Imported Upstream version 1.19.1upstream/1.19.1

1 files changed, 14 insertions, 6 deletions

diff --git a/omusrmsg.c b/omusrmsg.c
index 736f325..0697b59 100644
--- a/omusrmsg.c
+++ b/omusrmsg.c
@@ -266,8 +266,16 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1)
 	if(**pp != '*')
 		return RS_RET_CONFLINE_UNPROCESSED;
 #endif
+       /* User names must begin with a gnu e-regex:
+        *   [a-zA-Z0-9_.]
+	* plus '*' for wall
+        */
+       if (!*p || !((*p >= 'a' && *p <= 'z') || (*p >= 'A' && *p <= 'Z')
+                    || (*p >= '0' && *p <= '9') || *p == '_' || *p == '.' || *p == '*'))
+	       ABORT_FINALIZE(RS_RET_CONFLINE_UNPROCESSED);
+
 	if((iRet = createInstance(&pData)) != RS_RET_OK)
-		return iRet;
+		goto finalize_it;
 
 
 	if(*p == '*') { /* wall */
@@ -276,11 +284,11 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1)
 		pData->bIsWall = 1; /* write to all users */
 		if((iRet = cflineParseTemplateName(&p, *ppOMSR, 0, OMSR_NO_RQD_TPL_OPTS, (uchar*) " WallFmt"))
 		    != RS_RET_OK)
-			return iRet;
+			goto finalize_it;
 	} else {
-		/* everything else is currently treated as a user name
-		 * TODO: we must reconsider this - see also comment in
-		 * loadBuildInModules() in syslogd.c
+                /* everything else beginning with the regex above
+                 * is currently treated as a user name
+                 * TODO: is this portable?
 		 */
 		dbgprintf("users: %s\n", p);	/* ASP */
 		pData->bIsWall = 0; /* write to individual users */
@@ -301,7 +309,7 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1)
 		 */
 		if((iRet = cflineParseTemplateName(&p, *ppOMSR, 0, OMSR_NO_RQD_TPL_OPTS, (uchar*)" StdUsrMsgFmt"))
 		    != RS_RET_OK)
-			return iRet;
+			goto finalize_it;
 	}
 CODE_STD_FINALIZERparseSelectorAct
 ENDparseSelectorAct