Now does setegid() before seteuid(), since you can't setegid() if you aren't root.

[betaftpd] / cmds.c

diff --git a/cmds.c b/cmds.c
index 255b29335f0ba021c05f34455c10fe8a49ad36f0..cfb02689446f7d41302228460591d5a82f1f6fa9 100644 (file)
--- a/cmds.c
+++ b/cmds.c
@@ -25,6 +25,10 @@
 #include <stropts.h>
 #endif
 
+#if HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+ 
 #if HAVE_SYS_CONF_H
 #include <sys/conf.h>
 #endif
@@ -325,7 +329,7 @@ int cmd_pass(struct conn * const c)
                ) {
                        c->auth = 0;
                } else {
-                       c->auth = 3;
+                       c->auth = 4;
                }
        }
 #endif /* !WANT_NONROOT */
@@ -341,6 +345,7 @@ int cmd_pass(struct conn * const c)
                chdir(c->curr_dir);
                dump_file(c, 230, "welcome.msg");
 #endif
+               /* Have a different message for anonymous users? */
                numeric(c, 230, "User logged in.");
        }
        return 1;
@@ -411,8 +416,8 @@ int cmd_port(struct conn * const c)
 #endif
                bind(sock, (struct sockaddr *)&sin, sizeof(sin));
 #if !WANT_NONROOT
-               seteuid(c->uid);
                setegid(c->gid);
+               seteuid(c->uid);
 #endif
 
                f->sin.sin_family = AF_INET;
@@ -904,7 +909,7 @@ char conn_state[5][27] = {
        "Waiting for e-mail address",
        "Waiting for password",
        "Logged in",
-       "Waiting for password",         /* actually non-existant user */
+       "Logged in",            /* non-anonymous */
 };
 
 char ftran_state[6][42] = {
@@ -1554,7 +1559,7 @@ int cmd_rein(struct conn * const c)
  *             down without clearing any sockets etc. In other words:
  *             Don't use it on a production site.
  */
-void cmd_exit(struct conn * const c)
+int cmd_exit(struct conn * const c)
 {
        while (first_conn->next_conn)
                destroy_conn(first_conn->next_conn);
@@ -1607,8 +1612,8 @@ void parse_command(struct conn *c)
                                        seteuid(c->uid);
                                        setegid(c->gid);
                                } else {
-                                       seteuid(getuid());
                                        setegid(getgid());
+                                       seteuid(getuid());
                                }
 #endif