git: 732f13ad32dc - stable/13 - pw: The pw_checkname function has added ';' checking.
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 19 May 2023 08:10:33 UTC
The branch stable/13 has been updated by bapt:
URL: https://cgit.FreeBSD.org/src/commit/?id=732f13ad32dc7ddc951f9dcdb969b933bcacf631
commit 732f13ad32dc7ddc951f9dcdb969b933bcacf631
Author: pbuff <pbuff@qq.com>
AuthorDate: 2023-05-16 03:05:30 +0000
Commit: Baptiste Daroussin <bapt@FreeBSD.org>
CommitDate: 2023-05-19 08:10:09 +0000
pw: The pw_checkname function has added ';' checking.
The pw_checkname function forgot to include a ';'
when checking usernames, causing shell commands
to be executed when a username with a ';' is deleted.
PR: 271427
MFC After: 3 days
(cherry picked from commit e0155c6989049da43c5499f7129002aa17d1ca79)
---
usr.sbin/pw/pw_user.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/usr.sbin/pw/pw_user.c b/usr.sbin/pw/pw_user.c
index f0f87b923c0d..1b986e7c6985 100644
--- a/usr.sbin/pw/pw_user.c
+++ b/usr.sbin/pw/pw_user.c
@@ -637,7 +637,7 @@ pw_checkname(char *name, int gecos)
showtype = "gecos field";
} else {
/* See if the name is valid as a userid or group. */
- badchars = " ,\t:+&#%$^()!@~*?<>=|\\/\"";
+ badchars = " ,\t:+&#%$^()!@~*?<>=|\\/\";";
showtype = "userid/group name";
/* Userids and groups can not have a leading '-'. */
if (*ch == '-')