patchMuddleftpd - Flexible, secure FTP Daemon - Patches: patch #647, adds basic scripting support...

 
 

You are not allowed to post comments on this tracker with your current authentification level.

patch #647: adds basic scripting support (preup,postup,dirname,postdel)

Submitted by:  Invalid User ID <Invalid User ID>
Submitted on:  Mon 11 Nov 2002 06:44:53 PM UTC  
 
Category: addonPriority: 5 - Normal
Status: NonePrivacy: Public
Assigned to: Beau Kuiper <rugger>Open/Closed: Open

Tue 12 Nov 2002 04:35:25 AM UTC, comment #3:

One suggestion.

There appears to be a race condition in your upload code. It can allow someone to:
1) Upload a file, then rename it before the system deletes it via FTP.
2) Upload a file, knowing it will be deleted, then rename another file into its place, where the system deletes it.

To fix this, you need to have muddleftpd upload to a temporary file, and then automaticly program the ACL's to deny access to filenames of that type.

eg

add .temp to the filename automagicly when the user uploads it (where a script must decide to keep it or not) and then, if the server finds the configuration arguments that means it must run the script, execute

acllist_add(peer->acls, "*.temp", "NONE", TRUE);

There may be other race conditions in there to, so please check it out.

Also, I prefer unified diff patches to cvs patch since I can read them easier.

Thanks again.

Beau Kuiper <rugger>
Project AdministratorIn charge of this item.
Tue 12 Nov 2002 04:21:32 AM UTC, comment #2:

Oh, its compressed :)

Silly me

Beau Kuiper <rugger>
Project AdministratorIn charge of this item.
Tue 12 Nov 2002 04:07:52 AM UTC, comment #1:

Umm, I can't get the patch as text. I get a binary file when I as to view the Raw Patch.

If It is me, please tell me what I am doing wrong.

If it isn't me, and the patch is borked, please resubmit in text form.

Also be aware that I cannot add this patch to muddleftpd main, since it means breaking one of the security rules this server was built on. (ie, not to run external programs)

When I create a more general module system, this would be a good candidate for a module.

Thanks
Beau Kuiper

Beau Kuiper <rugger>
Project AdministratorIn charge of this item.

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follows 1 latest change.

Date Changed By Updated Field Previous Value => Replaced By
Tue 12 Nov 2002 12:00:09 AM UTCganneffAssigned toNone=>NA

Back to the top


Powered by Savane 3.1-cleanup