[ https://issues.apache.org/jira/browse/FTPSERVER-387?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Niklas Gustavsson updated FTPSERVER-387: ---------------------------------------- Fix Version/s: 1.0.5 > Disabling a user appears to have no effect > ------------------------------------------ > > Key: FTPSERVER-387 > URL: https://issues.apache.org/jira/browse/FTPSERVER-387 > Project: FtpServer > Issue Type: Bug > Components: Server > Affects Versions: 1.0.4 > Environment: WinXP > Reporter: Chris Birchall > Fix For: 1.0.5 > > > Using PropertiesUserManager, setting a user's "enableflag" to false does not > prevent the user from logging in, downloading files, etc. > Here is the users.properties file: > ======= > # Password is "admin" > ftpserver.user.admin.userpassword=21232F297A57A5A743894A0E4A801FC3 > ftpserver.user.admin.homedirectory=./res/home > ftpserver.user.admin.enableflag=true > ftpserver.user.admin.writepermission=true > ftpserver.user.admin.maxloginnumber=0 > ftpserver.user.admin.maxloginperip=0 > ftpserver.user.admin.idletime=0 > ftpserver.user.admin.uploadrate=0 > ftpserver.user.admin.downloadrate=0 > ftpserver.user.anonymous.userpassword= > ftpserver.user.anonymous.homedirectory=./res/home > ftpserver.user.anonymous.enableflag=true > ftpserver.user.anonymous.writepermission=false > ftpserver.user.anonymous.maxloginnumber=20 > ftpserver.user.anonymous.maxloginperip=2 > ftpserver.user.anonymous.idletime=300 > ftpserver.user.anonymous.uploadrate=4800 > ftpserver.user.anonymous.downloadrate=4800 > # Password is "admin" > ftpserver.user.chris.userpassword=21232F297A57A5A743894A0E4A801FC3 > ftpserver.user.chris.homedirectory=./res/home > ftpserver.user.chris.enableflag=false > ftpserver.user.chris.writepermission=false > ftpserver.user.chris.maxloginnumber=20 > ftpserver.user.chris.maxloginperip=2 > ftpserver.user.chris.idletime=300 > ftpserver.user.chris.uploadrate=4800 > ftpserver.user.chris.downloadrate=4800 > ========= > User 'chris' can successfully login and download a file, even though he is > disabled. > The DESCUSER command shows the user as disabled: > ======= > コマンド: SITE DESCUSER chris > 応答: 200- > 応答: userid : chris > 応答: userpassword : ******** > 応答: homedirectory : ./res/home > 応答: writepermission : false > 応答: enableflag : false > 応答: idletime : 300 > 応答: uploadrate : 0 > 応答: 200 downloadrate : 0 > ======= > I did a quick check of the source, and the only place I could find a check of > org.apache.ftpserver.ftplet.User#getEnabled() was in the SITE_DESCUSER > class. So it appears that at login time a user's enabled/disabled status is > never checked. -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online.