bugmldonkey, a multi-networks file-sharing client - Bugs: bug #1373, Security: filename with a slash

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #1373: Security: filename with a slash

Submitted by:  None
Submitted on:  Wed 09 Oct 2002 01:36:13 AM UTC  
 
Category: CoreSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Assigned to: NoneOpen/Closed: Closed
Release: Release: 1.16
Operating System: LinuxBinaries Origin: Binary from Savannah
CPU type: None

Tue 04 Mar 2003 07:38:36 AM UTC, comment #1:

fixed in current CVS 2.02-25

mldonkey admin <mldonkey>
Project Administrator
Wed 09 Oct 2002 01:36:13 AM UTC, original submission:

When downloading a file called "this is/a file.zip", mldonkey will create a directory called "this is" and download a file called "a file.zip" inside. I don't think this should be allowed.
I haven't checked, but may be the same happens with a file called "../../../etc/passwd". Anyone?

I guess mldonkey should remove all /'s from the local file name.

Regards,
Ernesto
xtango"at"netcombbs.com.ar

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 2 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Tue 04 Mar 2003 07:38:36 AM UTCmldonkeyStatusNone=>(Error - Not Found)
  Open/ClosedOpen=>(Error - Not Found)

Back to the top


Powered by Savane 3.1-cleanup1