From bb40804f2df9296a3398f18c60a675efcbec0452 Mon Sep 17 00:00:00 2001 From: ed Date: Mon, 27 Jul 2026 17:15:00 +0000 Subject: [PATCH] windows: add DLL-hijacking warning; famously, windows prefers cwd when resolving a binary to execute, rather than a predefined PATH like linux / unix / every other OS even worse, it also does this for DLLs, and mitigating *that* is infeasible because it depends on variables we dont control print a warning in case someone is unaware of this --- copyparty/authsrv.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/copyparty/authsrv.py b/copyparty/authsrv.py index 0e941b05..8b363388 100644 --- a/copyparty/authsrv.py +++ b/copyparty/authsrv.py @@ -3059,6 +3059,8 @@ class AuthSrv(object): zv, _ = vfs.get("", "*", False, True, err=999) if self.warn_anonwrite and verbosity > 4 and os.getcwd() == zv.realpath: t = "anyone can write to the current directory: {}\n" + if ANYWIN: + t += "/!\\ NOTE: because you are using Windows, this is extra dangerous (DLL-hijacking)\n" self.log(t.format(zv.realpath), c=1) self.warn_anonwrite = False