'blind' download ftp folder inaccessible since 3.0.5 ~ 3.0.6 - 550 PWD

RESOLVED FIXED in mozilla11

Status

()

Core
Networking: FTP
RESOLVED FIXED
8 years ago
5 years ago

People

(Reporter: Johan Draaisma, Assigned: michal)

Tracking

1.9.1 Branch
mozilla11
x86
Windows XP
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [inbound])

Attachments

(1 attachment)

(Reporter)

Description

8 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6

Mozilla Firefox seems to have changed behaviour when it comes to accessing FTP sites. The newer versions _ALWAYS_ send a PWD command, where older versions did not. Unfortunately, when access to that command is denied by the server, it produces the error "550 PWD: Permission denied" and the download does not start!

If you open this URL in an older version of Firefox or in Internet Explorer, it will work. In Firefox 3.0.6 it certainly does not:

ftp://ftptest:testpassword@80.127.93.47/test.txt

As you can see from the URL, it directs Firefox to use the FTP protocol and to use the username ftptest and the password testpassword. These are valid credentials, you may test them in any FTP client. You will however not get a directory listing. This is because this is a so-called 'blind download' account. You may only download files that you know the full name of.

As I've said.. in other browsers such as IE7 and Opera it just works. Even barely older versions of Firefox work perfectly with this URL. The problem is that Firefox sends a PWD command while that is not necessary in my humble opinion. That wouldn't be so bad if Firefox would just continue the process and sent a RETR command so the file could be retrieved. Unfortunately it doesn't do that. It just stops at the error message.

I have resolved this problem on the server end by using a workaround by making an exception for PWD and XPWD commands so that the server is now 'Firefox-compatible". Obviously this is only a minor problem but it is a puzzling one to see in such a fine browser.

Reproducible: Always

Steps to Reproduce:
1. open Mozilla Firefox 3.0.6
2. open the URL: ftp://ftptest:testpassword@80.127.93.47/test.txt
3. enjoy the error message. no download!
Actual Results:  
An error message showed up:

Alert
550 PWD: Permission denied

Expected Results:  
It should have either opened the text file in the browser or offered me to save or open the file or.. something. Instead it just spat out an error while it did have the filename I wanted and it did have access to it (as any other browser can confirm)

This problem even occurred for me on a plain vanilla install of Firefox 3.0.6 English version.

The FTP server software I am using is ProFTPD 1.3.0 on ubuntu 7.04 on an x86 platform. I have created a user that has its home directory in /test on the server and is chrooted there. The file /test/test.txt belongs to nobody:nogroup and there are read rights on it. In /etc/proftpd/proftpd.conf I have added the following information to make sure the 'blind download' user ftptest has only the ability to retrieve files if the user knows the exact filename.

<Directory /test>
AllowOverwrite                  off
<Limit ALL>
DenyALL
</Limit>
<Limit RETR SIZE>
AllowALL
</Limit>
</Directory>

If I change the line <Limit RETR SIZE> to <Limit RETR SIZE XPWD PWD> then Firefox seems to be happy and it all starts working again. However, as I've said earlier.. Slightly older versions of Firefox such as 3.0.1 and 3.0.2 do not seem to have this problem at all.

I consider this a true bug as it breaks functionality when links in a webpage to blind download FTP servers are used. Or even where simply PWD is omitted or removed on purpose. Especially sites like element5.com like to do this - generate a unique filename and then link buyers to it so that only those that have the correct FTP URL will be able to download the file. I really hate having to tell my clients to use Internet Explorer to circumvent a bug in Firefox. Here's hoping it gets fixed :)
confirming with SM 1.9.1 branch on the given URL
Status: UNCONFIRMED → NEW
Component: General → Networking: FTP
Ever confirmed: true
Product: Firefox → Core
QA Contact: general → networking.ftp
Version: unspecified → 1.9.1 Branch
(Assignee)

Updated

8 years ago
Assignee: nobody → michal
(Assignee)

Comment 2

8 years ago
Created attachment 365646 [details] [diff] [review]
patch v1
Attachment #365646 - Flags: review?(bzbarsky)
Michal, I'm probably the wrong reviewer for this.  You want dougt or someone...

In any case, this seems to be a regression, right?  From what bug?
(Assignee)

Updated

8 years ago
Attachment #365646 - Flags: review?(bzbarsky) → review?(doug.turner)
(Assignee)

Comment 4

8 years ago
(In reply to comment #3)
> In any case, this seems to be a regression, right?  From what bug?

PWD command was added in nsFtpConnectionThread.cpp&rev=1.204 (2001-10-28 01:58) and unsuccessful PWD was always fatal (except revisions 1.259-1.260).
I'm having a hard time reconciling that with comment 0....
(Assignee)

Comment 6

8 years ago
I've tried several versions and all fail:

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8) Gecko/20060101 Firefox/1.5
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1b1) Gecko/20060808 BonEcho/2.0b1
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.3pre) Gecko/20070227 BonEcho/2.0.0.3pre
(Reporter)

Comment 7

8 years ago
Maybe my memory is playing up and maybe this problem was already present in previous versions. I do recall testing this FTP server when I set it up a few months ago with a browser, and since I always use Firefox I assumed it must have been an older version of Firefox. Perhaps I was mistaken and I tested it with Internet Explorer.

In any case, the problem is there, and as you can see other browsers work fine with the mentioned URL and Firefox does not.

Cheers,

Updated

8 years ago
Attachment #365646 - Flags: review?(doug.turner) → review+

Comment 8

8 years ago
Comment on attachment 365646 [details] [diff] [review]
patch v1

this is fine.  i have been running a bit seams to not cause any problems.
(Assignee)

Updated

8 years ago
Attachment #365646 - Flags: superreview?(cbiesinger)
Attachment #365646 - Flags: superreview?(cbiesinger) → superreview+
(Assignee)

Comment 9

6 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/4397ed1d2aa2
Whiteboard: [inbound]
Target Milestone: --- → mozilla11
https://hg.mozilla.org/mozilla-central/rev/4397ed1d2aa2

\o/
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.