[X2Go-Dev] [X2go-User] Usernames with dashes causes errors?

[Mike Gabriel]

Hi Alex,

On Di 21 Feb 2012 15:03:17 CET Mike Gabriel wrote:

> Hi Christoffer,
>
> On Di 21 Feb 2012 12:58:08 CET christoffer krakou wrote:
>
>> Hello x2go people :)
>>
>> i have a server running Ubuntu 11.10 with an x2goserver   
>> installation, version 3.0.99.10-0~434~oneiric1, and it is running   
>> well and stable.
>>
>> We had some strange problems, though. We contacted a school, who   
>> would help us test the server under daily use, and made some test   
>> users for them, called "test-*their name*". When they, and i, tried  
>>  to log into those users, the client would freeze, no error message  
>>  or anything. On the server, the x2goagent would run amok, soaking  
>> up  CPU power. The problem seems to occur only on users with dashes  
>> in  their names.
>>
>> Can anyone replicate this? it is quite strange
>
> I can confirm this bug. The '-' sign is a field separator in the   
> session ID hash. As the username is part of the session ID all  
> scripts  will go bonkers with usernames containing a '-'.
>
> That indeed is worth fixing.
>
> Mike

I just took a look at this and it is not so trivial to fix...

Debian's adduser (3.110) script checks validity of user names against  
this regexp:

   '/^[_.A-Za-z0-9][- at _.A-Za-z0-9]*$?$/'

Using a '-' as a field separator in the session ID intereferes with  
the allowed characters in usernames.

The issue has to be addressed in x2goserver, x2goclient and  
python-x2go. I am not sure about the other helper applications (like  
the desktop bindings, desktopsharing, etc.).

Greets,
Mike

-- 

DAS-NETZWERKTEAM
mike gabriel, dorfstr. 27, 24245 barmissen
fon: +49 (4302) 281418, fax: +49 (4302) 281419

GnuPG Key ID 0xB588399B
mail: mike.gabriel at das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 490 bytes
Desc: Digitale PGP-Unterschrift
URL: <http://lists.x2go.org/pipermail/x2go-dev/attachments/20120221/163612f1/attachment.pgp>