#802 Whole src directory deleted when deleted

closed-fixed
Compose (426)
5
2002-09-23
2002-07-25
Anonymous
No

I accidently added a non-existant attachment to a
message while composing by clicking the Add button
instead of Browse. No sweat, or so I thought. I
selected the blank attachment and clicked "Delete
selected attachment". I then got an error page and
subsequent efforts to get into SquirrelMail failed with a
404 trying to access src\login.php. When I checked on
my web server, the src directory was history. Not there,
zero , zilch, nada, gone!

So, I restored src from the zip. I confirmed that
everything was working fine and repeated the steps
above with the same results. I am running SquirrelMail
on IIS on a W2k server using php 4.2.1.

Discussion

  • Anonymous - 2002-07-25

    Logged In: YES
    user_id=442854

    I saw a copy of your message forwarded to the development
    list. I tested this out on a debian unstable box and instead
    of adding an emtpy attachment it gave me the apropriate
    error "could not copy/attach file" so this must be a
    windows/IIS specific problem.

    jason
    jason@stdbev.com

     
  • Thijs Kinkhorst

    Thijs Kinkhorst - 2002-07-28

    Logged In: YES
    user_id=285765

    More important: you have permissions for your files set
    incorrectly: there could be a bug in squirrelmail but
    standard security measures prevent the effect you've seen:
    *your web server should NEVER be able to write or delete
    files/directories it doesn't have to!*
    If you have the right permissions, the only thing that could
    happen when deleting a non-existant attachment, would be
    receiving some kind of error message. Deleting your whole
    src directory should never be physically possible by the
    webserver.

     
  • Nobody/Anonymous

    Logged In: NO

    It might be Windows, but it aint IIS...

    I'm running W2K server, Apache 1.3.26, PHP 4.2.2 and I get
    the same error...

    Also, if I attach a large file >3M i get the same error.
    The attachment get listed as "filname - application/octet-
    stream (0 k)" and the SRC directory is deleted.
    I can however add more than 3M of smaller files, so if I ad 15
    300K files that would be OK.

    Same problem with both Squrrelmail 1.2.7 and 1.3.1

    /Magnus

     
  • Nobody/Anonymous

    Logged In: NO

    An extra note....

    Once the empty attachment _or_ too large attachment have
    been added, the SRC directory is gone.... it has nothing to do
    with clicking the "Delete" button.

    /Magnus

     
  • Nobody/Anonymous

    Logged In: NO

    I did some more checking and Kink are correct !!!

    It all has to do with the crappy security settings in Windows.
    Once I've set the general permissions to read/execute only
    and opened up the "data" directory for modification it worked
    just fine....

    Adding an non-existing attachment gives the proper
    errormessage, and a larger attachment gives a PHP-timeout
    (the 30 secs).

    /Magnus

     
  • Thijs Kinkhorst

    Thijs Kinkhorst - 2002-09-23
    • assigned_to: nobody --> kink
    • status: open --> closed-fixed
     
  • Thijs Kinkhorst

    Thijs Kinkhorst - 2002-09-23

    Logged In: YES
    user_id=285765

    Some code was trying to move the src directory into the
    attachment dir if a user pressed Add Attachment when no file
    was selected. Under Windows with bad file permissions, this
    resulted in the src directory actually being moved. This is
    now fixed.

     

Log in to post a comment.

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:

JavaScript is required for this form.





No, thanks