[PATCH] Only allow ascii characters in oem-config password fields

Bug #495695 reported by Debbie Beliveau
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
user-setup (Ubuntu)
New
Undecided
Unassigned

Bug Description

Binary package hint: ubiquity

Currently, oem-config does not complain if the user includes a non-ascii character in their password. This is generally not a problem because there usually is not an easy way for the user to enter a non-ascii character during oem-config. However, it is still possible for the user to enter a non-ascii character and some oem projects actually require that scim be enabled in oem-config (so, for example, the user's real name can be entered in Japanese).

Attached is a patch to ubiquity that has oem-config check the password for non-ascii characters. If any such characters are detected, oem-config will complain and the user is forced to enter a new password.

Tags: oem-services

Related branches

Revision history for this message
Debbie Beliveau (debbie-beliveau) wrote :
tags: added: oem-services
Revision history for this message
Loïc Minier (lool) wrote :

The patch changes the automatically downloaded user-setup copy in ubiquity; re-assigning to user-setup

affects: ubiquity (Ubuntu) → user-setup (Ubuntu)
Revision history for this message
Loïc Minier (lool) wrote :

Note for self: I'm not sure busybox is built with "expr"'s support for regexps in Debian.

Revision history for this message
Loïc Minier (lool) wrote :

"graph" in the regexp doesn't allow for space; is this on purpose?

Revision history for this message
Loïc Minier (lool) wrote :

I unpacked Debian sid's busybox-udeb and could run bin/busybox expr foo : foo, so it seems it has sufficient support.

Revision history for this message
Loïc Minier (lool) wrote :

It's not clear to me how this is specific to oem-config? it doesn't seem to be

Revision history for this message
Loïc Minier (lool) wrote :

I prepared a merge proposal for this as I'm not sure I understand these bits well enough.

Revision history for this message
Evan (ev) wrote :

What's wrong with a UTF-8 password?

Revision history for this message
Evan (ev) wrote :

To elaborate, I've done some testing on this and found no issues, nor outstanding bugs, with non-ascii passwords. That said, it's a big Internet, and I'm sure I could've missed something.

Revision history for this message
Colin Watson (cjwatson) wrote :

It would be helpful to re-prepare the merge review against lp:~ubuntu-core-dev/user-setup/ubuntu, so that it's possible to see the effective change being proposed.

Revision history for this message
Sebastien Bacher (seb128) wrote :

Debbie is that still something that applies to the current version? Could you do what Colin asked for in the previous comment?

Revision history for this message
Michael Terry (mterry) wrote :

I rebased the patch onto user-setup, in lp:~mterry/user-setup/only-ascii-passwords.

I can't speak to Evan's comment about what the problem is with utf-8 passwords these days. I believe they used to cause problems, but I'm not sure what the state of art is.

Revision history for this message
Martin Pitt (pitti) wrote :

I'm unsubscribing the sponsors team. This was discussed between Debbie and Colin, and so far the result is that this should be sent to Debian and then merged back.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.