Bug 31933

Summary: pw(8) can interpret numeric name as userid during userdel
Product: Base System Reporter: Ted Cabeen <ted>
Component: binAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Only Me CC: marcus
Priority: Normal    
Version: 4.4-RELEASE   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
file.diff none

Description Ted Cabeen 2001-11-12 19:10:00 UTC
When pw is given a non-existenent numeric username as part of a delete, print
or modify command, it will interpret that username as a uid.  This occurs even
if the username was expliclity set using the -n argument.  This occurs because
the -n argument is overloaded.  It can be used both explicitly, and implicitly
for the initial username/uid argument.

Fix: This is a patch to the CVS version of pw.  It changes the implicit argument
prepended to the initial name/uid argument from "-n" to "--".  "--" is an
illegal argument on the command line, so by using it here, we avoid 
overloading any of our user given arguments.  Besides removing the 
overloading from the "-n" argument, we also make sure that we only do the 
name->uid conversion if we need to and if the "--" argument isn't NULL.

cvs server: Diffing .
How-To-Repeat: 
root@red# pw useradd -n testpw -u 41001
root@red# id testpw
uid=41001(testpw) gid=41001(testpw) groups=41001(testpw)
root@red# id 41001
uid=41001(testpw) gid=41001(testpw) groups=41001(testpw)
root@red# pw userdel -n 41001
root@red# id testpw
id: testpw: no such user
root@red# id 41001
id: 41001: no such user
Comment 1 Matt Dillon freebsd_committer freebsd_triage 2002-03-23 01:02:36 UTC
Responsible Changed
From-To: freebsd-bugs->dillon

On my plate.
Comment 2 Giorgos Keramidas freebsd_committer freebsd_triage 2003-02-23 02:16:06 UTC
Responsible Changed
From-To: dillon->freebsd-bugs

Back to the free pool.
Comment 3 commit-hook freebsd_committer freebsd_triage 2015-07-28 12:21:20 UTC
A commit references this bug:

Author: bapt
Date: Tue Jul 28 12:20:58 UTC 2015
New revision: 285948
URL: https://svnweb.freebsd.org/changeset/base/285948

Log:
  when -n is passed to any pw subcommand it is always expected to be considered as
  a name so do not try to convert it to an id if it is a numeric value

  PR:		31933
  Reported by:	ted@impulse.net
  Sponsored by:	gandi.net

Changes:
  head/usr.sbin/pw/pw.c
  head/usr.sbin/pw/tests/pw_userdel.sh