Previous clobbered a work-in-progress. Here is the merged result:

Limit the "pathname" glob to one item, as that is what all users of it
are expecting, except for LIST.

Always glob, instead of when the first character is a ~.  For example,
if you had directories ~/x1, and ~/x2, then "cwd x[1]" would fail, but
"cwd ~/x[1]" would work since it was globbed due to the ~ character.
Also, "cwd ~/x[12]" used to arbitarily work as it used the first
expansion (ie: x1) without an error.  Make it return '550 ambiguous'
instead of '550 not found' so that the user can see the difference.

For LIST, just use the user supplied string as the popen does the glob.

Problem noticed by:  Ajay Mittal <amittal@iprg.nokia.com>

1 files changed, 6 insertions, 3 deletions

diff --git a/libexec/ftpd/ftpcmd.y b/libexec/ftpd/ftpcmd.y
index 04a7d87ec76f..9a4d125c9a46 100644
--- a/libexec/ftpd/ftpcmd.y
+++ b/libexec/ftpd/ftpcmd.y
@@ -138,7 +138,7 @@ extern int epsvall;
 %type	<i> check_login_ro octal_number byte_size
 %type	<i> check_login_epsv octal_number byte_size
 %type	<i> struct_code mode_code type_code form_code
-%type	<s> pathstring pathname password username ext_arg
+%type	<s> pathstring pathname password username
 %type	<s> ALL
 
 %start	cmd_list
@@ -475,7 +475,7 @@ cmd
 			if ($2)
 				retrieve("/bin/ls -lgA", "");
 		}
-	| LIST check_login SP pathname CRLF
+	| LIST check_login SP pathstring CRLF
 		{
 			if ($2 && $4 != NULL)
 				retrieve("/bin/ls -lgA %s", $4);
@@ -941,7 +941,7 @@ pathname
 			 * processing, but only gives a 550 error reply.
 			 * This is a valid reply in some cases but not in others.
 			 */
-			if (logged_in && $1 && *$1 == '~') {
+			if (logged_in && $1) {
 				glob_t gl;
 				int flags =
 				 GLOB_BRACE|GLOB_NOCHECK|GLOB_QUOTE|GLOB_TILDE;
@@ -953,6 +953,9 @@ pathname
 				    gl.gl_pathc == 0) {
 					reply(550, "not found");
 					$$ = NULL;
+				} else if (gl.gl_pathc > 1) {
+					reply(550, "ambiguous");
+					$$ = NULL;
 				} else {
 					$$ = strdup(gl.gl_pathv[0]);
 				}