Bug 120669 - test to allow - and _ in usernames is too generous [has patch]
test to allow - and _ in usernames is too generous [has patch]
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: system-config-users (Show other bugs)
rawhide
All Linux
medium Severity high
: ---
: ---
Assigned To: Brent Fox
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2004-04-12 16:44 EDT by Matthew Miller
Modified: 2007-11-30 17:10 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2004-04-15 14:22:59 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
allow - _ in names without ignoring further characters (1.45 KB, patch)
2004-04-15 13:22 EDT, Matthew Miller
no flags Details | Diff

  None (edit)
Description Matthew Miller 2004-04-12 16:44:17 EDT
Description of problem:

Sometime between redhat-config-users and now, this bit of code

        if i == "_" or i == "-":
            #specifically allow "_" and "-"
            return 1
        
was added to isUsernameOk() from asciiCheck.py. This is in a loop
which checks each character for okayness. The problem: if a - or _
occurs anywhere in the given username, the entire rest of the name is
passed without checking. So, one can give a username like "foo- b a
r", resulting in a runtime error (I assume from libuser) and a hung GUI.

Version-Release number of selected component (if applicable):

Not sure when this started, but it's in the test2 package, and it's in
1.2.11-4, which is the latest in the development tree.

How reproducible:

always

Steps to Reproduce:
1. hit the Add User button
2. enter "- blah" for a username
3. enter some password
4. hit OK
5. Boom!
  
Actual results:

Dialog goes gray and freezes; RuntimeError on console.

Expected results:

A pretty "don't do that!" warning message.

Additional info:

An alternate approach... instead of the whole new check, modify the
"if i in string.punctuation" one and either reduce what
string.punctuation is or add a second "oh except" check.
Comment 1 Matthew Miller 2004-04-15 13:21:19 EDT
Looks like this was added in 1.1.16-1 in response to bug #99115....
Comment 2 Matthew Miller 2004-04-15 13:22:44 EDT
Created attachment 99448 [details]
allow - _ in names without ignoring further characters

here, try this instead. :)
Comment 3 Matthew Miller 2004-04-15 14:08:43 EDT
Oh -- my patch doesn't fid the same problem in isGroupnameOk. But you
get the idea. :)
Comment 4 Brent Fox 2004-04-15 14:22:59 EDT
Should be fixed in system-config-users-1.2.12-1 and firstboot-1.3.11-1
in Rawhide.  Thanks for your report.

Note You need to log in before you can comment on or make changes to this bug.