CVS commit: src/libexec/ftpd

[Luke Mewburn <lukem%netbsd.org@localhost>]

Module Name:    src
Committed By:   lukem
Date:           Sat Sep 13 03:30:35 UTC 2008

Modified Files:
        src/libexec/ftpd: extern.h ftpcmd.y ftpd.c version.h

Log Message:
Don't split large commands into multiple commands; just fail on them.
This prevents CSRF-like attacks, when a web browser is used to access
an ftp server.
Reported by Maksymilian Arciemowicz <cxib%securityreason.com@localhost>.
Fix mostly derived from OpenBSD, written by Moritz Jodeit 
<moritz%OpenBSD.org@localhost>


To generate a diff of this commit:
cvs rdiff -r1.57 -r1.58 src/libexec/ftpd/extern.h
cvs rdiff -r1.87 -r1.88 src/libexec/ftpd/ftpcmd.y
cvs rdiff -r1.186 -r1.187 src/libexec/ftpd/ftpd.c
cvs rdiff -r1.68 -r1.69 src/libexec/ftpd/version.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.