Site command, not able to restric

odd · 05-14-2005, 08:09 AM

Just found one thing that is a kinda security issue.

Im useing ioGroups and have overide site command "SITE USERS" from ioFTPD default to ioGroups. I was playing around with an anonymous account and found out that ANY one can use "SITE USERS"

Ive trippled checked my ioFTPD.ini to see if anything is wrong but cant find nothing. Here is what my ioFTPD.ini contains:

Code:

[FTP_Pre-Command_Events]
site 		= EXEC ..\scripts\iogroups\ioGroups.exe override_site_users

[FTP_Custom_Commands]
lusers    		= EXEC ..\scripts\iogroups\ioGroups.exe listusers

[FTP_SITE_Permissions]
users		= 1GM

Code:

Admin 		= flags 1M
Simple User 	= flags 3Ff
Anonymous 	= flags 3A

Everyone of abow can use "SITE USERS"
Can someone confirm this as I get the same on two ftpds.