RE: IFS directory visibility from FTP

[Scott Klement <midrange-l@xxxxxxxxxxxxxxxx>]

Hi,

> Just make sure that you don?t enforce this with a simple compare of the
> first x bytes of the path - you have to resolve the dots.  For instance, if
> Fred can get to "/home/fred" don't just check that the request path starts
> with "/home/fred" because you can pass the check by using mget
> "/home/fred/../../qsys.lib/production.lib/payroll.file/*.mbr"

That's a good point, but it's not just dots...  Things like
"/home///////////fred" also have to be checked for.  The system will
treat all of the slashes together as if they were just one slash.

Probably the easiest way to ensure you're handling everything is to
actually change to the directory given, then retrieve the current
directory and compare THAT against what the user has specified.