FTP server authority issue

Can anyone verify this:

A customer is running the OS/400 FTP server under V4R2. They have a
modified system library list that has a user library NEWSYS prior to QSYS
in which they have created versions of IBM commands - one of which is
CRTPF. All users have had authority revoked to the original commands in QSYS.
When running an FTP session, users authorized to the new CRTPF command can
run the command QUOTE RCMD CRTPF QGPL/myfile etc.. successfully. However
when they try to use PUT to send to the file QGPL/myfile (which does not
exist) they get an error "Unable to open or create target file MYFILE in
library QGPL". I've checked out the FTP server job log and the library list
does include NEWSYS in the library list ahead of QSYS. Interestingly the
server joblog error states "Not authorized to command CRTPF in library
QSYS". Has the FTP server program changed to use the CRTPF command in QSYS
explicitely? If so, this would seem to be a security hole.

Tim 
Tim McCarthy
TrailBlazer Systems Inc.
AS/400 E-Commerce communications
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---