@@ -342,48 +342,46 @@ class ftpd {
342342 */
343343 const CWD = function ( cmd , arg ) {
344344 let newPath = arg
345- if ( main . _useHdl === false ) {
346- if ( newPath . charAt ( 0 ) === '/' ) {
347- let folder = path . join ( basefolder , newPath )
348- if ( fs . existsSync ( folder ) === true && fs . statSync ( folder ) . isDirectory ( ) === true && main . _beginsWith ( basefolder , folder ) === true ) {
349- if ( folder . charAt ( folder . length - 1 ) !== '/' ) {
350- folder += '/'
351- }
352- if ( newPath . charAt ( newPath . length - 1 ) !== '/' ) {
353- newPath += '/'
354- }
355- absolutePath = folder
356- relativePath = newPath
357- return main . _writeToSocket ( socket , '250' , ' ' , `CWD successful. "${ relativePath } " is current directory` , connectionInfo , SocketStateAfterWrite . Open )
345+ if ( newPath . charAt ( 0 ) === '/' ) {
346+ let folder = path . join ( basefolder , newPath )
347+ if ( isValidFolder ( folder ) === true || main . _useHdl === true ) {
348+ if ( folder . charAt ( folder . length - 1 ) !== '/' ) {
349+ folder += '/'
358350 }
359- } else if ( newPath !== '..' ) {
360- let folder = path . join ( basefolder , relativePath , newPath )
361- if ( fs . existsSync ( folder ) === true && fs . statSync ( folder ) . isDirectory ( ) === true && main . _beginsWith ( basefolder , folder ) === true ) {
362- if ( folder . charAt ( folder . length - 1 ) !== '/' ) {
363- folder += '/'
364- }
365- if ( newPath . charAt ( newPath . length - 1 ) !== '/' ) {
366- newPath += '/'
367- }
368- absolutePath = folder
369- relativePath += newPath
370- return main . _writeToSocket ( socket , '250' , ' ' , `CWD successful. "${ relativePath } " is current directory` , connectionInfo , SocketStateAfterWrite . Open )
351+ if ( newPath . charAt ( newPath . length - 1 ) !== '/' ) {
352+ newPath += '/'
371353 }
372- } else if ( newPath === '..' ) {
373- if ( relativePath !== '/' ) {
374- newPath = relativePath . split ( '/' )
375- newPath . pop ( )
376- newPath . pop ( )
377- newPath = newPath . join ( '/' ) + '/'
378- const folder = path . join ( basefolder , newPath )
379- if ( fs . existsSync ( folder ) === true && fs . statSync ( folder ) . isDirectory ( ) === true && main . _beginsWith ( basefolder , folder ) === true ) {
380- absolutePath = folder
381- relativePath = newPath
382- return main . _writeToSocket ( socket , '250' , ' ' , `CWD successful. "${ relativePath } " is current directory` , connectionInfo , SocketStateAfterWrite . Open )
383- }
384- } else {
354+ absolutePath = folder
355+ relativePath = newPath
356+ return main . _writeToSocket ( socket , '250' , ' ' , `CWD successful. "${ relativePath } " is current directory` , connectionInfo , SocketStateAfterWrite . Open )
357+ }
358+ } else if ( newPath !== '..' ) {
359+ let folder = path . join ( basefolder , relativePath , newPath )
360+ if ( isValidFolder ( folder ) === true || main . _useHdl === true ) {
361+ if ( folder . charAt ( folder . length - 1 ) !== '/' ) {
362+ folder += '/'
363+ }
364+ if ( newPath . charAt ( newPath . length - 1 ) !== '/' ) {
365+ newPath += '/'
366+ }
367+ absolutePath = folder
368+ relativePath += newPath
369+ return main . _writeToSocket ( socket , '250' , ' ' , `CWD successful. "${ relativePath } " is current directory` , connectionInfo , SocketStateAfterWrite . Open )
370+ }
371+ } else if ( newPath === '..' ) {
372+ if ( relativePath !== '/' ) {
373+ newPath = relativePath . split ( '/' )
374+ newPath . pop ( )
375+ newPath . pop ( )
376+ newPath = newPath . join ( '/' ) + '/'
377+ const folder = path . join ( basefolder , newPath )
378+ if ( isValidFolder ( folder ) === true || main . _useHdl === true ) {
379+ absolutePath = folder
380+ relativePath = newPath
385381 return main . _writeToSocket ( socket , '250' , ' ' , `CWD successful. "${ relativePath } " is current directory` , connectionInfo , SocketStateAfterWrite . Open )
386382 }
383+ } else {
384+ return main . _writeToSocket ( socket , '250' , ' ' , `CWD successful. "${ relativePath } " is current directory` , connectionInfo , SocketStateAfterWrite . Open )
387385 }
388386 }
389387 return main . _writeToSocket ( socket , '530' , ' ' , 'CWD not successful' , connectionInfo , SocketStateAfterWrite . Open )
@@ -1019,6 +1017,10 @@ class ftpd {
10191017 main . _writeToSocket ( socket , '501' , ' ' , 'Command failed' , connectionInfo , SocketStateAfterWrite . Open )
10201018 }
10211019 }
1020+
1021+ const isValidFolder = function ( folder ) {
1022+ return fs . existsSync ( folder ) === true && fs . statSync ( folder ) . isDirectory ( ) === true && main . _beginsWith ( basefolder , folder ) === true
1023+ }
10221024 }
10231025
10241026 _informLogin ( username , remoteAddr ) {
0 commit comments