FileZilla Server version 0.9.18 beta

Features:

almost unlimited number of users
multi-threaded engine
runs as service under Windows NT4, 2000 and XP
anti fxp / bounce attack filter
secure password storage (as MD5 hash)
real-time user/group management
all options can be set at runtime, there's no need to take the server offline
no-transfer timeout which can kick idle users which use basic keep alive systems
Server and user/group speed limits based on rule sets.
MODE Z file transfer compression

Release Notes:

Please report any bugs immediately to Tim.Kosse@gmx.de and don't forget to include some system details as it helps to identify the bugs.

The tray icon

From the tray icon you've access to different features of FileZilla Server. You can enable/disable, lock/unlock or exit the server as well as restoring it to normal size.

List of tray icon states:
red		server offline
yellow		server online
green		client connected
flashing red-green		server will go offline or will exit when all clients are disconnected
flashing red-yellow		server is locked
flashing yellow-green		server is locked and clients are still connected

Version History:

For a more detailed list of changes, please have a look at the CVS changelog located at http://filezilla-project.org/changelog.php?type=2.

Version 0.9.18

Fixed bugs:

Fix MLSD command not displaying all aliases

Fix keyboard nagivation in settings dialog

Added OPTS UTF8 OFF command

Version 0.9.17

Fixed bugs:

Fix critical buffer overflow in admin interface. Remote code execution with the rights of the user running the admin interface might have been possible. Only the interface was affected, the service was unaffected.

Fix memory leak in service

Compatibility fixes for systems with more than one CPU

Version 0.9.16

Fixed bugs:

Fix conversion problem if any configuration data had a non-English character.

Internal changes to make whole service use Unicode

Fix explicit SSL (0.9.16a)

Fix buffer overflow in settings dialog (0.9.16b)

Fix problem with list of connected users (0.9.16c)

Version 0.9.15

New features:

UTF-8 support as specified in RFC 2640. As result, the minimum required Windows version is now Windows 2000.

Fixed bugs:

SSL file truncation problem

Compatiblity fix for NAT-in-NAT environments

Compatibility with clients sending the STRU command

Fix loading of aliases in UNC format

Version 0.9.14

Fixed bugs:

Fixed problem with SSL transfers aborting or even crashing the server.

Version 0.9.13

New features:

Option to not use external ip address in passive mode if client is within local network. Enabled by default.

Option to ignore the address given in the PORT command if it's from an unrouteable address range, but the client has a routeable address. Enabled by default.

Fixed bugs:

Fixed problems with the case-(in)sensitivity of aliases

(0.9.13b) Fixed passive mode problems introduced in 0.9.13

Version 0.9.12

New features:

Alias targets can now be virtual paths as well

Add option to allow reading of files which are opened for writing by another process

Always require a set password even for local connections now. If you don't remember your password, delete it from FileZilla Server.xml

Workaround for SMC routers with P@SW bug

Added SITE NAMEFMT command with "1" as only supported naming format. Required by at least one client running on AS/400 server.

Fixed bugs:

Don't allow AUTH SSL/TLS command if already using SSL/TLS, broadcast SSL/TLS availability in FEAT response

Version 0.9.11

Fixed bugs:

No longer freezes if using a password protected keyfile.

It was not possible to access filenames starting with multiple dots

Version 0.9.10

New features:

Option to force SSL login for selected users/groups

Fixed bugs:

SSL mode fixes, fix truncated downloads

fix creation of multiple ports if not bound to all IP addresses

Version 0.9.9

New features:

Option to force PROT P for SSL/TLS connections.

Fixed bugs:

Now compiled against zlib 1.2.3 to fix potential security vulnerability

Version 0.9.8c

Fixed bugs:

Sometimes file downloads aborted prematurely leading to incomplete files.

Don't send MODE Z in FEAT response if MODE Z has been disabled.

Version 0.9.8b

New features:

Added option to set socket buffer size, increased default buffer sizes

Fixed bugs:

Wildcards in argument to LIST command were not handled properly

Use proper reply code for AUTH SSL and AUTH TLS commands

Version 0.9.8

New features:

Service and Admin interface can be installed separately in the installer

Fixed bugs:

Infinite loop if user disconnects while throttled by anti-hammering code

Accept PBSZ command if using SSL/TLS

Version 0.9.7

New features:

Option to force explicit SSL

Fixed bugs:

Available bandwidth was not distributed properly if using speedlimits

possible crash after closing client connections if using SSL

time based speed limits over midnight did not work properly

Connection freeze after SSL initialization

taking server offline and back online did not work properly if used multiple times in a row

fix infinite loop if speedlimits are enabled

Version 0.9.6a

fixed bugs:

Sockets for admin interface or transfer connections could not be created on all systems

Input box for the listen ports did not accept separator characters.

reserved MSDOS device name did not work properly

Version 0.9.6

New features:

SSL/TLS encryption. This feature is still experimental, use at your own risk.

