version 1.5, 2001/11/16 06:10:41
|
version 1.7, 2002/09/16 13:27:40
|
Line 7
|
Line 7
|
# YEAR=2001 |
# YEAR=2001 |
# 10/23,11/13,11/15 Scott Harrison |
# 10/23,11/13,11/15 Scott Harrison |
# |
# |
|
# YEAR=2002 |
|
# 02/19 Matthew Hall |
|
# |
# $Id$ |
# $Id$ |
### |
### |
|
|
use strict; |
use strict; |
|
my $noprint = 1; |
|
|
# ------------------------------------------------------------------ Untainting |
# ------------------------------------------------------------------ Untainting |
$ENV{'PATH'}='/bin:/usr/bin'; # Nullify path information. |
$ENV{'PATH'}='/bin:/usr/bin'; # Nullify path information. |
Line 19 delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}
|
Line 23 delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}
|
# ---------------------------- Make sure this process is running from user=root |
# ---------------------------- Make sure this process is running from user=root |
my $wwwid=getpwnam('www'); |
my $wwwid=getpwnam('www'); |
if (0!=$<) { |
if (0!=$<) { |
|
print "Username not www" unless $noprint; |
exit 1; |
exit 1; |
} |
} |
# ----------------------------------------------- If not running setuid as root |
# ----------------------------------------------- If not running setuid as root |
if ($>!=0) { |
if ($>!=0) { |
|
print "Not setuid to root" unless $noprint; |
exit 1; |
exit 1; |
} |
} |
|
|
Line 30 if ($>!=0) {
|
Line 36 if ($>!=0) {
|
my $user=shift @ARGV; |
my $user=shift @ARGV; |
$user=~/^(\w+)$/; |
$user=~/^(\w+)$/; |
my $safe=$1; |
my $safe=$1; |
|
print "Save user = $safe" unless $noprint; |
|
|
my $pword=<>; |
my $pword=<>; |
chomp $pword; |
chomp $pword; |
unless (length($safe) and ($user eq $safe) and ($safe=~/^[A-Za-z]/)) { |
unless (length($safe) and ($user eq $safe) and ($safe=~/^[A-Za-z]/)) { |
exit 2; |
exit 2; |
} |
} |
|
print "Password = $pword" unless $noprint; |
my $pbad=0; |
my $pbad=0; |
map {if (($_<32)&&($_>126)){$pbad=1;}} (split(//,$pword)); |
foreach (split(//,$pword)) {if ((ord($_)<32)||(ord($_)>126)){$pbad=1;}} |
exit 3 if $pbad; |
exit 3 if $pbad; |
|
|
# --------------------------------------------------------- Call system command |
# --------------------------------------------------------- Call system command |