Skip to content

Commit 99594b8

Browse files
committed
fix ftp based denial of service attack.
The autoreboot feature can be abused as you dont need a valid login to trigger the reboot. This fix will only auto reboot after you quit a logged in session.
1 parent 0075bc5 commit 99594b8

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

src/net/ftpworker.cpp

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1057,7 +1057,15 @@ bool CFTPWorker::RenameTo(const char* pArgs)
10571057

10581058
bool CFTPWorker::Bye(const char* pArgs)
10591059
{
1060-
SendStatus(TFTPStatus::ClosingControl, "Goodbye.");
1060+
if (!CheckLoggedIn())
1061+
{
1062+
SendStatus(TFTPStatus::ClosingControl, "Goodbye.");
1063+
delete m_pControlSocket;
1064+
m_pControlSocket = nullptr;
1065+
return true;
1066+
}
1067+
1068+
SendStatus(TFTPStatus::ClosingControl, "Goodbye. Rebooting");
10611069
delete m_pControlSocket;
10621070
m_pControlSocket = nullptr;
10631071

0 commit comments

Comments
 (0)