Chris Lu 3cdfe648eb sftp: reject an empty password (#11095) ...

ValidatePassword compared the stored and supplied passwords with
subtle.ConstantTimeCompare, which returns 1 for two zero-length slices.
A user provisioned for public-key-only auth has an empty stored password,
so an empty supplied password authenticated as that user whenever
"password" was among the enabled auth methods (the default).

Treat an empty stored or supplied password as a non-match.

Claude-Session: https://claude.ai/code/session_011QqNaxZwnpHgMoAZNp3RkY

2026-09-02 11:33:25 -07:00

..

auth

sftpd: support SSH user certificates signed by a trusted CA (#9815)

2026-06-03 22:32:47 -07:00

user

sftp: reject an empty password (#11095)

2026-09-02 11:33:25 -07:00

utils

Fix sftp performances and add seaweedfs all-in-one deployment (#6792)

2025-05-26 00:50:48 -07:00

sftp_file_reader.go

convert error fromating to %w everywhere (#6995)

2025-07-16 23:39:27 -07:00

sftp_file_writer.go

chore: remove ~50k lines of unreachable dead code (#8913)

2026-04-03 16:04:27 -07:00

sftp_filer_test.go

sftp: url-encode the upload path (#10758)

2026-08-14 09:19:37 -07:00

sftp_filer.go

sftp: url-encode the upload path (#10758)

2026-08-14 09:19:37 -07:00

sftp_permissions_test.go

sftp: match permission paths on path-component boundaries (#10311)

2026-07-10 22:10:01 -07:00

sftp_permissions.go

Add codespell support with configuration and typo fixes (#10393)

2026-07-22 14:38:06 -07:00

sftp_server_test.go

fix: SFTP HomeDir path translation for user operations (#7611)

2025-12-03 13:42:05 -08:00

sftp_server.go

Fix SFTP file upload failures with JWT filer tokens (#8448)

2026-02-25 14:30:21 -08:00

sftp_service.go

sftpd: support SSH user certificates signed by a trusted CA (#9815)

2026-06-03 22:32:47 -07:00