Pyftpdlib

Latest version: v1.5.9

Safety actively analyzes 630254 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 3 of 5

1.3.0

Not secure
=================================

**Enhancements**

- 253: benchmark script's new --timeout option.
- 270: new -V / --verbose cmdline option to enable a more verbose logging.

**Bug fixes**

- 254: bench.py script hadn't been ported to Python 3.
- 263: MultiprocessFTPServer leaks memory and file descriptors. (patch by
Juan J. Martinez)
- 265: FTPServer class cannot be used with Circus.
- 272: pyftpdlib fails when imported on OpenBSD because of Python bug
http://bugs.python.org/issue3770
- 273: IOLoop.fileno() on BSD systems raises AttributeError. (patch by
Michael Ross)

1.2.0

Not secure
=================================

**Enhancements**

- 250: added FTPServer's backlog argument controlling the queue of accepted
connections.
- 251: IOLoop.fileno() method for epoll() and kqueue() pollers.
- 252: FTPServer 'address' parameter can also be an existent socket object.

**Bug fixes**

- 245: ThreadedFTPServer hogs all CPU resources after a client connects.

1.1.0

Not secure
=================================

**Enhancements**

- 240: enabled "python -m pyftpdlib" cmdline syntax and got rid of
"python -m pyftpdlib.ftpserver" syntax which was deprecated in 1.0.0.
- 241: empty passwords are now allowed for anonymous and other users.
- 244: pysendfile is no longer a dependency if we're on Python >= 3.3 as
os.sendfile() will be used instead.
- 247: on python 3.3 use time.monotonic() instead of time.time() so that the
scheduler won't break in case of system clock updates.
- 248: bench.py memory usage is highly overestimated.

**Bug fixes**

- 238: username is not logged in case of failed authentication.
(patch by tlockert)
- 243: an erroneous error message is given in case the address passed to
bind() is already in use.
- 245: ThreadedFTPServer hogs all CPU resources after a client connects.
- 246: ThrottledDTPHandler was broken.

**Incompatible API changes**

- "python -m pyftpdlib.ftpserver" cmdline syntax doesn't work anymore

1.0.1

Not secure
=================================

**Bug fixes**

- 236: MultiprocessFTPServer and ThreadedFTPServer hanging in case of failed
authentication.

1.0.0

Not secure
=================================

**Enhancements**

- 76: python 3.x porting.
- 198: full unicode support (RFC-2640).
- 203: asyncore IO loop has been rewritten from scratch and now supports
epoll() on Linux and kqueue() on OSX/BSD.
Also select() (Windows) and poll() pollers have been rewritten
resulting in pyftpdlib being an order of magnitude faster and more
scalable than ever.
- 204: a new FilesystemError exception class is available in order send
custom error strings to client from an AbstracteFS subclass.
- 207: added on_connect() and on_disconnect() callback methods to FTPHandler
class.
- 212: provided two new classes:
Logging_managementpyftpdlib.servers.ThreadedFTPServer and
pyftpdlib.servers.MultiprocessFTPServer (POSIX only).
They can be used to change the base async-based concurrecy model and
use a multiple threads / processes based approach instead.
Your FTPHandler subclasses will finally be free to block! ;)
- 219: it is not possible to instantiate different FPTS classes using
different SSL certificates.
- 213: DummyAuthorizer.validate_authentication() has changed in that it
no longer returns a bool but instead raises AuthenticationFailed()
exception to signal a failed authentication.
This has been done in order allow customized error messages on failed
auth. Also it now expects a third 'handler' argument which is passed in
order to allow IP-based authentication logic. Existing code overriding
validate_authentication() must be changed in accordance.
- 223: ftpserver.py has been split in submodules.
- 225: logging module is now used for logging. ftpserver.py's log(), logline()
and logerror() functions are deprecated.
- 231: FTPHandler.ftp_* methods implementing filesystem-related commands
now return a meaningful value on success (tipically the path name).
- 234: FTPHandler and DTPHandler class provide a nice __repr__.
- 235: FTPServer.serve_forever() has a new handle_exit parameter which
can be set to False in order to avoid handling SIGTERM/SIGINT signals
and logging server start and stop.
- 236: big logging refactoring; by default only useful messages are logged
(as opposed to *all* commands and responses exchanged by client and
server). Also, FTPHandler has a new 'log_prefix' attribute which can
be used to format every line logged.

