Bug in [Change-Permissions]

Zer0Racer · 06-21-2003, 10:12 AM

When testing gadmin stuff I stumbled onto something...

Seems gadmins (users with G flag) AND regular users can access certain commands that they are not supposed to.

When gadmin/user tries to SITE CHANGE groups other than their own and users NOT in gadmin's primary group:

Code:

[Change-Permissions]
admingroup        = 1M		Permissions denied.
credits           = 1M		Permissions denied.
flags             = 1M		Permissions denied.
groupdescription  = 1M		Command successful. <-- Bug!
groupslots        = 1M		Command successful. <-- Bug!
groupvfsfile      = M		Command successful. <-- Bug!
homedir           = 1GM		User is not in your primary group. Command successful. (but no change)
logins            = 1M		Permission denied.
passwd            = 1GM		User is not in your primary group. Command successful. (but no change)
ratio             = 1GM		User is not in your primary group. Command successful. (but no change)
stats             = M		Permission denied.
tagline           = 1GM		User is not in your primary group. Command successful. (but no change)
vfsfile           = M		Permission denied.

Only tested on ioFTPD 4.9.4r.

Pichento · 06-21-2003, 11:38 AM

I can only confirm the bug.

Gadmins can also exeed their slot allocations and still add users if they want to - above slot allocations.

Had to clean up one messy userdb after 90% decided to add more users than their allocations (slots).

Zer0Racer · 06-22-2003, 01:33 PM

Fixed in next version. Closing this thread.