SARG ChangeLog
Mar-03-2008 Version 2.2.5
- new fix to the script insertion vulnerability via user-agent report.
Javascript can still be executed via e.g. the "
" scheme
Thanks to Alin Rad Pop, Security Specialist, Secunia, Denmark
Mar-02-2008 version 2.2.4
- security issues can be exploited to execute arbitrary code when sarg
is used with malicious input files.
The vulnerability within the processing of the useragent.log is rather
critical, as this can be exploited by passing a long user agent string
when browsing via a squid proxy. the manipulated GET request in the
access log would not be accepted by squid, so that file has to be specially crafted.
Thank you to L4teral l4teral@gmail.com
- French language fixed.
Thanks to Nicod
- Fixed: Segfault in x86_64
Jan-02-2007 version 2.2.3.1
- fixed -m option to show all the used tags
- date period invalid in download reports
- wrong results when userid contain '%20' character
- previous reports info wrong in index.html
Dez/23/2006 Version 2.2.3
- gd graph font change from FreeSans.ttf to DejaVuSans.ttf
- minor fixes when only denied records in access.log file.
- ulimit tag changed. If you run sarg with a low privilege user,
set to 'none' to disable ulimit.
Thanks to Jorge Morgado
- Russian_UTF-8 language fixed by Igor Ageikin
- realtime_unauthenticated_records tag changed to show by default.
- chmod 755 in sarg-php due to errors in rpmbuild.
Thanks to Davide Madrisan
- when the keyword "anonymous" is used in squidGuard.conf, Sarg does
not find the log-files anymore.
Thanks to Daniel Vogel
- after reading the squidGuard configuration, the data read from the
usertab file was corrupted.
Thanks to Daniel Vogel
- milisec values showed as bytes. Thanks to Carlos
- with squidGuard, you can log groups in only one log file.
We must parse each log files only one time.
Thanks to Christophe BADINA
- error message(removetmp) Cannot open /tmp/sarg_tmp/../general
when sending report by email. Thanks to Peter Volkov
- incorrect off_t size in printf. In FreeBSD off_t is 64bit long long,
but sarg always use %d to display off_t in log processing. This cause garbage
while reading log files on a freebsd, and possible crash.
Thanks to Alex Samorukov
- squid24 on/off tag added in sarg.conf to implement compatibility if using
squid <= 2.4 and using squid common logs.
Thanks to Valter Dal Bo
- exclude_hosts and some code errors fixed by
Alexander Kozlov . Many thanks.
- temporary file names changed to sarg-... to avoid conflicts
with usernames. Thanks to Ukrainian Elephant
- SARG support Japanese wordset but not support charset.
submited by anonymous at sourceforge.net Many thanks.
- support for utf-8 character set added by Peter Warasin
. Many thanks.
- if all the data is at the hour each day, totaliza_day() treates it all as being
on the last day. This is observed for users which only download via a cron job
at the same time each day. Now the date and time will be
checked to see if changed.
Thanks to Ian Dall
- greport_day() doesn't add the volume for the first hour of each day to the total.
Thanks to Ian Dall
- Russian_koi8 and Russian_windows1251 languages updated by
Stas Degteff . Many thanks
- realtime reporting is sorted by URL, and not by Date/Time.
Thanks tp Puce-Xcit
Aug/29/2006 Version 2.2.2
- malloc test implemented to avoid high-memory consuming.
Thanks to Rodrigo Rubira Branco
- Czech UTF8 language added by Josef Karliak
- fixed: parsed mismatch in realtime_access_log_lines and
access_log_lines tags.
Thanks to Kuznetsov Andrey
- changed: realtime report sort changed by date/time
Thanks to Leonardo Buonsanti
- GD minor fixes added.
- bug fixed. *** buffer overflow detected ***: sarg terminated
in Fedora Core 5 when using -D FORTIFY_SOURCE in gcc or in kernel.
May/19/2006 Version 2.2.1
- iconv problems fixed in Freebsd and Slackware.
Thanks to Grigory Trenin .
- new word added to languages: Topuser
- missing fclose fp-in in css.c
Thanks to Renato Botelho .
- index.c fixed. Missing -r in reverse sort.
Thanks to Fernando Lemes da Silva
- wrong values in columns in-cache and out-cache.
Thanks to Hugo P S Costa
May/17/2006 Version 2.2
- sarg ported to 64 bits.
Thanks to Antonio F. Zago
to share your Fedora Core 5 64 bits with me.
- fixed conflict types for 'saverecs2' in .configure
- fixed no index.html when lastlog tag is greather then 0,
caused by some debug messages.
- removed some development debug message
- user_limit_block script added to block users when limit exceeded
- fixed wrong sort in index.html
- removed '+' argument to sort utility.
Thanks to Julio Cesar Covolato
- fixed "file too long" messages when using long_url
Thanks to Fabio Lo Votrico
- fixes and improvements from Oleg - Tanks.
. fprintf faster than sprintf+fputs (fixed in some places);
. strcpy+strcat is faster than sprintf (fixed in some places);
. unused variables removed;
. fixed headers look and feel (