RE: IFS directory visibility from FTP

[rob@xxxxxxxxx]

Cool idea!

Rob Berendt
--
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com


|-----------------------------+-------------------------------------------|
|   Scott Klement             |                                           |
|   <midrange-l@xxxxxxxxxxxxxx|                                           |
|   om>                       |                                         To|
|   Sent by:                  |                                      Midra|
|   midrange-l-bounces@midrang|                                      nge  |
|   e.com                     |                                      Syste|
|                             |                                      ms   |
|   08/11/2004 05:25 PM       |                                      Techn|
|                             |                                      ical |
|         Please respond to   |                                      Discu|
|         Midrange Systems    |                                      ssion|
|       Technical Discussion  |                                      <midr|
|      <midrange-l@xxxxxxxxxxx|                                      ange-|
|                m>           |                                      l@mid|
|                             |                                      range|
|                             |                                      .com>|
|                             |                                         cc|
|                             |                                           |
|                             |                                     Fax to|
|                             |                                           |
|                             |                                    Subject|
|                             |                                      RE:  |
|                             |                                      IFS  |
|                             |                                      direc|
|                             |                                      tory |
|                             |                                      visib|
|                             |                                      ility|
|                             |                                      from |
|                             |                                      FTP  |
|                             |                                           |
|                             |                                           |
|                             |                                           |
|                             |                                           |
|                             |                                           |
|                             |                                           |
|-----------------------------+-------------------------------------------|







Hi,

> Just make sure that you donât enforce this with a simple compare of the
> first x bytes of the path - you have to resolve the dots. ÂFor instance,
if
> Fred can get to "/home/fred" don't just check that the request path
starts
> with "/home/fred" because you can pass the check by using mget
> "/home/fred/../../qsys.lib/production.lib/payroll.file/*.mbr"

That's a good point, but it's not just dots... ÂThings like
"/home///////////fred" also have to be checked for. ÂThe system will
treat all of the slashes together as if they were just one slash.

Probably the easiest way to ensure you're handling everything is to
actually change to the directory given, then retrieve the current
directory and compare THAT against what the user has specified.



--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.