php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #78708 ftp_login doesn't work with colon (:) in password
Submitted: 2019-10-21 09:16 UTC Modified: 2021-02-28 04:22 UTC
Votes:2
Avg. Score:5.0 ± 0.0
Reproduced:2 of 2 (100.0%)
Same Version:2 (100.0%)
Same OS:2 (100.0%)
From: julien dot chavee at gmail dot com Assigned: cmb (profile)
Status: No Feedback Package: FTP related
PHP Version: 7.3.10 OS: CentOS
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2019-10-21 09:16 UTC] julien dot chavee at gmail dot com
Description:
------------
The PHP function ftp_login() return false with the following warning when the password contains the character colon (:):

"PHP Warning:  ftp_login(): 500"

Test script:
---------------
<?php
$connection = ftp_connect(
	'[SERVER]',
	'[PORT]',
	'[TIMEOUT]'
);

if($connection !== false) {
	$login = ftp_login(
		$connection,
		'[USERNAME]',
		'abc:def'
);

if($login === true) {
	echo 'Success';
} else {
	echo 'Failed';
}

Expected result:
----------------
Display 'Success'

Actual result:
--------------
Display 'Failed' with the warning "PHP Warning:  ftp_login(): 500"

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-10-21 10:02 UTC] cmb@php.net
-Status: Open +Status: Feedback -Assigned To: +Assigned To: cmb
 [2019-10-21 10:02 UTC] cmb@php.net
Would it work, if you passed the following as $password:

  urlencode('abc:def')
 [2019-10-21 12:13 UTC] julien dot chavee at gmail dot com
Hello,

I tried but unfortunately it doesn't work. The warning is not the same but we still can't connect:

"PHP Warning:  ftp_login(): Login authentication failed"
 [2019-10-21 12:21 UTC] cmb@php.net
-Status: Feedback +Status: Open -Assigned To: cmb +Assigned To:
 [2019-10-21 12:21 UTC] cmb@php.net
Thanks for checking, anyway!
 [2021-02-19 17:31 UTC] cmb@php.net
-Status: Open +Status: Feedback -Assigned To: +Assigned To: cmb
 [2021-02-19 17:31 UTC] cmb@php.net
After having a closer look, I fail to see why that would fail
(unless the username/password combination is invalid).
ftp_login() just sends the following commands

    USER [USERNAME]
    PASS abc:def

What would happen if you send these commands via ftp_raw() or via
telnet?  Also, can you please inspect the network traffic to see
whether the colon gets mangled somehow?  And which FTP server do
you use?
 [2021-02-28 04:22 UTC] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Mon Mar 01 14:01:24 2021 UTC