Great Circle Associates Majordomo-Workers
(October 1998)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: list passwords with double-quotes in them
From: Jason L Tibbitts III <tibbs @ hpc . uh . edu>
Date: 05 Oct 1998 12:42:51 -0500
To: majordomo-workers @ greatcircle . com, Dave Barr <barr @ cis . ohio-state . edu>
In-reply-to: Dave Barr's message of "Mon, 05 Oct 1998 08:47:20 -0400"
References: <3618BFD8.3F4BC940@cis.ohio-state.edu>

>>>>> "DB" == Dave Barr <barr@cis.ohio-state.edu> writes:

DB> One of my list admins just had a list password with a double-quote in
DB> it.  It totally blew up everything.

Wow.  I've never tried that.  Well, I just set one and it doesn't seem to
be giving me any problems:

XYX:sina:~/mj/cvs> mj_shell -p 'bl"ah' who test-list
Members of list "test-list":
    tibbs@sina.hpc.uh.edu
1 listed subscriber

It works fine via email, too.  This is with latest CVS, but I can't see
that anything changed in that area recently.  And I can't see where
anything would care about the quote; it's just used in a string comparison.

DB> Can't locate object method "canon" via package
DB> "barr@mail.cis.ohio-state.edu" at
DB> /opt/majordomo/lib/auto/Mj/Access/validate_passwd.al line 27.

Hmmm.  I'd need to see more debugging here.  The error would indicate that
something is passing a string where it's supposed to be passing an Mj::Addr
object.  I'd need to see the whole call tree in order to trace it back.
It's very possible that this is related to the actual command that they're
running and not the password.

DB> Also, does Majordomo log its errors to a file?

Check the log files in wherever you set tmpdir to.  All output is
redirected there.

 - J<


References:
Indexed By Date Previous: list passwords with double-quotes in them
From: Dave Barr <barr@cis.ohio-state.edu>
Next: Re: Security flaw in confirmation cookie
From: Joachim Schrod <jschrod@acm.org>
Indexed By Thread Previous: list passwords with double-quotes in them
From: Dave Barr <barr@cis.ohio-state.edu>
Next: More digest stuff
From: Jason L Tibbitts III <tibbs@hpc.uh.edu>

Google
 
Search Internet Search www.greatcircle.com