Fixed bugs:

Infinite loop on file uploads or directory listings if using zlib compression

Sending commands with filenames as arguments which did contain reserved MSDOS device names (such as NUL, CON, COM1, LPT1) could freeze FileZilla Server on older systems. Those filenames are now considered invalid

Fixed crash if taking server offline

Connection limits for users did not work as intended

The /reload-config command line switch has been fixed

Version 0.9.5

fixed bugs:

Typo in anti-hammering code, delayed connections were never unstalled

Aliases for directories containing :u did not work if username did contain uppercase chars

If renaming groups, adjust user accounts accordingly

If deleting groups which are in use, ask what to do with the affected users

Use same network interface for transfer connection as for the control connection to solve some firewall issues, patch by dartonw

Version 0.9.4e

fixed bugs:

Fixed buffer overflow in admin interface

Aliases did not always display in NLST listings

Version 0.9.4

new features:

List of connected users displays more details: IP, current file, progress and speed. Based on patch by "Tropics"

Admininterface reconnects automatically after connection loss

Folders to which the user has no access, won't be displayed in directory listings

All IP filters can now also filter hostnames using regular expressions, based on patch from Sebastian Schuberth

implemented MLSD and MLST commands

implemented ALLO command

If user password in settings file is not 32 characters long (and thus not a MD5 hash) convert it to a MD5 hash.

removed features:

The permissions handling code has been simplified a lot. In the process some features as described above have been removed, partially due to better alternatives.

Removed non-relative directory structure mode. It did expose the servers physical directory structure. Also there were some bugs regarding this mode in the previous code.

Removed "Resolve Shortcuts" option. Aliases are more flexible since they allow username replacement (using :u) and don't depend on some files on your drive which could be replaced by other applications.

fixed bugs:

Dashes as prefix for command line options did not work

Time pickers in speedlimit rule dialog did change type to date pickers.

Internal changes for 64bit portability

Fixed rare crash which could occur whenever a user disconneced

Fixed crashes if stopping server

Use proper reply for MKD commands to already existing directories

No longer display folder selection dialog for remote administration sessions.

Internal changes to reduce CPU load

Version 0.9.3

new features:

Welcome messages can be hidden to no longer display in the interface and logfiles. Based on patch by Jason Jackson.

Max. Welcome message size greatly increased

fixed bugs:

security fix for zlib which could lead to denial of service attacks if MODE Z transfers are allowed.

Version 0.9.2

new features:

increased speed of admin interface

implemented anti-hammering code to prevent brute force password cracking. Can't be disabled for good reason.

Version 0.9.1

new features:

Directory aliases to simplify usage of virtual file system

IP filter to limit access to server

Users / groups can be disabled

Comments field for users and groups

Added HELP command (0.9.1b)

fixed bugs:

ip filter did not work properly together with groups (0.9.1a)

fixed deadlock in external IP check and speed limit code

fixed infinite loop in zlib mode

speed limits were not calculcated properly

wrong timezone was used in speed limit rules

global speed limits weren't initialized properly

fixed error message if editing speed limit rules

groups no longer duplicate if opening groups dialog on inactive servers without any user accounts

Version 0.9.0

new features:

MODE Z file transfer compression

server listening socket can be bound to specific IPs

fixed bugs:

server did not shutdown properly

Version 0.8.9

fixed bugs:

Interface could crash if kicking user

group ip based connection limit did not work

fixed alignment of years in directory listings

fixed crash if listening socket can't be created

changed MKD return code to 257

Version 0.8.8

new features:

added hostname support for external PASV IP address

support for remote IP detection scripts

config file can be reloaded by calling "FileZilla Server.exe" /reload-config
fixed bugs:

Fixed format of permissions field in directory listings

group membership for user accounts wasn't set on startup

somtimes the last few bytes were missing on uploaded files

fixed missing titles of users and groups dialog

version 0.8.7

new features and improvements:

lots of performance improvements:

connection establishment is up to 100ms faster

some optimizations in the welcome message, directory listing and permission code

Thanks to Tom Diviney for a lot of testing.

Improved behaviour of LIST and NLST with arguments, should fix the mget issue, fix provided by Bengt Johannesson

fixed bugs:

Creation of transfer connection in active mode was not RFC 959 compatible.

possible fix for stalling GSS transfers

version 0.8.6

new features:

new log window, it's now possible to select text

fixed bugs:

due to a bug in the Windows api function CreateDirectory it was possible to create directories with one or more dots at the end of their name. Such directories can't be accessed or deleted by most programs. FileZilla Server now checks for dots at the end of diretories and denies creation of such directories. If you already have such directories on your disk, you can delete them in the console using rmdir \\?\<path>, replace path with the full path of the invalid directory.

