-
Notifications
You must be signed in to change notification settings - Fork 99
Fix and test MDTM command #24
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit properly resolves MDTM request filenames to locations within the CHROOT jail. Previously, requests were made relative to the filesystem root (/), instead of the server root (/srv/files/from/here). This allowed users to request MDTM on potentially sensitive files (/root, /home), while simultaneously denying legitimate requests within the shared directory. Note: all filesystem calls *must* be joined with the path to the server root (pathModule.join(self.root, filename)). fix #28 ref nodeftpd@57a9e5f ref nodeftpd#5 ref nodeftpd#9
Style aside, this reduces bugs. In this case, the return statement was indented such that it appeared to be part of the else block, whereas it was actually executed regardless. This makes the code more robust.
This string previously contained a <CRLF> sequence, when commands were still writing directly to the socket. ref nodeftpd#2 ref 22c8d17
Methods without a return statement (including an empty statement) implicitly return "undefined", limiting their usefullness. By returning "this" from any object method without another return value, we allow method calls to be chained together.
In this case, if we can't find or access a file, the distinction is irrelevant. The generic error message would hint that the file actually does exist, but is inaccessible for some other reason (insufficient permissions, etc.). This behavior could have been leveraged by a malicious user and should be removed.
Resolve file path more clearly
Previously, "self" was being used to maintain a pointer to the "this" value outside of the anonymous function. Instead, we use the native Function.bind(...) method to bind the method to the caller's namespace. Beyond removing a superfluous variable, this also prevents a user from mistakenly referencing "this" inside the anonymous function instead of "self".
This commit tests all branches of the MDTM command. It should accept requests for existing files and reject requests for invalid files.
Following the bug fixed at 322cf37, it's time to push an update.
Collaborator
Author
|
Merged at c75acb7 @sstur, would you mind pushing the update to https://www.npmjs.org/ ? |
Collaborator
|
Will version bump and npm publish.. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR addresses the following issues for the
MDTMcommand:It has been split into multiple commits to highlight each changeset. Please refer to each commit for a detailed explanation of the change, the reasoning, and the impact.