Buffalo Forums

Products => Storage => Topic started by: JamesAng on June 02, 2013, 11:18:26 PM

Title: [BUG]: Folder can be moved (and removed) using FTP client
Post by: JamesAng on June 02, 2013, 11:18:26 PM

Hi,

 

I just got a LS-QVL and set it up as a FTP server only.

 

Using the admin portal,

I created 2 user accounts and each account has 2 folders to hold private and public data.

ie. (priv_userA, pub_userA, priv_userB, pub_userB).

 

UserA & UserB: default profile for new user setup.

 

The folder for pub_userA (pub_userB) are set as follows,

- Shared Folder Attributes: Read & Write

- Recycle Bin: Disable

- Shared Folder Support: FTP only

- "Access Restrictions"

-- "Local Users"

--- User A (User B): Read & Write

--- User B (User A): Read only

 

The folder for priv_userA (priv_userB) are set as follows,

- Shared Folder Attributes: Read & Write

- Recycle Bin: Disable

- Shared Folder Support: FTP only

- "Access Restrictions"

-- "Local Users"

--- User A (User B): Read & Write

 

The structure (directory listing) is

/

|

+array1/ (auto-created by LS)

             |

             +priv_userA (only can be seen by UserA, read & write permission)

             +priv_userB (only can be seen by UserB, read & write permission)

             +pub_userA (can be seen by UserA & UserB, read & write permission for UserA, read-only permission for UserB)

             +pub_userB (can be seen by UserA & UserB, read-only permission for UserA, read & write permission for UserB)

 

The pub_ folder is to publish shared data while the priv_ folder is hidden from other users.

 

Using Filezilla, the permission to create (write) to the folders are adhered properly. User A cannot write or delete from User B's public folder.

 

But when a user drag a file/folder from a pub_ folder to another which he has write permission, the entire folder is moved using the RENAME FTP command! and the original folder no longer exists. Permission on pub_userA is violated by userB!

 

Below is the command log,

 

Status:                      Directory listing successful

Status:                      Renaming '/array1/pub_userA/iso-images' to '/array1/pub_userB/iso-images'

Command:               RNFR iso-images

Response:               350 File or directory exists, ready for destination name

Command:               RNTO /array1/pub_userB/iso-images

Response:               250 Rename successful

 

Please advise if I made any mistake in setting up the machine or is it a BUG on LS-QVL on the FTP rename command.

 

Firmware: v1.64 (DTCP-IP:1.64-20121203)

Browser ID: smf (is_webkit)
Templates: 1: Printpage (default).
Sub templates: 4: init, print_above, main, print_below.
Language files: 1: index+Modifications.english (default).
Style sheets: 0: .
Hooks called: 49 (show)
Files included: 27 - 1055KB. (show)
Memory used: 722KB.
Tokens: post-login.
Queries used: 14.

[Show Queries]