**Bug fixes**

- 131: IPv6 dual-stack support was broken.
- 206: can't change directory (CWD) when using UnixAuthorizer and process
cwd is == "/root".
- 211: pyftpdlib doesn't work if deprecated py-sendfile 1.2.4 module is
installed.
- 215: usage of FTPHandler.sleeping attribute could lead to 100% CPU usage.
FTPHandler.sleeping is now removed. self.add_channel() /
self.del_channel() should be used instead.
- 222: an unhandled exception in handle_error() or close() can cause server
to crash.
- 229: backslashes on UNIX are not handled properly.
- 232: hybrid IPv4/IPv6 support is broken. (patch by Claus Klein)

**New modules**

All the code contained in pyftpdlib/ftpserver.py and pyftpdlib/contrib
namespaces has been moved here:

- pyftpdlib.authorizers
- pyftpdlib.filesystems
- pyftpdlib.servers
- pyftpdlib.handlers
- pyftpdlib.log

**New APIs**

- pyftpdlib.authorizers.AuthenticationFailed
- pyftpdlib.filesystems.FilesystemError
- pyftpdlib.servers.ThreadedFTPServer
- pyftpdlib.servers.MultiprocessFTPServer
- pyftpdlib.handlers.FTPHandler's on_connect() and on_disconnect() callbacks.
- pyftpdlib.handlers.FTPHandler.ftp_* methods return a meaningful value on
success.
- FTPServer, FTPHandler, DTPHandler new ioloop attribute.
- pyftpdlib.lib.ioloop.IOLoop class (not supposed to be used directly)
- pyftpdlib.handlers.FTPHandler.log_prefix

**Deprecated name spaces**

- pyftpdlib.ftpserver
- pyftpdlib.contrib.*

**Incompatible API changes**

- All the main classes have been extracted from ftpserver.py and split into sub
modules.

+-------------------------------------+---------------------------------------+
| Before | After |
+=====================================+=======================================+
| pyftpdlib.ftpserver.FTPServer | pyftpdlib.servers.FTPServer |
+-------------------------------------+---------------------------------------+
| pyftpdlib.ftpserver.FTPHandler | pyftpdlib.handlers.FTPHandler |
+-------------------------------------+---------------------------------------+
| pyftpdlib.ftpserver.DTPHandler | pyftpdlib.handlers.DTPHandler |
+-------------------------------------+---------------------------------------+
| pyftpdlib.ftpserver.DummyAuthorizer | pyftpdlib.authorizers.DummyAuthorizer |
+-------------------------------------+---------------------------------------+
| pyftpdlib.ftpserver.AbstractedFS | pyftpdlib.filesystems.AbstractedFS |
+-------------------------------------+---------------------------------------+

Same for pyftpflib.contribs namespace which is deprecated.

+-------------------------------------------------+-----------------------------------------+
| Before | After |
+=================================================+=========================================+
| pyftpdlib.contrib.handlers.TLS_FTPHandler | pyftpdlib.handlers.TLS_FTPHandler |
+-------------------------------------------------+-----------------------------------------+
| pyftpdlib.contrib.authorizers.UnixAuthorizer | pyftpdlib.authorizers.UnixAuthorizer |
+-------------------------------------------------+-----------------------------------------+
| pyftpdlib.contrib.authorizers.WindowsAuthorizer | pyftpdlib.authorizers.WindowsAuthorizer |
+-------------------------------------------------+-----------------------------------------+
| pyftpdlib.contrib.filesystems.UnixFilesystem | pyftpdlib.filesystems.UnixFilesystem |
+-------------------------------------------------+-----------------------------------------+

Both imports from pyftpdlib.ftpserver and pyftpdlib.contrib.* will still work
though and will raise a DeprecationWarning exception.

