Re: How do I force an FTP user to '/home/ftpdir'?

[Tom Hightower <tomh5480@xxxxxxxxx>]

rob@xxxxxxxxx said the following on 
2/21/2005 7:59 AM:
> Tom,
>
> Two area's of concern. 
> QIBM_QTMF_SVR_LOGON  Will be where you set initial directory.
> QIBM_QTMF_SERVER_REQ will be where you make sure that they do not go to 
> another directory.  Beware of a patch I need to make to my version, (as 
> pointed out on this list).  If you lock them down to a directory 
> /ftp/customer123/upload/*, the hack would be 
> /ftp/customer123/upload/../../customer456/upload
> It was suggested that I actually do the CD and then just check the 
> resultant directory against what directory was intended.
>
> Rob Berendt

I know I should just write something real intelligent, but in the case 
of '../..' - I just deny the command.  I figure they're not likely to 
enter that in a brower or GUI ftp client, and - if they're writing a 
script - they can enter each 'cd ..' on a separate line.

But mostly, I wasn't sure how to check to see where I wind up after 
doing '../..'.  Maybe when I have time to experiment...

Tom