Re: [Ganglia-developers] web front-end cross-scripting vulnerability

2007-12-05 Thread Matt Massie
i just meant in the announcement/changelog. -matt On 12/5/07, Bernard Li <[EMAIL PROTECTED]> wrote: > > Hi Matt: > > On 12/5/07, Matt Massie <[EMAIL PROTECTED]> wrote: > > > make sure we credit "Romain Wartel" at CERN for discovering the > > vulnerability and reporting it to us. thanks for pulli

Re: [Ganglia-developers] web front-end cross-scripting vulnerability

2007-12-05 Thread Bernard Li
Hi Matt: On 12/5/07, Matt Massie <[EMAIL PROTECTED]> wrote: > make sure we credit "Romain Wartel" at CERN for discovering the > vulnerability and reporting it to us. thanks for pulling this together to > push out! How would you like to credit him? Perhaps via the AUTHORS file? That file is a

Re: [Ganglia-developers] web front-end cross-scripting vulnerability

2007-12-05 Thread Matt Massie
make sure we credit "Romain Wartel" at CERN for discovering the vulnerability and reporting it to us. thanks for pulling this together to push out! -matt On 12/5/07, Bernard Li <[EMAIL PROTECTED]> wrote: > > Hi guys: > > On 12/5/07, Martin Knoblauch <[EMAIL PROTECTED]> wrote: > > > I tend to ag

Re: [Ganglia-developers] web front-end cross-scripting vulnerability

2007-12-05 Thread Bernard Li
Hi guys: On 12/5/07, Martin Knoblauch <[EMAIL PROTECTED]> wrote: > I tend to agree. Unless there is a critical functional bug in 3.0.5, we > should just do > a security release. This will be a plan. I will build 3.0.x snapshots with Alex's fixes shortly and post them to the website. Cheers,

Re: [Ganglia-developers] web front-end cross-scripting vulnerability

2007-12-05 Thread Martin Knoblauch
- Original Message > From: Brad Nicholes <[EMAIL PROTECTED]> > To: Matt Massie <[EMAIL PROTECTED]>; Bernard Li <[EMAIL PROTECTED]> > Cc: ganglia-developers@lists.sourceforge.net > Sent: Wednesday, December 5, 2007 10:59:42 PM > Subject: Re: [Ganglia-developers] web front-end cross-scriptin

[Ganglia-developers] metrics descriptor

2007-12-05 Thread Matthias Blankenhaus
Hi Brad ! Nice meeting you yesterday :-) I took a closer look at PCP to see what it uses for the meta level description for every metric. I thought this might be interesting for you. Here you go: - Data type: union of all C types, plus blob - Semantics: counter, instant, descrete - Units an

Re: [Ganglia-developers] XDR packet refactoring and additional metric metadata...

2007-12-05 Thread Bernard Li
Hi Brad: On 12/5/07, Brad Nicholes <[EMAIL PROTECTED]> wrote: > We could. I just thought that it might be easier for the web frontend if it > didn't have to worry about whether the TITLE existed or not and could just > count on it being there. I am guessing that moving forward an alternate us

Re: [Ganglia-developers] XDR packet refactoring and additional metric metadata...

2007-12-05 Thread Brad Nicholes
>>> On 12/5/2007 at 11:33 AM, in message <[EMAIL PROTECTED]>, Paul Millar <[EMAIL PROTECTED]> wrote: > On Thursday 29 November 2007 00:09:20 Brad Nicholes wrote: > [...] >> > > > TN="81296" TMAX="180" DMAX="0" SLOPE="both" SOURCE="gmond"> >> > >> > >> >> By default the is the same as the metric

Re: [Ganglia-developers] web front-end cross-scripting vulnerability

2007-12-05 Thread Brad Nicholes
>>> On 12/5/2007 at 12:22 PM, in message <[EMAIL PROTECTED]>, "Bernard Li" <[EMAIL PROTECTED]> wrote: > Hi guys: > > On 12/5/07, Matt Massie <[EMAIL PROTECTED]> wrote: > >> outstanding! >> >> i'll send all the details to you in a separate email. thanks for stepping >> up! > > I guess we should

Re: [Ganglia-developers] web front-end cross-scripting vulnerability

2007-12-05 Thread Bernard Li
Hi guys: On 12/5/07, Matt Massie <[EMAIL PROTECTED]> wrote: > outstanding! > > i'll send all the details to you in a separate email. thanks for stepping > up! I guess we should re-open the 3.0.x branch, backport the fixes from trunk and release 3.0.6 as a security bugfix release? Cheers, Bern

Re: [Ganglia-developers] XDR packet refactoring and ad ditional metric metadata...

2007-12-05 Thread Paul Millar
On Thursday 29 November 2007 00:09:20 Brad Nicholes wrote: [...] > > > TN="81296" TMAX="180" DMAX="0" SLOPE="both" SOURCE="gmond"> > > > > > > By default the is the same as the metric name. However > if you add a Title="blah" to any Metric{} block in gmond.conf file, that > title is reflected

Re: [Ganglia-developers] web front-end cross-scripting vulnerability

2007-12-05 Thread Matt Massie
outstanding! i'll send all the details to you in a separate email. thanks for stepping up! -matt On 12/5/07, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > Quoting Matt Massie <[EMAIL PROTECTED]>: > > > we need to systematically review all our template variable assignments > to > > make sure

Re: [Ganglia-developers] web front-end cross-scripting vulnerability

2007-12-05 Thread alex
Quoting Matt Massie <[EMAIL PROTECTED]>: > we need to systematically review all our template variable assignments to > make sure they are not vulnerable. is there someone on the team who would > like to step up to take the lead on this? i'd like to prevent publicly > explaining the vulnerability

[Ganglia-developers] web front-end cross-scripting vulnerability

2007-12-05 Thread Matt Massie
guys- i was just contacted by CERN about a cross-scripting vulnerability they found in our web front-end. i've just checked into subversion a quick fix to one known problem presented to me. we need to systematically review all our template variable assignments to make sure they are not vulnerabl