Address GHSA-rjrw-mjq6-hpmm

patrickhener · patrickhener · commit 32f4a0e1790a · 2026-06-26T08:39:45.000+02:00
diff --git a/sftpserver/sftpserver.go b/sftpserver/sftpserver.go
@@ -82,7 +82,7 @@ func (s *SFTPServer) Start() error {
 		sshServer.HostSigners = []ssh.Signer{private}
 	}
 
-	if s.Username != "" && s.Password != "" {
+	if s.Username != "" || s.Password != "" {
 		sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool {
 			return subtle.ConstantTimeCompare([]byte(ctx.User()), []byte(s.Username)) == 1 && subtle.ConstantTimeCompare([]byte(password), []byte(s.Password)) == 1
 		}

Original file line number	Diff line number	Diff line change
`@@ -82,7 +82,7 @@ func (s *SFTPServer) Start() error {`
`82`	`82`	`sshServer.HostSigners = []ssh.Signer{private}`
`83`	`83`	`}`
`84`	`84`
`85`		`- if s.Username != "" && s.Password != "" {`
	`85`	`+ if s.Username != "" \|\| s.Password != "" {`
`86`	`86`	`sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool {`
`87`	`87`	`return subtle.ConstantTimeCompare([]byte(ctx.User()), []byte(s.Username)) == 1 && subtle.ConstantTimeCompare([]byte(password), []byte(s.Password)) == 1`
`88`	`88`	`}`