--- loncom/pwchange 2001/11/16 06:10:41 1.5 +++ loncom/pwchange 2002/09/19 02:02:59 1.8 @@ -7,22 +7,32 @@ # YEAR=2001 # 10/23,11/13,11/15 Scott Harrison # -# $Id: pwchange,v 1.5 2001/11/16 06:10:41 harris41 Exp $ +# YEAR=2002 +# 02/19 Matthew Hall +# +# $Id: pwchange,v 1.8 2002/09/19 02:02:59 foxr Exp $ ### use strict; +my $noprint = 1; + + +print "In pwchange\n" unless $noprint; +print "Real uid = $< effective uid = $> \n" unless $noprint; # ------------------------------------------------------------------ Untainting $ENV{'PATH'}='/bin:/usr/bin'; # Nullify path information. delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; # nullify potential taints # ---------------------------- Make sure this process is running from user=root -my $wwwid=getpwnam('www'); -if (0!=$<) { + +if (0 != $<) { + print "Username not root" unless $noprint; exit 1; } # ----------------------------------------------- If not running setuid as root if ($>!=0) { + print "Not setuid to root" unless $noprint; exit 1; } @@ -30,14 +40,16 @@ if ($>!=0) { my $user=shift @ARGV; $user=~/^(\w+)$/; my $safe=$1; +print "Save user = $safe" unless $noprint; + my $pword=<>; chomp $pword; unless (length($safe) and ($user eq $safe) and ($safe=~/^[A-Za-z]/)) { exit 2; } - +print "Password = $pword" unless $noprint; my $pbad=0; -map {if (($_<32)&&($_>126)){$pbad=1;}} (split(//,$pword)); +foreach (split(//,$pword)) {if ((ord($_)<32)||(ord($_)>126)){$pbad=1;}} exit 3 if $pbad; # --------------------------------------------------------- Call system command