Re: Ftpfs security hole particulary fixed



Hello!


I tested MC on a few sites and found that it doesn't work on ftp.netbsd.org. It shows the top-level directory, but show nothing in /pub. Here's the log:
PASV
227 Entering Passive Mode (204,152,184,75,238,199)
LIST -la /pub/.
150 Opening ASCII mode data connection for '/bin/ls'.
226 Transfer complete.

I think that "LIST -la /pub" would have chances to work on more systems.
Not at ftp.netbsd.org. Single way is "cd then ls" ;-(
Can you report this problem to NetBSD-ftpd developers?

MC before your patch doesn't work on ftp.netbsd.org at all.  But you 
probably didn't go far enough to eliminate all trailing dots.

 /* Trailing "/." is necessary if remote_path is a symlink
           but don't generate "//." */

Maybe trailing "/" is sufficient?  Besides, ftp.netbsd.org/pub is not a 
symlink.  Maybe the code isn't doing what the comment says?

It does, but I have not access to amiga ftp server.
Trailing "/." removed for Amiga server in translate(),
but remote_is_amiga ignored in dir_load().
BTW, why do you complain against "LIST -laL"?




[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]