Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@asylumfunk
Copy link
Collaborator

This PR addresses the following issues for the MDTM command:

It has been split into multiple commits to highlight each changeset. Please refer to each commit for a detailed explanation of the change, the reasoning, and the impact.

This commit properly resolves MDTM request filenames to locations within
the CHROOT jail. Previously, requests were made relative to the
filesystem root (/), instead of the server root (/srv/files/from/here).

This allowed users to request MDTM on potentially sensitive files
(/root, /home), while simultaneously denying legitimate requests within
the shared directory.

Note: all filesystem calls *must* be joined with the path to the server
root (pathModule.join(self.root, filename)).

fix #28
ref nodeftpd@57a9e5f
ref nodeftpd#5
ref nodeftpd#9
Style aside, this reduces bugs. In this case, the return statement was
indented such that it appeared to be part of the else block, whereas it
was actually executed regardless. This makes the code more robust.
This string previously contained a <CRLF> sequence, when commands were
still writing directly to the socket.

ref nodeftpd#2
ref 22c8d17
Methods without a return statement (including an empty statement)
implicitly return "undefined", limiting their usefullness. By
returning "this" from any object method without another return value, we
allow method calls to be chained together.
In this case, if we can't find or access a file, the distinction is
irrelevant.  The generic error message would hint that the file actually
does exist, but is inaccessible for some other reason (insufficient
permissions, etc.). This behavior could have been leveraged by a
malicious user and should be removed.
Resolve file path more clearly
Previously, "self" was being used to maintain a pointer to the "this"
value outside of the anonymous function. Instead, we use the native
Function.bind(...) method to bind the method to the caller's namespace.

Beyond removing a superfluous variable, this also prevents a user from
mistakenly referencing "this" inside the anonymous function instead of
"self".
This commit tests all branches of the MDTM command. It should accept
requests for existing files and reject requests for invalid files.
Following the bug fixed at 322cf37,
it's time to push an update.
asylumfunk added a commit that referenced this pull request Mar 7, 2014
Fix and test MDTM command
@asylumfunk asylumfunk merged commit c75acb7 into nodeftpd:master Mar 7, 2014
@asylumfunk
Copy link
Collaborator Author

Merged at c75acb7
Tagged at https://github.com/sstur/nodeftpd/tree/v0.2.7

@sstur, would you mind pushing the update to https://www.npmjs.org/ ?

@sstur
Copy link
Collaborator

sstur commented Mar 7, 2014

Will version bump and npm publish..

@asylumfunk asylumfunk deleted the i/28 branch March 9, 2014 01:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants