From 7367647d40d9b43d529d952d3a063d53606697cb Mon Sep 17 00:00:00 2001
From: ritt <stefan.ritt@psi.ch>
Date: Mon, 9 Dec 2019 13:13:43 +0100
Subject: [PATCH] Implemented "Allow clone" configuration setting

---
 doc/config.html |  6 +++++-
 src/elogd.c     | 22 ++++++++++++++++------
 2 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/doc/config.html b/doc/config.html
index cd45b922..40f3effb 100755
--- a/doc/config.html
+++ b/doc/config.html
@@ -3025,7 +3025,11 @@ elogd -C http://master.your.domain
       <pre>
 elogd -C https://master.your.domain
 </pre>
-      for a remote server running under the SSL protocol.
+      for a remote server running under the SSL protocol. Note that you
+      have to put "Allow clone = 1" temporarily into the elogd.cfg file of
+      your existing server to allow cloning. This opens a password-free
+      access to your existing server, so remove it immediately after you
+      finished cloning.
       <p>
          This command tells elogd to retrieve the configuration file, and
          optionally all logbook entries and password files from the master
diff --git a/src/elogd.c b/src/elogd.c
index 05b45cf2..56304b00 100755
--- a/src/elogd.c
+++ b/src/elogd.c
@@ -22908,10 +22908,10 @@ void submit_elog(LOGBOOK *lbs) {
    } else
       n_attr = lbs->n_attr;
 
-
    /* check for editing interval */
-   if (!check_edit_time(lbs, atoi(getparam("edit_id"))))
-      return;
+   if (isparam("edit_id"))
+      if (!check_edit_time(lbs, atoi(getparam("edit_id"))))
+         return;
 
    /* check for required attributs */
    missing = 0;
@@ -24037,7 +24037,7 @@ int is_inline_attachment(char *encoding, int message_id, char *text, int i, char
       strlcpy(att_enc, att, sizeof(att_enc));
       att_enc[13] = '/';
       pt = text;
-      while (stristr(pt, att_enc)) {
+      while (*pt && stristr(pt, att_enc)) {
          /* make sure that it's really an inline image */
          for (p = stristr(pt, att_enc); p > pt; p--)
             if (*p == '<')
@@ -24051,7 +24051,7 @@ int is_inline_attachment(char *encoding, int message_id, char *text, int i, char
       }
       retrieve_domain(domain, sizeof(domain));
       sprintf(str, "cid:att%d@%s", i, domain);
-      if (stristr(text, str))
+      if (*text && stristr(text, str))
          return 1;
    }
 
@@ -29102,7 +29102,17 @@ int process_http_request(const char *request, int i_conn) {
    }
 
    if (!logbook[0] && global_cmd[0] && stricmp(global_cmd, "GetConfig") == 0) {
-      download_config();
+      char allow[256];
+      allow[0] = 0;
+      getcfg("global", "Allow clone", allow, sizeof(allow));
+      if (atoi(allow) == 1)
+         download_config();
+      else {
+         show_http_header(NULL, FALSE, NULL);
+         rsputs(loc("Cloning not allowed. Set \"Allow clone = 1\" to enable cloning."));
+         rsputs("\r\n");
+         return 1;
+      }
    } else if (stricmp(global_cmd, "gettimedate") == 0) {
       if (!getcfg(logbook, "Time format", format, sizeof(format)))
          strcpy(format, DEFAULT_TIME_FORMAT);