Bug 534198 – net-ftp/pure-ftpd-1.0.36-r1 - anonymous upload deletes file in /home/ftp/pub/incoming/

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Juergen Rose 2015-01-01 13:03:08 UTC]

At the beginning I have one file in /home/ftp/pub/incoming/ at orca:

root@orca:/root(64)# date ; ll /home/ftp/pub/incoming/
Thu Jan  1 13:39:08 CET 2015
total 128
-rw-r--r-- 1 ftp ftp 129260 Jan  1 11:56 workflow.pdf

Twenty seconds later I upload a file from gepard as user ftp (anonymous):

rose@gepard:/home/rose(104)$ date ;  wput  training.gnumeric ftp://ftp@orca/pub/incoming/
Do 1. Jan 13:39:24 CET 2015
--13:39:24-- `training.gnumeric'
    => ftp://ftp:xxxxx@141.89.194.24:21/pub/incoming/training.gnumeric
Verbinden mit 141.89.194.24:21... verbunden! 
Anmeldung als ftp ... angemeldet!
Größe: 138,485
99% [==========================================================================>] 137,216          42.00K/s ETA    00s
13:39:31 (training.gnumeric) - `22.89K/s' [138485]

FERTIG --13:39:31--
Es wurden 138,485 Bytes in 1 Datei bei durchschnittlich 20.62K/s übertragen.


I can see this file on orca:

root@orca:/root(65)# date ; ll /home/ftp/pub/incoming/
Thu Jan  1 13:39:30 CET 2015
total 264
-rw-r--r-- 1 ftp ftp 138485 Jan  1 13:39 training.gnumeric
-rw-r--r-- 1 ftp ftp 129260 Jan  1 11:56 workflow.pdf
root@orca:/root(66)# date ; ll /home/ftp/pub/incoming/
Thu Jan  1 13:40:04 CET 2015
total 264
-rw-r--r-- 1 ftp ftp 138485 Jan  1 13:39 training.gnumeric
-rw-r--r-- 1 ftp ftp 129260 Jan  1 11:56 workflow.pdf

Again twenty seconds later I try to rewrite this file from gepard. This should fail, because it should be not allowed for user anonymous or ftp to overwrite existing files:

rose@gepard:/home/rose(105)$ date ;  wput  training.gnumeric ftp://ftp@orca/pub/incoming/
Do 1. Jan 13:40:24 CET 2015
--13:40:24-- `training.gnumeric'
    => ftp://ftp:xxxxx@141.89.194.24:21/pub/incoming/training.gnumeric
Verbinden mit 141.89.194.24:21... verbunden! 
Anmeldung als ftp ... angemeldet!
Send Failed (Anonymous users may not overwrite existing files) Überspringe diese Datei
FERTIG --13:40:25--
Die Übertragung von 1 Datei ist fehlgeschlagen.


From the client side it looks as expected (Transmission of 1 file failed), but at the server side I see that the file /pub/incoming/training.gnumeric is deleted:

root@orca:/root(67)# date ; ll /home/ftp/pub/incoming/
Thu Jan  1 13:40:32 CET 2015
total 128
-rw-r--r-- 1 ftp ftp 129260 Jan  1 11:56 workflow.pdf
root@orca:/root(68)# 

root@orca:/root(69)# emerge -pvD pure-ftpd

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R    ] net-ftp/pure-ftpd-1.0.36-r1  USE="ldap mysql pam postgres ssl -anondel -anonperm -anonren -anonres -caps -charconv -implicittls -noiplog -paranoidmsg -resolveids (-selinux) -sysquota -vchroot -xinetd" 477 KiB


Is this the expected behaviour? I do not see this behaviour at other ftp servers. 

root@orca:/root(72)# grep ^MISC /etc/conf.d/pure-ftpd
MISC_OTHER="-A -x -j -R -Z"

[Comment 1 Juergen Rose 2015-01-01 14:17:44 UTC]

I changed the permissions of /home/ftp/pub/incoming:

root@orca:/root(27)# ll -d /home/ftp/pub/incoming
drwxr-xr-x 2 ftp ftp 72 Jan  1 15:14 /home/ftp/pub/incoming/

But I have still the same effect.

[Comment 2 Conrad Kostecki 2022-04-17 11:59:45 UTC]

I was not able to reproduce in recent versions. Could you give a retry and re-open if it still persists?