - Makefile supports DESTDIR for easy package creation (thanks to Erjo). - Real time report honour the user_ip flag of the configuration file and the -l and -n passed on command line. - Fix usage of -Werror and detection of fopen64 with old compilers not supporting -Werror=implicit-function-declaration. Oct-14-2009 Version 2.2.6 - Protection against buffer overflows in getword and friends and report the origin of the error instead of always blaming access.log. - Patch #2224623 applied. - Updated to autoconf 2.61. - Detect external commands failures and print the exact command that produced the error. The offending file is kept for debugging if possible. - The format of the date written in sarg-date is forced to prevent a failure if the locale is not en_US. - Removed the duplicate file opening that resulted in a resource leak. - Patch #1945235 applied. - Patch #1918397 applied. - Limit the content of the squidguard log file to the date of the day being processed. - Removed fscanf that is prone to buffer overflows. - Size of buffers increased. - Protect ip2name against buffer overflows. - Replace characters that are valid in URL but not in file names when building a file name from a URL. - Patch #2657320 applied. - Fix #else #if into #elif. - Remove all the compilation warnings (inspired from patch #1771501). - Fixed the real time report. - Fixed the same bug as patch #1733337 but in a cleaner way. - All the sprintf/fputs have been replaced by fprintf to avoid an intermediary buffer and possible buffer overflow. - Moved all the functions declarations from conf.h to defs.h for consistency. - Fixed bug #2089451. - Fixed Debian bug #444845. - Replaced the ifdef FOPEN64 by a single call to MY_FOPEN for code clarity. - User IP/ID is searched only in the first column of the usertab file. - Some of indentation fixes. - Speed up by removing two unnecessary ip resolutions. - Applied debian patches: sarg-polish.patch, sarg-turkish.patch - Applied debian patch: opensuse_2_enlarge_report_buffers.patch - Applied debian patch: opensuse_3_too_small_font_buffer.patch - Applied debian patch: opensuse_4_enlarge_log_buffer.patch - Applied and extended debian patch: opensuse_5_limit_sprintf.patch - Function debuga format the output string itself, so there is no need to use sprintf. - Applied debian patch: opensuse_7_year_assertion.patch - Removed a few unnecessary strings copy. - Embryo of documentation for the code with doxygen. - Changed subs to replace the string in place and avoid allocating a memory that was freed on only one occasion. - A few improvements on strings manipulations. - Fixed debian bug #504749. - Detect downloaded suffix bigger than 3 characters, don't match the cases and don't stop on a partial match. - Fixed bug #2716729. - Sanitized a little bit the generated HTML. - Don't reject URL without directories. - Use the correct format for off_t on amd64. - Use the mechanism provided by configure to set the directories of the application instead of the custom variables. - Fixed bug #1814212. - Fixed bug #1847374. - Partly applied advice of bug #1659784. - Fixed bug #1740268. - Applied suggestion of bug #2830643. - Fixed bug #2216451. - Fixed bug #2000178. - Protect the reading of the configuration file against buffer overflows. - Logo image height taken into account. - Accept longer mail utility name. - Fixed e-mail report (may also fix bug #2153024). - Fixed total and percentages of topuser page. - Applied Gentoo patch 10_all_sarg-2.2.5-enlarge-day-mon-buffers.patch. - Applied Gentoo patch 12_all_sarg-2.2.5-enlarge-ntemp.patch. - Open only once the denied.log and authfail.log when parsing more than one access.log. - Use configurable paths for the files that used to reside in SYSCONFDIR. - Add cmake configuration files. - Compute the report date without resorting to the system command. - Allow the use of spaces in the temporary directory. - Fixed bug #2863485. - Removed misplaced off_t as suggested in bug #2864425. - Z files are uncompressed by zcat to avoid deleting the original log file. - Compressed log files are uncompressed in /tmp/sarg to delete the file when the process completes. - Fixed several memory leaks. Mar-03-2008 Version 2.2.5 - new fix to the script insertion vulnerability via user-agent report. javascript can still be executed via e.g. the "
" scheme Thanks to Alin Rad Pop, Security Specialist, Secunia, Denmark Mar-02-2008 version 2.2.4 - security issues can be exploited to execute arbitrary code when sarg is used with malicious input files. The vulnerability within the processing of the useragent.log is rather critical, as this can be exploited by passing a long user agent string when browsing via a squid proxy. the manipulated GET request in the access log would not be accepted by squid, so that file has to be specially crafted. Thank you to L4teral l4teral@gmail.com - French language fixed. Thanks to Nicod