CVS commit: [netbsd-3-0] src/libexec/ftpd

[Manuel Bouyer <bouyer%netbsd.org@localhost>]

Module Name:    src
Committed By:   bouyer
Date:           Thu Sep 18 19:31:33 UTC 2008

Modified Files:
        src/libexec/ftpd [netbsd-3-0]: version.h

Log Message:
Pull up following revision(s) (requested by lukem in ticket #1964):
        libexec/ftpd/ftpd.c: revision 1.187 via patch
        libexec/ftpd/extern.h: revision 1.58 via patch
        libexec/ftpd/ftpcmd.y: revision 1.88 via patch
        libexec/ftpd/version.h: patch
Don't split large commands into multiple commands; just fail on them.
This prevents CSRF-like attacks, when a web browser is used to access
an ftp server.
Reported by Maksymilian Arciemowicz <cxib%securityreason.com@localhost>.
Fix mostly derived from OpenBSD, written by Moritz Jodeit 
<moritz%OpenBSD.o@localhost=
rg>


To generate a diff of this commit:
cvs rdiff -r1.59 -r1.59.4.1 src/libexec/ftpd/version.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.