Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

luci-base: explicitly invoke busybox applet for password change

Browse source 
Ensure to invoke the Busybox `passwd` applet to change the system password
in a non-interactive manner. Non-Busybox variants may not take the new
password input from stdin or use password hashes which are not supported
by musl's `crypt()` implementation by default.

Fixes: #5629
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich 2022-01-25 22:56:56 +01:00
parent 18b1130711
commit 22e2bfb096
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
modules/luci-base/root/usr/libexec/rpcd/luci
View file

@ -447,7 +447,7 @@ local methods = {
call = function(args)
local util = require "luci.util"
return {
result = (os.execute("(echo %s; sleep 1; echo %s) | passwd %s >/dev/null 2>&1" %{
result = (os.execute("(echo %s; sleep 1; echo %s) | /bin/busybox passwd %s >/dev/null 2>&1" %{
luci.util.shellquote(args.password),
luci.util.shellquote(args.password),
luci.util.shellquote(args.username)