From: Jo-Philipp Wich Date: Tue, 25 Jan 2022 21:56:56 +0000 (+0100) Subject: luci-base: explicitly invoke busybox applet for password change X-Git-Url: http://git.openwrt.org/%22https:/collectd.org//%22http:/www.crowdsec.net/%22/%22https:/collectd.org/%22http:/www.crowdsec.net/%22?a=commitdiff_plain;h=22e2bfb09667e167a93b5eca4487ac41669126d9;p=project%2Fluci.git luci-base: explicitly invoke busybox applet for password change Ensure to invoke the Busybox `passwd` applet to change the system password in a non-interactive manner. Non-Busybox variants may not take the new password input from stdin or use password hashes which are not supported by musl's `crypt()` implementation by default. Fixes: #5629 Signed-off-by: Jo-Philipp Wich --- diff --git a/modules/luci-base/root/usr/libexec/rpcd/luci b/modules/luci-base/root/usr/libexec/rpcd/luci index dccdbee900..d17a7cf40e 100755 --- a/modules/luci-base/root/usr/libexec/rpcd/luci +++ b/modules/luci-base/root/usr/libexec/rpcd/luci @@ -447,7 +447,7 @@ local methods = { call = function(args) local util = require "luci.util" return { - result = (os.execute("(echo %s; sleep 1; echo %s) | passwd %s >/dev/null 2>&1" %{ + result = (os.execute("(echo %s; sleep 1; echo %s) | /bin/busybox passwd %s >/dev/null 2>&1" %{ luci.util.shellquote(args.password), luci.util.shellquote(args.password), luci.util.shellquote(args.username)