- markus@cvs.openbsd.org 2003/02/02 10:51:13

     [scp.c]
     call okname() only when using system(3) for remote-remote copy;
     fixes bugs #483, #472; ok deraadt@, mouring@

2 files changed, 20 insertions, 9 deletions

diff --git a/ChangeLog b/ChangeLog
index a966fbdde..c36f52055 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -20,6 +20,10 @@
      [sshd.8]
      typos; sshd(8): help and ok markus@
      help and ok millert@
+   - markus@cvs.openbsd.org 2003/02/02 10:51:13
+     [scp.c]
+     call okname() only when using system(3) for remote-remote copy;
+     fixes bugs #483, #472; ok deraadt@, mouring@
 
 20030211
  - (djm) Cygwin needs libcrypt too. Patch from vinschen@redhat.com
@@ -1120,4 +1124,4 @@
      save auth method before monitor_reset_key_state(); bugzilla bug #284;
      ok provos@
 
-$Id: ChangeLog,v 1.2598 2003/02/24 00:52:26 djm Exp $
+$Id: ChangeLog,v 1.2599 2003/02/24 00:52:58 djm Exp $
diff --git a/scp.c b/scp.c
index 60484e769..e44a1cf69 100644
--- a/scp.c
+++ b/scp.c
@@ -75,7 +75,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: scp.c,v 1.100 2003/01/23 14:06:15 markus Exp $");
+RCSID("$OpenBSD: scp.c,v 1.101 2003/02/02 10:51:13 markus Exp $");
 
 #include "xmalloc.h"
 #include "atomicio.h"
@@ -370,8 +370,6 @@ toremote(targ, argc, argv)
                 tuser = argv[argc - 1];
                 if (*tuser == '\0')
                         tuser = NULL;
-                else if (!okname(tuser))
-                        exit(1);
         } else {
                 thost = argv[argc - 1];
                 tuser = NULL;
@@ -399,6 +397,8 @@ toremote(targ, argc, argv)
                                         suser = pwd->pw_name;
                                 else if (!okname(suser))
                                         continue;
+                                if (tuser && !okname(tuser))
+                                        continue;
                                 snprintf(bp, len,
                                     "%s%s %s -n "
                                     "-l %s %s %s %s '%s%s%s:%s'",
@@ -472,8 +472,6 @@ tolocal(argc, argv)
                         suser = argv[i];
                         if (*suser == '\0')
                                 suser = pwd->pw_name;
-                        else if (!okname(suser))
-                                continue;
                 }
                 host = cleanhostname(host);
                 len = strlen(src) + CMDNEEDS + 20;
@@ -1085,9 +1083,18 @@ okname(cp0)
                 c = (int)*cp;
                 if (c & 0200)
                         goto bad;
-                if (!isalpha(c) && !isdigit(c) &&
-                    c != '@' && c != '_' && c != '-' && c != '.' && c != '+')
-                        goto bad;
+                if (!isalpha(c) && !isdigit(c)) {
+                        switch (c) {
+                        case '\'':
+                        case '"':
+                        case '`':
+                        case ' ':
+                        case '#':
+                                goto bad;
+                        default:
+                                break;
+                        }
+                }
         } while (*++cp);
         return (1);