From 623abc6bdff15a77fc14eac9dc1af975e9d98b2f Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Tue, 30 Nov 2010 17:00:54 -0500
Subject: Properly quote passwords sent to pkisilent so special characters
 work.

Also check for url-encoded passwords before logging them.

ticket 324
---
 ipaserver/install/cainstance.py | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

(limited to 'ipaserver/install/cainstance.py')

diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
index 7cc8d50a3..9d7a4c237 100644
--- a/ipaserver/install/cainstance.py
+++ b/ipaserver/install/cainstance.py
@@ -507,12 +507,12 @@ class CAInstance(service.Service):
                     "-cs_hostname", self.host_name,
                     "-cs_port", str(ADMIN_SECURE_PORT),
                     "-client_certdb_dir", self.ca_agent_db,
-                    "-client_certdb_pwd", '"%s"' % self.admin_password,
+                    "-client_certdb_pwd", "'%s'" % self.admin_password,
                     "-preop_pin" , preop_pin,
                     "-domain_name", self.domain_name,
                     "-admin_user", "admin",
                     "-admin_email",  "root@localhost",
-                    "-admin_password", '"%s"' % self.admin_password,
+                    "-admin_password", "'%s'" % self.admin_password,
                     "-agent_name", "ipa-ca-agent",
                     "-agent_key_size", "2048",
                     "-agent_key_type", "rsa",
@@ -520,14 +520,14 @@ class CAInstance(service.Service):
                     "-ldap_host", self.host_name,
                     "-ldap_port", str(self.ds_port),
                     "-bind_dn", "\"cn=Directory Manager\"",
-                    "-bind_password", '"%s"' % self.dm_password,
+                    "-bind_password", "'%s'" % self.dm_password,
                     "-base_dn", self.basedn,
                     "-db_name", "ipaca",
                     "-key_size", "2048",
                     "-key_type", "rsa",
                     "-key_algorithm", "SHA256withRSA",
                     "-save_p12", "true",
-                    "-backup_pwd", '"%s"' % self.admin_password,
+                    "-backup_pwd", "'%s'" % self.admin_password,
                     "-subsystem_name", self.service_name,
                     "-token_name", "internal",
                     "-ca_subsystem_cert_subject_name", "\"CN=CA Subsystem,%s\"" % self.subject_base,
@@ -565,7 +565,7 @@ class CAInstance(service.Service):
                 args.append("-clone_p12_file")
                 args.append("ca.p12")
                 args.append("-clone_p12_password")
-                args.append('"%s"' % self.dm_password)
+                args.append("'%s'" % self.dm_password)
                 args.append("-sd_hostname")
                 args.append(self.master_host)
                 args.append("-sd_admin_port")
@@ -573,7 +573,7 @@ class CAInstance(service.Service):
                 args.append("-sd_admin_name")
                 args.append("admin")
                 args.append("-sd_admin_password")
-                args.append('"%s"' % self.admin_password)
+                args.append("'%s'" % self.admin_password)
                 args.append("-clone_uri")
                 args.append("https://%s:%d" % (self.master_host, EE_SECURE_PORT))
             else:
@@ -775,7 +775,7 @@ class CAInstance(service.Service):
             pwd_file = self.ra_agent_pwd
         new_args = ["/usr/bin/certutil", "-d", database, "-f", pwd_file]
         new_args = new_args + args
-        return ipautil.run(new_args, stdin)
+        return ipautil.run(new_args, stdin, nolog=(pwd_file,))
 
     def __create_ra_agent_db(self):
         if ipautil.file_exists(self.ra_agent_db + "/cert8.db"):
-- 
cgit