server lets you use .. outside root

[kimihia]

You can use '..' to see below the root of a directory.

ftp> ls ..
200 Port command successful
150 Opening data channel for directory list.
site1
site2
226 Transfer OK

For example, directories are set up like so:

c:\ftp
c:\ftp\site1
c:\ftp\site2

I have a user "anonymous" set up as follows:

c:\ftp\site1
Files: read
Directories: list, subdirs
Show relative paths

0.6.0 beta.

[kimihia]

Still a problem in 0.7.0.

[Tim Kosse]

Thanks for reporting this security hole, fixed in FileZilla Server
0.7.2