Date: Tue, 16 May 2023 06:48:42 GMT From: Baptiste Daroussin <bapt@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: e0155c698904 - main - pw: The pw_checkname function has added ';' checking. Message-ID: <202305160648.34G6mgDI055608@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by bapt: URL: https://cgit.FreeBSD.org/src/commit/?id=e0155c6989049da43c5499f7129002aa17d1ca79 commit e0155c6989049da43c5499f7129002aa17d1ca79 Author: pbuff <pbuff@qq.com> AuthorDate: 2023-05-16 03:05:30 +0000 Commit: Baptiste Daroussin <bapt@FreeBSD.org> CommitDate: 2023-05-16 06:48:08 +0000 pw: The pw_checkname function has added ';' checking. The pw_checkname function forgot to include a ';' when checking usernames, causing shell commands to be executed when a username with a ';' is deleted. PR: 271427 MFC After: 3 days --- usr.sbin/pw/pw_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr.sbin/pw/pw_user.c b/usr.sbin/pw/pw_user.c index c0002f985bfb..c8e8de1fc46a 100644 --- a/usr.sbin/pw/pw_user.c +++ b/usr.sbin/pw/pw_user.c @@ -636,7 +636,7 @@ pw_checkname(char *name, int gecos) showtype = "gecos field"; } else { /* See if the name is valid as a userid or group. */ - badchars = " ,\t:+&#%$^()!@~*?<>=|\\/\""; + badchars = " ,\t:+&#%$^()!@~*?<>=|\\/\";"; showtype = "userid/group name"; /* Userids and groups can not have a leading '-'. */ if (*ch == '-')
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202305160648.34G6mgDI055608>