Hello @jheysel-r7,

I’ve opened a PR (jheysel-r7#5) into your branch with the following changes:

1. Fixed the Exploit:

   • I solved the issue by telling the client that passive mode (EPSV) isn’t implemented. The client still tries RETR afterward, which simplifies the process.
   • Handling passive mode would have made things much harder.

2. Refactored Code:

   • I made the logic easier to follow.

3. Improved Documentation:

   • Added setup instructions, affected versions, and usage examples for better clarity.

Let me know if you have any feedback or further suggestions!

Best,
Chocapikk

Hey @Chocapikk,

Thank you so much for digging into the issue and pushing a fix with documentation. Very much appreciated! I was just returning to work on this, perfect timing. I've pulled in your PR and made a couple minor changes.

I readded the slight hack for the SSL datastore option. If the target CraftCMS application uses SSL over HTTP and you have the SSL datastore option set to true, the same datastore option gets used when starting the FTP server unfortunately so we need to temporarily disable it when starting the FTP server.

There was a mix of normal if statements and ternary operators in the overridden FTP Server methods. I thought it would be best to stay consistent and although they take up more lines I find normal if statements slightly easier to follow.

Hi @jheysel-r7, you're welcome! No problem at all, and thank you as well for implementing the changes.