Custom Query (8117 matches)

When FileZilla is told to trust a self-signed certificate, that certificate will be accepted for any connection. For example, if I trust a certificate from some random guy for my connection to ftp.randomguy.net, that certificate will also be treated as valid for filezilla-project.org, google.com, sourceforge.net and so on.

The certificate (or rather FileZillas trust in the certificate) ought to be bound to a specific hostname or to a specific site in the site manager.

Steps to reproduce the problem:

1. Generate a valid self-signed certificate and configure an FTP server to use it.
2. Connect to the server with FileZilla and choose to trust the certificate.
3. Copy the same certificate to a different FTP server (and set it up).
4. Connect to this second server with FileZilla.

The result: FileZilla connects without warnings to the second server, even though the certificate belongs to a completely different server.

Software versions: FileZilla 3.3.4.1, GnuTLS 2.8.6

RFC 959: "upon successful completion of an MKD command, the server should return a line of the form:

257<space>"<directory-name>"<space><commentary>

FileZilla returns: C: MKD Folder1 S: 257 Directory created successfully

Leading spaces are truncated by MKD commands. Same issue also exists for files.

S: 220-FileZilla Server version 0.9.36 beta
S: 220-written by Tim Kosse (Tim.Kosse@gmx.de)
S: 220 Please visit http://sourceforge.net/projects/filezilla/
...
C: MKD  Folder1
S: 257 Directory created successfully
C: MKD Folder1
S: 550 Directory already exists