|
@@ -283,8 +283,7 @@ sub _config {
|
|
|
|
|
|
|
|
# A guest name reaches the filesystem here, so it is a hostname or it is nothing.
|
|
# A guest name reaches the filesystem here, so it is a hostname or it is nothing.
|
|
|
sub _safe_domain ($domain) {
|
|
sub _safe_domain ($domain) {
|
|
|
- $domain //= q{};
|
|
|
|
|
- return undef if $domain eq q{} || length $domain >= 254;
|
|
|
|
|
|
|
+ return undef if !$domain || length $domain >= 254;
|
|
|
return undef if $domain =~ m/(?:^|\.)\.\.?(?:\.|$)/;
|
|
return undef if $domain =~ m/(?:^|\.)\.\.?(?:\.|$)/;
|
|
|
|
|
|
|
|
my ($safe) = $domain =~ m/^([A-Za-z0-9][A-Za-z0-9._-]*)$/;
|
|
my ($safe) = $domain =~ m/^([A-Za-z0-9][A-Za-z0-9._-]*)$/;
|
|
@@ -474,9 +473,9 @@ sub _credentials (%args) {
|
|
|
# typed ones are worth filing away, and only they can be: a value fetched
|
|
# typed ones are worth filing away, and only they can be: a value fetched
|
|
|
# from the vault is already in it.
|
|
# from the vault is already in it.
|
|
|
my %typed;
|
|
my %typed;
|
|
|
- $typed{sudo} = $args{sudo} if ( $args{sudo} // q{} ) ne q{};
|
|
|
|
|
|
|
+ $typed{sudo} = $args{sudo} if $args{sudo};
|
|
|
|
|
|
|
|
- if ( ( $args{totp} // q{} ) ne q{} ) {
|
|
|
|
|
|
|
+ if ( $args{totp} ) {
|
|
|
return ( undef, 'a code identifies somebody, and nobody is logged in' ) unless $user;
|
|
return ( undef, 'a code identifies somebody, and nobody is logged in' ) unless $user;
|
|
|
|
|
|
|
|
# Asked before the code is spent, and the reason is that a code is
|
|
# Asked before the code is spent, and the reason is that a code is
|
|
@@ -493,11 +492,11 @@ sub _credentials (%args) {
|
|
|
return ( undef, $why ) unless $ok;
|
|
return ( undef, $why ) unless $ok;
|
|
|
|
|
|
|
|
my $stored = Trog::Vault::get( $user, $secret_name );
|
|
my $stored = Trog::Vault::get( $user, $secret_name );
|
|
|
- return ( undef, "the stored provisioning passphrase for $user could not be read" ) unless ( $stored // q{} ) ne q{};
|
|
|
|
|
|
|
+ return ( undef, "the stored provisioning passphrase for $user could not be read" ) unless $stored;
|
|
|
$credentials{keepass} = $stored;
|
|
$credentials{keepass} = $stored;
|
|
|
}
|
|
}
|
|
|
else {
|
|
else {
|
|
|
- return ( undef, 'a passphrase is required, as the provisioner asks for one' ) unless ( $args{passphrase} // q{} ) ne q{};
|
|
|
|
|
|
|
+ return ( undef, 'a passphrase is required, as the provisioner asks for one' ) unless $args{passphrase};
|
|
|
$credentials{keepass} = $args{passphrase};
|
|
$credentials{keepass} = $args{passphrase};
|
|
|
$typed{keepass} = $args{passphrase};
|
|
$typed{keepass} = $args{passphrase};
|
|
|
}
|
|
}
|
|
@@ -506,7 +505,7 @@ sub _credentials (%args) {
|
|
|
# reason to -- and no sudo password at all is the ordinary answer, for a
|
|
# reason to -- and no sudo password at all is the ordinary answer, for a
|
|
|
# hypervisor whose login has passwordless sudo.
|
|
# hypervisor whose login has passwordless sudo.
|
|
|
my $sudo = $typed{sudo} // ( $user ? Trog::Vault::get( $user, $sudo_name ) : undef );
|
|
my $sudo = $typed{sudo} // ( $user ? Trog::Vault::get( $user, $sudo_name ) : undef );
|
|
|
- $credentials{sudo} = $sudo if ( $sudo // q{} ) ne q{};
|
|
|
|
|
|
|
+ $credentials{sudo} = $sudo if $sudo;
|
|
|
|
|
|
|
|
_remember( $user, \%typed ) if $args{remember} && $user && %typed;
|
|
_remember( $user, \%typed ) if $args{remember} && $user && %typed;
|
|
|
|
|
|