From 45ad89b6cddbcb3c112f1c2cdfd4361bc7fdced3 Mon Sep 17 00:00:00 2001 From: Jonas Smedegaard Date: Sat, 9 Feb 2013 19:54:08 +0100 Subject: Dual-quote arguments passed to su_monkeysphere_user() when possible. It is a healthy coding practice to keep each argument separate when executing system calls, i.e. quote each variable separately instead of relying on whitespace to indicate argument separation. Quoting shell-inside-shell is tricky to do right, and gets trickier when the wrapper demands unusually complex quoting. su_monkeysphere_user() expands arguments using "$*" which (unlike "$@") collapses all arguments into a single string, and therefore require "risky" arguments (e.g. ones containing variables that may contain space or other unusual characters) to be dual-quoted for them to not wreak havoc at the inside shell. This patch improves arguments passed to su_monkeysphere_user() by first single-quoting and then double-quoting arguments containing variables. NB! Dynamic arguments are only double-quoted ( "$@" ) which looks safe but effectively is a noop (quoting is lost at wrapper!). --- src/share/ma/update_users | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/share/ma/update_users') diff --git a/src/share/ma/update_users b/src/share/ma/update_users index 991c302..09ca9cb 100644 --- a/src/share/ma/update_users +++ b/src/share/ma/update_users @@ -79,7 +79,7 @@ for uname in $unames ; do # process authorized_user_ids file, as monkeysphere user su_monkeysphere_user \ - . "${SYSSHAREDIR}/process_authorized_user_ids" "'$STRICT_MODES'" - \ + . "'${SYSSHAREDIR}/process_authorized_user_ids'" "'$STRICT_MODES'" - \ < "$authorizedUserIDs" \ > "$tmpAuthorizedKeys" -- cgit v1.2.3