Opened 19 years ago
Last modified 19 years ago
#929 closed Bug report
Security issue: Invalid folder names created in file system
Reported by: | silversword411 | Owned by: | |
---|---|---|---|
Priority: | normal | Component: | FileZilla Server |
Keywords: | Cc: | silversword411, Tim Kosse | |
Component version: | Operating system type: | ||
Operating system version: |
Description
This seems to be an issue that should at least have an
option available to block invalid folder/files from
being created in the servers file system. Here is an
example of the folder names that were created (full log
file also attached):
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
MKD uploads/ /ÿÿk 97536ÿÿÿÿÿÿÿÿÿÿ/
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
257 Directory created successfully
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
MKD uploads/ /ÿÿk 97536ÿÿÿÿÿÿÿÿÿÿ/ÿÿÿÿÿÿÿÿÿt 22241ÿÿÿÿ/
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
257 Directory created successfully
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
MKD uploads/ /ÿÿk 97536ÿÿÿÿÿÿÿÿÿÿ/ÿÿÿÿÿÿÿÿÿt
22241ÿÿÿÿ/ÿÿÿÿÿÿÿÿÿP 63612ÿÿÿÿÿÿÿÿÿÿ/
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
257 Directory created successfully
Note that folders were created with spaces thruout the
name were created. Attempting to delete these folders
via standard windows file managers cause errors.
Only method I was able to find to delete the folders
was to use rmdir from command prompt on the parent
folder (uploads).
Thanks,
David Troesch
Change History (2)
comment:1 by , 19 years ago
comment:2 by , 19 years ago
I'm wondering if these folders are allowed to be created
with the windows API's because they are unicode compliant.
As an English version of XP here though, I don't want
unicode folders allowed because if you don't the folder
support loaded then it causes problems.
Maybe an option to block non-english folders would be a
feasable, reasonable workaround?
David Troesch
FileZilla only uses the function Windows itself provides. If
standard file managers can't delete them, I think the
standard file managers are broken.