Changeset 3955 in subversion

Timestamp:

Sep 10, 2010 4:09:10 AM (3 years ago)

Author:

alec

Message:

• Security improvements for chpasswd driver (#1486987)

Location:

trunk/plugins/password

Files:

• README (modified) (1 diff)
• drivers/chpasswd.php (modified) (2 diffs)
• package.xml (modified) (3 diffs)

trunk/plugins/password/README

@@ -224 +224 @@
  the 'chpasswd' command. See config.inc.php file.
 
+ Attached wrapper script (chpass-wrapper.py) restricts password changes
+ to uids >= 1000 and can deny requests based on a blacklist.
+
 
  2.12.  LDAP - no PEAR (ldap_simple)

trunk/plugins/password/drivers/chpasswd.php

@@ -12 +12 @@
  * @author Alex Cartwright <acartwright@mutinydesign.co.uk)
  */
- 
+
 function password_save($currpass, $newpass)
 {
-    $cmd = sprintf('echo \'%1$s:%2$s\' | %3$s; echo $?',
-                addcslashes($_SESSION['username'], "'"),
-                addcslashes($newpass, "'"),
-                rcmail::get_instance()->config->get('password_chpasswd_cmd'));
+    $cmd = rcmail::get_instance()->config->get('password_chpasswd_cmd');
+    $username = $_SESSION['username'];
 
-    if (exec($cmd) == 0) {
+    $handle = popen($cmd, "w");
+    fwrite($handle, "$username:$newpass");
+
+    if (pclose($handle) == 0) {
         return PASSWORD_SUCCESS;
     }
@@ -34 +35 @@
     return PASSWORD_ERROR;
 }
-
-?>

trunk/plugins/password/package.xml

@@ -16 +16 @@
                 <active>yes</active>
         </lead>
-        <date></date>
-        <time></time>
+        <date>2010-09-10</date>
+        <time>09:00:00</time>
         <version>
                 <release>1.7</release>
@@ -29 +29 @@
         <notes>
 - Added XMail driver
+- Improve security of chpasswd driver using popen instead of exec+echo (#1486987)
+- Added chpass-wrapper.py script to improve security (#1486987)
     </notes>
         <contents>
@@ -82 +84 @@
             <file name="drivers/virtualmin.php" role="php"></file>
             <file name="drivers/ximss.php" role="php"></file>
+            <file name="drivers/xmail.php" role="php"></file>
+            <file name="drivers/chpass-wrapper.py" role="data"></file>
 
             <file name="config.inc.php.disc" role="data"></file>