From e0d8009d76b3a2451cb6c6ed2b241c7eff06ed60 Mon Sep 17 00:00:00 2001 From: Rob Landley Date: Fri, 26 Sep 2014 18:49:44 -0500 Subject: The only illegal characters in a username are ":" (field separator), "\n" (line separator), and "/" (filename separator). Restricting usernames to the legacy posix character allowed set (for filenames, so the $HOME directory is creatable on VFAT and similar) means you can't have UTF-8 usernames. Linux allows any character but / and NUL in filenames. Since root is creating these entries, we assume root knows what it's doing. --- lib/password.c | 32 +------------------------------- 1 file changed, 1 insertion(+), 31 deletions(-) (limited to 'lib/password.c') diff --git a/lib/password.c b/lib/password.c index 2578dfe0..40cbead0 100644 --- a/lib/password.c +++ b/lib/password.c @@ -19,11 +19,7 @@ int get_salt(char *salt, char *algo) int len = al[i].len; char *s = salt; - if (al[i].id) { - *s++ = '$'; - *s++ = '0'+al[i].id; - *s++ = '$'; - } + if (al[i].id) s += sprintf(s, "$%c$", '0'+al[i].id); // Read appropriate number of random bytes for salt i = xopen("/dev/urandom", O_RDONLY); @@ -233,29 +229,3 @@ free_storage: free(filenamesfx); return ret; } - -void is_valid_username(const char *name) -{ - regex_t rp; - regmatch_t rm[1]; - int eval; - char *regex = "^[_.A-Za-z0-9][-_.A-Za-z0-9]*"; //User name REGEX - - xregcomp(&rp, regex, REG_NEWLINE); - - /* compare string against pattern -- remember that patterns - are anchored to the beginning of the line */ - eval = regexec(&rp, name, 1, rm, 0); - regfree(&rp); - if (!eval && !rm[0].rm_so) { - int len = strlen(name); - if ((rm[0].rm_eo == len) || - (rm[0].rm_eo == len - 1 && name[len - 1] == '$')) { - if (len >= LOGIN_NAME_MAX) error_exit("name is too long"); - else return; - } - } - error_exit("'%s', not valid %sname",name, - (((toys.which->name[3] == 'g') || - (toys.which->name[0] == 'g'))? "group" : "user")); -} -- cgit v1.2.3