Prevention of resumable upload permissions on the FTP server
Assume that the ftpserver contains readme.txt, Which is 1000 bytes in size and 500 bytes in size. Okay. I started to do bad things.
1. Connect to the FTP server (the built-in ftp://ftp.exe/can be used without authorization on the Intranet, because ftp://ftp.exe/uses the portmode)
2、dir( readme.txt size, determined to be 1000 bytes)
3. Quote rest 1000 (tell the FTP server that the file I want to transfer starts from File Location 1000)
4. Send readme.txt
5 bytes dir( readme.txt size again, now readme. TXT is changed to 1500 bytes)
Is readme.txt larger? It is very simple because the 500-byte readme.txt of my local file is successfully uploaded and written to the readme.txt file of the 1000 byteson the FTP server. The problem lies in the second command. If there is no second command, my 4th command (send readme.txt) will get a permission deny error, the second command is to allow the FTP server to trust us to re-upload a breakpoint. If there is no second command, the FTP server will assume that we are performing an operation to overwrite the original file (overwriting the original file requires additional permissions ).
This problem only exists in the FTP service that allows resumable data transfer, but now the FTP service of 90% Program Resumable upload is allowed. Therefore, this problem exists on FTP servers.
Defense methods:
If you need to grant the upload permission to the user, the best precaution is that each user creates a directory for the user and completely locks the user's permissions in the directory, then the user has no permission to view the directories of other users, that is, it cannot cause the aforementioned damages.
