diff --git a/wiki/addwikiuser.in b/wiki/addwikiuser.in index 03f91f011fa737f3dbe801646af795d7d5b941c2..b736764b413f62735c01d0f9d15880de8ae90c67 100644 --- a/wiki/addwikiuser.in +++ b/wiki/addwikiuser.in @@ -180,13 +180,14 @@ utime $now, $now, $lockfile; # we use that. Otherwise have to form one from the user name. Ick. # my $query_result = - DBQueryFatal("select wikiname,usr_name,usr_email ". + DBQueryFatal("select wikiname,usr_name,usr_email,usr_pswd ". "from users where uid='$user'"); if (!$query_result->numrows) { fatal("No such user $user in the DB!"); } -my ($wikiname,$usr_name,$usr_email) = $query_result->fetchrow_array(); +my ($wikiname,$usr_name,$usr_email,$usr_pswd) = + $query_result->fetchrow_array(); if (!defined($wikiname)) { # In update mode, do nothing if no wikiname. @@ -247,8 +248,11 @@ if ($CONTROL ne $BOSSNODE) { print "Adding user $user to the wiki on $CONTROL.\n"; } + # shell escape. + $usr_pswd =~ s/\$/\\\$/g; + if (system("$SSH -host $CONTROL $WIKIPROXY ". - " $optarg adduser $user $wikiname")) { + " $optarg adduser $user $wikiname '$usr_pswd'")) { fatal("$WIKIPROXY failed on $CONTROL!"); } } diff --git a/wiki/wikiproxy.in b/wiki/wikiproxy.in index 709fbf5644cc64206fcf6548978fd422a47fbf45..3e0cde7b52dd7334764ccd6dd993b9acfb7a88e9 100644 --- a/wiki/wikiproxy.in +++ b/wiki/wikiproxy.in @@ -13,7 +13,7 @@ use Errno; # sub usage() { - print "Usage: wikiproxy adduser <uid> <wikiname> or\n"; + print "Usage: wikiproxy adduser <uid> <wikiname> <passhash> or\n"; print " wikiproxy deluser <uid> <wikiname> or\n"; print " wikiproxy addproject <pid> <wikiname> or\n"; print " wikiproxy setgroups <wikiuser> <wikigroup> ...\n"; @@ -111,20 +111,13 @@ exit(0); sub AddWikiUser(@) { usage() - if (@_ != 2); + if (@_ != 3); - my ($user, $wikiname) = @_; + my ($user, $wikiname, $passwd) = @_; chdir("$WIKIUSERDIR") or fatal("Could not chdir to $WIKIUSERDIR"); - # - # Grab the password hash. - # - my ($name,$passwd) = getpwnam($user); - fatal("No such user $user in the password file") - if (!defined($name)); - # # If the password file does not have the entry, just tack it onto # the end of the file. Otherwise we have to get fancier so we