**Other incompatible API changes**

- DummyAuthorizer.validate_authentication() signature has changed. A third
'handler' argument is now expected.
- DummyAuthorizer.validate_authentication() is no longer expected to return a
bool. Instead it is supposed to raise AuthenticationFailed(msg) in case of
failed authentication and return None otherwise.
(see issue 213)
- ftpserver.py's log(), logline() and logerror() functions are deprecated.
logging module is now used instead. See:
http://code.google.com/p/billiejoex/wiki/Tutorial#4.2_-_Logging_management
- Unicode is now used instead of bytes pretty much everywhere.
- FTPHandler.__init__() and TLS_FTPHandler.__init__() signatures have changed:
from __init__(conn, server)
to __init__(conn, server, ioloop=None)
- FTPServer.server_forever() signature has changed:
from serve_forever(timeout=1.0, use_poll=False, count=None)
to serve_forever(timeout=1.0, blocking=True, handle_exit=True)
- FTPServer.close_all() signature has changed:
from close_all(ignore_all=False)
to close_all()
- FTPServer.serve_forever() and FTPServer.close_all() are no longer class
methods.
- asyncore.dispatcher and asynchat.async_chat classes has been replaced by:
pyftpdlib.ioloop.Acceptor
pyftpdlib.ioloop.Connector
pyftpdlib.ioloop.AsyncChat
Any customization relying on asyncore (e.g. use of asyncore.socket_map to
figure out the number of connected clients) will no longer work.
- pyftpdlib.ftpserver.CallLater and pyftpdlib.ftpserver.CallEvery are
deprecated. Instead, use self.ioloop.call_later() and self.ioloop.call_every()
from within the FTPHandler. Also delay() method of the returned object has
been removed.
- FTPHandler.sleeping attribute is removed. self.add_channel() and
self.del_channel() should be used to pause and restart the handler.

**Minor incompatible API changes**

- FTPHandler.respond(resp) -> FTPHandler.respond(resp, logfun=logger.debug)
- FTPHandler.log(resp) -> FTPHandler.log(resp, logfun=logger.info)
- FTPHandler.logline(resp) -> FTPHandler.logline(resp, logfun=logger.debug)

0.7.0

Not secure
=================================

**Enhancements**

- 152: uploads (from server to client) on UNIX are now from 2x (Linux) to 3x
(OSX) faster because of sendfile(2) system call usage.
- 155: AbstractedFS "root" and "cwd" are no longer read-only properties but
can be set via setattr().
- 168: added FTPHandler.logerror() method. It can be overridden to provide
more information (e.g. username) when logging exception tracebacks.
- 174: added support for SITE CHMOD command (change file mode).
- 177: setuptools is now used in setup.py
- 178: added anti flood script in demo directory.
- 181: added CallEvery class to call a function every x seconds.
- 185: pass Debian licenscheck tool.
- 189: the internal scheduler has been rewritten from scratch and it is an
order of magnitude faster, especially for operations like cancel()
which are involved when clients are disconnected (hence invoked very
often). Some benchmarks:
schedule: +0.5x,
reschedule: +1.7x,
cancel: +477x (with 1 million scheduled functions),
run: +8x
Also, a single scheduled function now consumes 1/3 of the memory thanks
to ``__slots__`` usage.
- 195: enhanced unix_daemon.py script which (now uses python-daemon library).
- 196: added callback for failed login attempt.
- 200: FTPServer.server_forever() is now a class method.
- 202: added benchmark script.

**Bug fixes**

- 156: data connection must be closed before sending 226/426 reply. This was
against RFC-959 and was causing problems with older FTP clients.
- 161: MLSD 'unique' fact can provide the same value for files having a
similar device/inode but that in fact are different.
(patch by Andrew Scheller)
- 162: (FTPS) SSL shutdown() is not invoked for the control connection.
- 163: FEAT erroneously reports MLSD. (patch by Andrew Scheller)
- 166: (FTPS) an exception on send() can cause server to crash (DoS).
- 167: fix some typos returned on HELP.
- 170: PBSZ and PROT commands are now allowed before authentication fixing
problems with non-compliant FTPS clients.
- 171: (FTPS) an exception when shutting down the SSL layer can cause server
to crash (DoS).
- 173: file last modification time shown in LIST response might be in a
language different than English causing problems with some clients.
- 175: FEAT response now omits to show those commands which are removed from
proto_cmds map.
- 176: SO_REUSEADDR option is now used for passive data sockets to prevent
server running out of free ports when using passive_ports directive.
- 187: match proftpd LIST format for files having last modification time
> 6 months.
- 188: fix maximum recursion depth exceeded exception occurring if client
quickly connects and disconnects data channel.
- 191: (FTPS) during SSL shutdown() operation the server can end up in an
infinite loop hogging CPU resources.
- 199: UnixAuthorizer with require_valid_shell option is broken.

Page 3 of 5

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.