diff options
author | Ed Maste <emaste@FreeBSD.org> | 2017-08-19 00:32:26 +0000 |
---|---|---|
committer | Ed Maste <emaste@FreeBSD.org> | 2017-08-19 00:32:26 +0000 |
commit | c0bc488b2c50819975f1c59b5b26e3ce8c4f5da4 (patch) | |
tree | a697d3f6b15a67d8b1fbf82ff08a0629b4867598 /pw | |
parent | d79c5099603f0afa9e292d79f9595563cd623cf3 (diff) | |
download | pw-darwin-c0bc488b2c50819975f1c59b5b26e3ce8c4f5da4.tar.gz pw-darwin-c0bc488b2c50819975f1c59b5b26e3ce8c4f5da4.tar.zst pw-darwin-c0bc488b2c50819975f1c59b5b26e3ce8c4f5da4.zip |
pw useradd: Validate the user name before creating the entry
Previouly it was possible to create users with spaces in the name with:
pw useradd -u 1234 -g 1234 -n 'test user'
The "-g 1234" is relevant, without it the name was already rejected
as expected:
[fk@test ~]$ sudo pw useradd -u 1234 -n 'test user'
pw: invalid character ` ' at position 4 in userid/group name
Bug unintentionally found with a salt config without explicit name entry:
test user:
user.present:
- uid: 1234
- gid: 1234
- fullname: Test user
- shell: /usr/local/bin/bash
- home: /home/test
- groups:
- wheel
- salt
"Luckily" salt modules rarely bother with input validation either ...
PR: 221416
Submitted by: Fabian Keil
Obtained from: ElectroBSD
MFC after: 1 week
Diffstat (limited to 'pw')
-rw-r--r-- | pw/pw_user.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/pw/pw_user.c b/pw/pw_user.c index a71be12..92d5c6c 100644 --- a/pw/pw_user.c +++ b/pw/pw_user.c @@ -1202,7 +1202,7 @@ pw_user_add(int argc, char **argv, char *arg1) if (arg1[strspn(arg1, "0123456789")] == '\0') id = pw_checkid(arg1, UID_MAX); else - name = arg1; + name = pw_checkname(arg1, 0); } while ((ch = getopt(argc, argv, args)) != -1) { @@ -1214,7 +1214,7 @@ pw_user_add(int argc, char **argv, char *arg1) quiet = true; break; case 'n': - name = optarg; + name = pw_checkname(optarg, 0); break; case 'u': userid = optarg; |