Re: Ftpfs security hole particulary fixed


I tested MC on a few sites and found that it doesn't work on It shows the top-level directory, but show nothing in /pub. Here's the log:

227 Entering Passive Mode (204,152,184,75,238,199)
LIST -la /pub/.
150 Opening ASCII mode data connection for '/bin/ls'.
226 Transfer complete.

I think that "LIST -la /pub" would have chances to work on more systems.

Not at Single way is "cd then ls" ;-(
Can you report this problem to NetBSD-ftpd developers?

MC before your patch doesn't work on at all. But you probably didn't go far enough to eliminate all trailing dots.

 /* Trailing "/." is necessary if remote_path is a symlink
           but don't generate "//." */

Maybe trailing "/" is sufficient? Besides, is not a symlink. Maybe the code isn't doing what the comment says?

It does, but I have not access to amiga ftp server.
Trailing "/." removed for Amiga server in translate(),
but remote_is_amiga ignored in dir_load().
BTW, why do you complain against "LIST -laL"?

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]