The branch main has been updated by bapt:
URL:
https://cgit.FreeBSD.org/src/commit/?id=e0155c6989049da43c5499f7129002aa17d1ca79
commit e0155c6989049da43c5499f7129002aa17d1ca79
Author: pbuff <pb...@qq.com>
AuthorDate: 2023-05-16 03:05:30 +0000
Commit: Baptiste Daroussin <b...@freebsd.org>
CommitDate: 2023-05-16 06:48:08 +0000
pw: The pw_checkname function has added ';' checking.
The pw_checkname function forgot to include a ';'
when checking usernames, causing shell commands
to be executed when a username with a ';' is deleted.
PR: 271427
MFC After: 3 days
---
usr.sbin/pw/pw_user.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/usr.sbin/pw/pw_user.c b/usr.sbin/pw/pw_user.c
index c0002f985bfb..c8e8de1fc46a 100644
--- a/usr.sbin/pw/pw_user.c
+++ b/usr.sbin/pw/pw_user.c
@@ -636,7 +636,7 @@ pw_checkname(char *name, int gecos)
showtype = "gecos field";
} else {
/* See if the name is valid as a userid or group. */
- badchars = " ,\t:+&#%$^()!@~*?<>=|\\/\"";
+ badchars = " ,\t:+&#%$^()!@~*?<>=|\\/\";";
showtype = "userid/group name";
/* Userids and groups can not have a leading '-'. */
if (*ch == '-')
