Subject: uploads any patches ?

From: Alain Magloire <[email-masked]>
Date: Wed, 30 Oct 1996 22:27:34 -0500 (EST)

Kenneth Simler wrote:
[.. deleted ..]
:      I had started thinking that I would build the beta, but then I noticed
: a line in FIXES-2.4.2-BETA-11 that said the new ftpaccess man page was
: updated to clarify that the home directory listed in the upload directive
: MUST match the directory in /etc/passwd.
: 

:-) yes. the culprit is extensions.c(upl_check()):

      match_value = -1;
      i = match_value;
      while (getaclentry("upload", &entry) && ARG0 && ARG1 && ARG2 != NULL) {
+         if ( (!strcmp(ARG0, pw->pw_dir)) &&
           ((i = path_compare(ARG1, cwdir)) >= match_value) ) {
              match_value = i;
...
...
          }
...
...
      /* if we did get matches... ..else don't do any of this stuff */
      if (match_value >= 0) {
...
...
      } else {
          /*
           * upload defaults to "permitted"
           */
          return(1);
      }

If you don't have the same entry in the passwd and for upload the
strcmp(ARG0, pw->pw_dir) will return != 0. Hence the if will fail
and match_value never update. 

Upload will be __permitted anywhere__ in spite of whatever you put
in your ftpaccess.

I remembered some __Long__ midnight shift over that strcmp().
Until I patched out of the sky(Felt sooooo good, especially
when it was 3:00 AM and I wanted to go home >:<

I mean when you have:

upload /home/ftp * no

It's pretty clear that you don't want uploading !!!!

Can somebody come up with a reason, a ... anything on the existence
of that mischievous "strcmp(ARG0, pw->pw_dir)", .. aside
from making sys adms and ISP's loose sanity.

--
bonne nuit, alain

---

From: Bob Myers <[email-masked]>
Date: Wed, 30 Oct 1996 19:48:53 -0800

> from making sys adms and ISP's loose sanity.

Virtual hosting and guestgroups, where you have multiple "users"
on different virtual hosts or guests you want to restrict using the
upload command.

-- 
Bob Myers                              InteleNet Communications, Inc.
Email: [email-masked]               30 Executive Park, Suite 150
Phone: 714-851-8250 x227               Irvine, CA 92614
Fax:   714-851-1088                    http://www.intelenet.net/