mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-07-22 16:03:20 +00:00
Chris Lu
29981f8d24
* sftp: match permission paths on path-component boundaries Permission checks compared paths with raw string prefixes, so a permission entry for /tenants/alice also matched sibling paths such as /tenants/alice-archive, letting a scoped user read and overwrite another tenant's files. The home directory containment check had the same flaw. Route both through pathWithin, which cleans the paths and requires exact equality or a separator-delimited descendant. * sftp: clean permission path into a local when ranking matches
50 lines
844 B
JSON
50 lines
844 B
JSON
[
|
|
{
|
|
"Username": "admin",
|
|
"Password": "adminpassword",
|
|
"PublicKeys": [],
|
|
"HomeDir": "/",
|
|
"Permissions": {
|
|
"/": ["*"]
|
|
},
|
|
"Uid": 0,
|
|
"Gid": 0
|
|
},
|
|
{
|
|
"Username": "testuser",
|
|
"Password": "testuserpassword",
|
|
"PublicKeys": [],
|
|
"HomeDir": "/sftp/testuser",
|
|
"Permissions": {
|
|
"/sftp/testuser": ["*"]
|
|
},
|
|
"Uid": 1001,
|
|
"Gid": 1001
|
|
},
|
|
{
|
|
"Username": "readonly",
|
|
"Password": "readonlypassword",
|
|
"PublicKeys": [],
|
|
"HomeDir": "/public",
|
|
"Permissions": {
|
|
"/public": ["read", "list"]
|
|
},
|
|
"Uid": 1002,
|
|
"Gid": 1002
|
|
},
|
|
{
|
|
"Username": "scoped",
|
|
"Password": "scopedpassword",
|
|
"PublicKeys": [],
|
|
"HomeDir": "/",
|
|
"Permissions": {
|
|
"/tenants/alice": ["read", "write", "list"]
|
|
},
|
|
"Uid": 1003,
|
|
"Gid": 1003
|
|
}
|
|
]
|
|
|
|
|
|
|