Page 1 of 1

SIZE with No directory list BUG

Posted: 2019-01-06 02:21
by jekit
Hi Everyone,

just discovered that if allowed only Read permission and No directory list, FileZilla server will not support SIZE command.
If you turn off Directory list, the server will not return file SIZE on size command.
Another FTP servers return file size in such case.

Anyone can reproduce this?
ver. 0.9.60.2

Thanks in advance

Re: SIZE with No directory list BUG

Posted: 2019-01-06 06:46
by boco
FileZilla Server does not support "blind" operation. Removing the List permission makes a directory inaccessible. That's intended and by design.

Re: SIZE with No directory list BUG

Posted: 2019-01-06 14:17
by jekit
boco wrote:
2019-01-06 06:46
FileZilla Server does not support "blind" operation.
Why not to add "blind" mode feature?
Please argue.

Re: SIZE with No directory list BUG

Posted: 2019-01-06 15:41
by boco
Nothing to argue, I'm not the dev.

Re: SIZE with No directory list BUG

Posted: 2019-01-06 18:18
by botg
No, what purpose would such an obscure configuration have?

Re: SIZE with No directory list BUG

Posted: 2019-01-08 17:46
by jekit
botg wrote:
2019-01-06 18:18
No, what purpose would such an obscure configuration have?
Just for anonymous FTP with directory list turned off. Some programs send SIZE command and get an error in this case.

I talk about only about SIZE behaviour not about 'blind' mode.
If the file available for download then the SIZE command must work.
Does not matter directory list turned on or off.

Re: SIZE with No directory list BUG

Posted: 2019-01-08 20:42
by boco
If the file available for download then the SIZE command must work.
Yes, but in FileZilla Server without List permission set, it isn't. Without List, you can neither download nor upload, no matter what other permissions you set.

FileZilla Server uses List as the master kill switch - unchecking List completely removes the directory+subs from the equation. Not displayed in file lists, not accessible in any way.

Re: SIZE with No directory list BUG

Posted: 2019-01-08 21:31
by botg
You are attempting to rely on security by obscurity, which is a deeply flawed concept. Just don't. If you don't want user A to download files from user B, create separate accounts for these users with different passwords.