Usergroups no longer change randomly if there are more than one user group.

version 0.8.5:

new features:

Added server menu to interface with Active and Lock items (same funcionality as the first two icons)

fixed bugs:

Users without delete permission could delete empty directories

Files could be renamed over account boundaries

Locking the server did not work

Defatult width of users pane was zero if starting the interface on low resolution (800x600 or fewer) monitors.

version 0.8.4:

new features:

Global as well as user specific speed limits can be set

Added user groups

Support for Kerberos GSSAPI authentication

Transfer buffer size can now be set

version 0.8.3:

new features:

remote administration

logging to file

fixed bugs:

admin interface could hang during connect (fixed in 0.8.3a)

F2 to rename user accounts / dirs in users dialog now works correctly

sometimes files sent to clients were not sent correctly

version 0.8.2

fixed bugs:

fixed "account duplication" if taking server offline and back online

fixed timeouts, active clients no longer timeout without reason.

version 0.8.1

new features:

added settings converter due to popular request

fixed bugs:

not all account settings could be read correctly from xml file

fixed some bugs in the server <--> interface protocol

fixed buffer overflow in server side admin socket class

some minor fixes

version 0.8.0:

new features:

Separated server from the user interface, interface now runs in its own process

Sever now runs as service under Windows NT4, 2000 and XP

fixed bugs:

fixed problems with non relative paths and drive letters. This should also fix the compatibility to some versions of the IE and other browsers (fixed by TJ Drennan)

fixed crash if a directory did contain files with a year larger than 2038

server no longer sometimes stops responding after issuing shutdown

version 0.7.4:

new features:

installer now uses modernUI style

fixed bugs:

added warning if accepting a new connection failed. Some bad firewalls do allow creating listen sockets and pass through connection attempts but block accepting them.

fixed some problems with the socket class

fixed GDI-resource leak

version 0.7.3:

fixed bugs:

improved thread responsiveness to messages

fixed display of transferrate

reduced flicker of main window while resizing

when deleting a user, the user data could get mixed up

now no error message appears when "Enable custom PASV settings" is disabled

now NULL passwords are supported if an account does not require a password (anonymous for example)

"Maximum connection count" for user accounts did not work

version 0.7.2:

new features:

added custom PASV IP and port settings

added XCUP, XPWD, XMKD, XRMD and NOP commands

fixed bugs:

QUIT works without beeing logged on

Telnet commands no longer show up in message log

fixed cancel button in users dialog not working properly

added missing users dialog menu entry

version 0.7.1:

fixed bugs:

fixed problems with usernames containing uppercase characters

fixed installer creating source project shortcut in wrong directory

fixed security hole, could list directories outside your ftproot.

version 0.7:

enhanced features:

new Winsock wrapper class, should increase performance a little bit

prepared the use of format specifications in welcome message. If you had used a custom welcome message before using version 0.7, you would have to reenter the message.

fixed bugs:

fixed problem with LIST and NLST command and parameters

files are now stored with the names passed with the STOR command, no longer all lowercase

correct handling of quoted arguments

version 0.6:

new features:

custom welcome message

server port can be changed without having to manually close and reopen it.

increased performance under heavy load

added NLST and MDTM (last modified time) commands

crash log generation

fixed bugs:

fixed security hole that allowed to list directories within your ftp root without list permission.

fixed some more deadlocks

version 0.5.2 beta:

fixed bugs:

fixed problem with usernames containing uppercase characters

Server hanged when it was unable to get the homedir of a user

version 0.5.1 beta:

fixed bugs:

could not always determinate filesize correctly

version 0.5 beta:

new featurs:

NLST command added

a path can be passed to LIST and NLST as argument

start minimized option

fixed bugs:

multiple problems with files larger than 2GB

version 0.4 beta:

new features:

APPE and QUIT command added

fixed bugs:

sometimes permissions could not be retrieved due to a bug in GetRealDirectory(), permission was always denied.

when using APPE or "REST x" (x!=0), it was possible to upload new files in folders with append permission but no write permission.

fixed some minor bugs

version 0.3 beta:

new features:

ip limit per user

users can be renamed

transfer count and rate will be displayed

NOOP command implemented

enhanced features:

speed of directory listings improved

fixed bugs:

timeouts weren't calculated properly

version 0.2 beta:

new features:

ABOR and SYST commands added

login timeout integrated

users can be kicked

number of threads can be changed at runtime

fixed bugs:

MKD could not create multiple directory levels at once

files were not sent completely to clients

some problems in the users dialog

control channel now sends line endings with <CRLF> as specified in RFC 959 instead of <LF>

InitTransfer called too early in some rare cases

a whole bunch of bugs causing crashes or freezes

version 0.1 beta:

new featuers:

options dialog

timeout and no transfer timeout

port selection

number of threads can be selected

max number of users

user-specific bypass max user and local max user setting

all connected users are displayed on the right pane of the main window

added systray icon

bounce attack / fxp protection

ABOR command implemented

now only one file transfer and one directory listing can be active at the same time, so you can still browse the server during file transfers.

fixed bugs:

sometimes the threads were not shut down correctly with FileZilla

fixed some issues in the user account manager

Server could crash if a new transfer was initiated while another transfer is still active.

version 0.0.2 alpha:

new features:

non relative paths

file transfers

PASV mode support

delete files and directory

create directories

renaming of files/dirs

fixed bugs:

the message log now displays the seconds, too

version 0.0.1 alpha:

first public release

new features:

user account manager

browsing of directories

Windows shorcut files (.lnk files) resolving

multithreaded engine with very basic load balancing