Security issue

[mamantoha]

Hi.

When I run example.cr from the repo, I'm able to view all filesystem not only root directory.

crystal example.cr -- 8090 /Users/admin/crystal/CrystalFTP

ftp localhost -p 8090
ftp> cd /usr
ftp> ls

[LeChatErrant]

Does the RFC959 specify something about this?
Maybe should we let the user decide if they want to expose all their filesystem or only the root directory, with an extra argument in FTPServer constructor

[mamantoha]

Maybe should we let the user decide if they want to expose all their filesystem or only the root directory, with an extra argument in FTPServer constructor

👍