Re: [PATCH] tftpd: strip leading slashes from the requested file name

Bug 4874 is a real, filed issue on its own: an absolute path escaping
a directory tftpd was actually given, DIR or CWD. That's what this
patch closes, completely, not partially. Calling it a workaround
would mean the escape is still possible after this patch. It isn't,
not for that bug.

The CWD=/ gap you're raising is real too, but it doesn't have a
bug number and nobody has discussed it as its own issue before this
thread. That doesn't make it less real. It makes it separate: nobody has
designed what tftpd should do when it's never told where to serve from.

I'd rather open that as its own thread than fold it into 4874. Are you
blocking this patch until that's solved, or is it just the "separate
issue" wording you object to?

Ali