flood
flood copied to clipboard
Lack of dir permission checks during move operations
Type: Bug Report
- [x] Try to follow the update procedure described in the README and try again before opening this issue.
Your Environment
- Version used:
- Version 4.7.0 stable release
- Environment name and version:
- Node.js version
16.13.2
- npm version
8.1.2
- Web browser
ffox
- Node.js version
- Operating system and version: Debian 10
- Torrent client and version: rTorrent 0.9.7
Summary
The torrent data files are located in a read-only directory to the Flood user. When attempting to move said torrent to a different directory using Flood, there seems to be no permission checks before the move operation.
Expected Behavior
Flood displays an error message saying the data files cannot be moved
Current Behavior
Flood goes ahead with the move operation anyway; Data files remained in the original directory, and the torrent points to a non existence destination directory.
Possible Solution
Flood should check for write permission on both src and dest directories before the move operation. Print error and abort if permission is missing.
Steps to Reproduce
- Using rTorrent, download a multi-files torrent
my_torrent
into directory/download
, assuming the/download
directory is world readable (0755), and is owned by the rTorrent / Flood user - Complete download, then change the ownership of
my_torrent
to someone else by runningchown -R foo /download/my_torrent
- Nowmy_torrent
remains world readable but no longer writable by the rTorrent / Flood user - In Flood, use
Set Location...
to move the torrent to another directory - Torrent's location gets updated, but rTorrent cannot find the data anymore - remains in
/download
We could ask the torrent server to move the files for us by running a mv
shell command. For rtorrent, this can probably be achieved with an execute
call.