[Xitami] exploite ?

[Francis Turner]

>
>
>
>Then how can something in the /upload dir suddenly become readable when
>the ftpdirs.aut read:
>
>[pub/upload]                                                                    
>Anonymous=PM
>
>the problems aint that someone uploades something but that the /upload dirs
>suddenly becomes readable for an anonymous user, seeems as xitami dont 
>check the access rights in ftpdirs.aut as it should.
>
Well if yout have ftproot/pub for anonymous and
ftproot/upload for upload (two separate directories with no links 
between them) then the problem goes away.

This isn't a bug it a feature (sort of). Basically Xitami inherits 
permissions from the parent specified and by means of the method of access.

In your case you appear to have defined pub/ as G and pub/upload/ as PM. 
Unfortunately this means that because you can get to pub/upload from pub 
the permissions from pub also apply to pub/upload.


Francis

-- 
"Education is when you read the fine print; 
  experience is what you get when you don't." Pete Seeger