Plesk file manager can delete Files with root rights!

[B4c4rd1]

TITLE:

Plesk file manager can delete Files with root rights!​

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE:

Plesk Onyx, Version 17.5.3 Update #30, Ubuntu 16.04.2 LTS‬, x64​

PROBLEM DESCRIPTION:

The internal filemanager may seem to delete files created with the root owner. Theoretically, the user could delete all folders and all files with Plesk File Manager. Even if the file may only be read by root:

This fil can delete over the filemanager.​

STEPS TO REPRODUCE:

Create a file over SSH under root and change the file rights to: 0400

This file can delete with the filemanager under plesk panel.​

ACTUAL RESULT:

All files and folders can be deleted​

EXPECTED RESULT:

It may be deleted only the files and folders that can describe the current user too.​

ANY ADDITIONAL INFORMATION:

​

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM:

Confirm bug​

 

[virtubox]

TITLE:

Plesk file manager can delete Files with root rights!​

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE:

Plesk Onyx, Version 17.5.3 Update #30, Ubuntu 16.04.2 LTS‬, x64​

PROBLEM DESCRIPTION:

The internal filemanager may seem to delete files created with the root owner. Theoretically, the user could delete all folders and all files with Plesk File Manager. Even if the file may only be read by root:

This fil can delete over the filemanager.​

STEPS TO REPRODUCE:

Create a file over SSH under root and change the file rights to: 0400

This file can delete with the filemanager under plesk panel.​

ACTUAL RESULT:

All files and folders can be deleted​

EXPECTED RESULT:

It may be deleted only the files and folders that can describe the current user too.​

ANY ADDITIONAL INFORMATION:

​

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM:

Confirm bug​

This is not a bug, it's only logic linux permissions . Plesk will never use root owner in user directory.

 

[B4c4rd1]

@virtubox

fact that I have not noticed.

Files can be deleted but folders are not. Thank you for the clarification!

 

[mow]

Because you own the directory and have write permission for it, you can unlink any file from that directory (the unlink action is just modifying the directory, which you own / have write permission for), regardless of who the owner of the file is.
Note that unlinking a file is not the same as deletion: On unix filesystems, the file itself will only be removed when all references to it - including file handles - are gone. This is different from Windows where you can't remove a file that is in use.
Example: upload a big backup file and immediately unlink it; the uploading will still proceed, and only after it finished you will see the disk space being freed. This can be quite useful when you want to ensure no old backup files stay around even in case of errors.

In case of a folder: A directory can only be unlinked when it is empty, and as you don't have write permission for that directory because you don't own it, you cannot unlink its contents and make it empty.