summaryrefslogtreecommitdiffstats
path: root/usr.sbin
diff options
context:
space:
mode:
authormtm <mtm@FreeBSD.org>2003-02-09 18:29:09 +0000
committermtm <mtm@FreeBSD.org>2003-02-09 18:29:09 +0000
commit79fd930022063414744be50bb034953d57ba880d (patch)
treeb1e7430c5359f670e943e42e535af1e9554fb6bd /usr.sbin
parentd40dbd1c8c5ccfda57d0addeeb3e9fd2e2e5f365 (diff)
downloadFreeBSD-src-79fd930022063414744be50bb034953d57ba880d.zip
FreeBSD-src-79fd930022063414744be50bb034953d57ba880d.tar.gz
Revisit the shell special characters issue and settle it once-and-forall.
All characters will be accepted, and pw(8) can sort out which ones it will allow and which ones it won't. Approved by: markm (mentor) Prodded by: Philippe Bourcier <philippe@cyberabuse.org>
Diffstat (limited to 'usr.sbin')
-rw-r--r--usr.sbin/adduser/adduser.sh32
1 files changed, 19 insertions, 13 deletions
diff --git a/usr.sbin/adduser/adduser.sh b/usr.sbin/adduser/adduser.sh
index ee47bdd..2b6398a 100644
--- a/usr.sbin/adduser/adduser.sh
+++ b/usr.sbin/adduser/adduser.sh
@@ -187,25 +187,31 @@ add_user() {
_passwdmethod=
_name="-n '$username'"
- [ -n "$uuid" ] && _uid="-u '$uuid'"
- [ -n "$ulogingroup" ] && _group="-g '$ulogingroup'"
- [ -n "$ugroups" ] && _grouplist="-G '$ugroups'"
- [ -n "$ushell" ] && _shell="-s '$ushell'"
- [ -n "$uhome" ] && _home="-m -d '$uhome'"
- [ -n "$uclass" ] && _class="-L '$uclass'"
- [ -n "$ugecos" ] && _comment="-c '$ugecos'"
- [ -n "$udotdir" ] && _dotdir="-k '$udotdir'"
- [ -n "$uexpire" ] && _expire="-e '$uexpire'"
- [ -n "$upwexpire" ] && _pwexpire="-p '$upwexpire'"
+ [ -n "$uuid" ] && _uid='-u "$uuid"'
+ [ -n "$ulogingroup" ] && _group='-g "$ulogingroup"'
+ [ -n "$ugroups" ] && _grouplist='-G "$ugroups"'
+ [ -n "$ushell" ] && _shell='-s "$ushell"'
+ [ -n "$uhome" ] && _home='-m -d "$uhome"'
+ [ -n "$uclass" ] && _class='-L "$uclass"'
+ [ -n "$ugecos" ] && _comment='-c "$ugecos"'
+ [ -n "$udotdir" ] && _dotdir='-k "$udotdir"'
+ [ -n "$uexpire" ] && _expire='-e "$uexpire"'
+ [ -n "$upwexpire" ] && _pwexpire='-p "$upwexpire"'
case $passwdtype in
no)
_passwdmethod="-w no"
_passwd="-h -"
;;
yes)
+ # Note on processing the password: The outer double quotes
+ # make literal everything except ` and \ and $.
+ # The outer single quotes make literal ` and $.
+ # We can ensure the \ isn't treated specially by specifying
+ # the -r switch to the read command used to obtain the input.
+ #
_passwdmethod="-w yes"
_passwd="-h 0"
- _upasswd="echo '$upass' |"
+ _upasswd='echo "$upass" |'
;;
none)
_passwdmethod="-w none"
@@ -521,7 +527,7 @@ get_password() {
input_from_file() {
_field=
- while read fileline ; do
+ while read -r fileline ; do
case "$fileline" in
\#*|'')
return 0
@@ -629,7 +635,7 @@ input_interactive() {
trap 'stty echo; exit' 0 1 2 3 15
stty -echo
echo -n "Enter password: "
- read upass
+ read -r upass
echo''
echo -n "Enter password again: "
read _passconfirm
OpenPOWER on IntegriCloud