giampaolo / pyftpdlib

Extremely fast and scalable Python FTP server library
MIT License
1.65k stars 265 forks source link

format_mlsx not within "run_as_current_user" #593

Open isigold opened 1 year ago

isigold commented 1 year ago

I am using pyftpdlib to provide an FTP frontend to files indexed in a database using a class inherited from AbstractFS that retrieves the information from the database's API. The API is accessed using the credentials provided by the FTP-Client (set by a custom DummyAuthorizer). When implementing stat, I first used some static values and everything worked fine. The database's API also provides information like size etc. and I updated filesystem's stat-method to retrieve this information. Now, listing of a directory fails, as the API rejects the request.

Looking into the code, I found that in handler.py / ftp_MLSD only listdir is called within run_as_current_user. So the stat call later within format_mlsx is not called as current user (and therefore the credentials in the API-call are not set). I am not sure, why format_mlsx is not enclosed within run_as_current_user, as I would have assumed that any call on the filesystem should be run as the current user.

TLDR; AbstractFS.format_mlsx is called by FTPHandler without run_as_current_user, thereby filesystem has no user credentials available (for stat).