patchMuddleftpd - Flexible, secure FTP Daemon - Patches: patch #647, adds basic scripting support...


You are not allowed to post comments on this tracker with your current authentication level.

patch #647: adds basic scripting support (preup,postup,dirname,postdel)

Submitted by:  Invalid User ID <#12539>
Submitted on:  Mon 11 Nov 2002 06:44:53 PM UTC  
Category:  addon Priority:  5 - Normal
Status:  None Privacy:  Public
Assigned to:  Beau Kuiper <rugger> Open/Closed:  Open

Tue 12 Nov 2002 04:35:25 AM UTC, comment #3: 

One suggestion.

There appears to be a race condition in your upload code. It can allow someone to:
1) Upload a file, then rename it before the system deletes it via FTP.
2) Upload a file, knowing it will be deleted, then rename another file into its place, where the system deletes it.

To fix this, you need to have muddleftpd upload to a temporary file, and then automaticly program the ACL's to deny access to filenames of that type.


add .temp to the filename automagicly when the user uploads it (where a script must decide to keep it or not) and then, if the server finds the configuration arguments that means it must run the script, execute

acllist_add(peer->acls, "*.temp", "NONE", TRUE);

There may be other race conditions in there to, so please check it out.

Also, I prefer unified diff patches to cvs patch since I can read them easier.

Thanks again.

Beau Kuiper <rugger>
Project AdministratorIn charge of this item.
Tue 12 Nov 2002 04:21:32 AM UTC, comment #2: 

Oh, its compressed :)

Silly me

Beau Kuiper <rugger>
Project AdministratorIn charge of this item.
Tue 12 Nov 2002 04:07:52 AM UTC, comment #1: 

Umm, I can't get the patch as text. I get a binary file when I as to view the Raw Patch.

If It is me, please tell me what I am doing wrong.

If it isn't me, and the patch is borked, please resubmit in text form.

Also be aware that I cannot add this patch to muddleftpd main, since it means breaking one of the security rules this server was built on. (ie, not to run external programs)

When I create a more general module system, this would be a good candidate for a module.

Beau Kuiper

Beau Kuiper <rugger>
Project AdministratorIn charge of this item.


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


Do you think this task is very important?
If so, you can add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.




Follows 1 latest change.

Date Changed by Updated Field Previous Value => Replaced by
2002-11-12 ganneff Assigned toNone => NA

Back to the top

Powered by Savane 3.5