4 files changed, 59 insertions, 25 deletions

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 08476bdd8f..c4baa8f7a5 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -415,7 +415,8 @@ BOOL in_list(char *s,char *list,BOOL casesensitive);
 BOOL string_init(char **dest,const char *src);
 void string_free(char **s);
 BOOL string_set(char **dest,const char *src);
-BOOL string_sub(char *s,const char *pattern,const char *insert);
+void string_sub(char *s,const char *pattern,const char *insert);
+void all_string_sub(char *s,const char *pattern,const char *insert);
 void split_at_last_component(char *path, char *front, char sep, char *back);
 
 /*The following definitions come from  lib/util_unistr.c  */
diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c
index c943a854cf..dad0e85477 100644
--- a/source3/lib/util_str.c
+++ b/source3/lib/util_str.c
@@ -990,6 +990,7 @@ BOOL string_set(char **dest,const char *src)
   return(string_init(dest,src));
 }
 
+
 /****************************************************************************
 substitute a string for a pattern in another string. Make sure there is 
 enough room!
@@ -997,31 +998,63 @@ enough room!
 This routine looks for pattern in s and replaces it with 
 insert. It may do multiple replacements.
 
-return True if a substitution was done.
+any of " ; or ` in the insert string are replaced with _
 ****************************************************************************/
-BOOL string_sub(char *s,const char *pattern,const char *insert)
+void string_sub(char *s,const char *pattern,const char *insert)
 {
-  BOOL ret = False;
-  char *p;
-  size_t ls,lp,li;
+	char *p;
+	size_t ls,lp,li, i;
+
+	if (!insert || !pattern || !s) return;
+
+	ls = strlen(s);
+	lp = strlen(pattern);
+	li = strlen(insert);
+
+	if (!*pattern) return;
+	
+	while (lp <= ls && (p = strstr(s,pattern))) {
+		memmove(p+li,p+lp,ls + 1 - (PTR_DIFF(p,s) + lp));
+		for (i=0;i<li;i++) {
+			switch (insert[i]) {
+			case '`':
+			case '"':
+			case ';':
+				p[i] = '_';
+				break;
+			default:
+				p[i] = insert[i];
+			}
+		}
+		s = p + li;
+		ls += (li-lp);
+	}
+}
 
-  if (!insert || !pattern || !s) return(False);
 
-  ls = strlen(s);
-  lp = strlen(pattern);
-  li = strlen(insert);
+/****************************************************************************
+similar to string_sub() but allows for any character to be substituted. 
+Use with caution!
+****************************************************************************/
+void all_string_sub(char *s,const char *pattern,const char *insert)
+{
+	char *p;
+	size_t ls,lp,li, i;
 
-  if (!*pattern) return(False);
+	if (!insert || !pattern || !s) return;
 
-  while (lp <= ls && (p = strstr(s,pattern)))
-    {
-      ret = True;
-      memmove(p+li,p+lp,ls + 1 - (PTR_DIFF(p,s) + lp));
-      memcpy(p,insert,li);
-      s = p + li;
-      ls = strlen(s);
-    }
-  return(ret);
+	ls = strlen(s);
+	lp = strlen(pattern);
+	li = strlen(insert);
+
+	if (!*pattern) return;
+	
+	while (lp <= ls && (p = strstr(s,pattern))) {
+		memmove(p+li,p+lp,ls + 1 - (PTR_DIFF(p,s) + lp));
+		memcpy(p, insert, li);
+		s = p + li;
+		ls += (li-lp);
+	}
 }
 
 /****************************************************************************
diff --git a/source3/smbd/chgpasswd.c b/source3/smbd/chgpasswd.c
index 69ac69b59b..30b9b3fed6 100644
--- a/source3/smbd/chgpasswd.c
+++ b/source3/smbd/chgpasswd.c
@@ -434,12 +434,12 @@ BOOL chgpasswd(char *name,char *oldpass,char *newpass, BOOL as_root)
   }
 
   string_sub(passwordprogram,"%u",name);
-  string_sub(passwordprogram,"%o",oldpass);
-  string_sub(passwordprogram,"%n",newpass);
+  all_string_sub(passwordprogram,"%o",oldpass);
+  all_string_sub(passwordprogram,"%n",newpass);
 
   string_sub(chatsequence,"%u",name);
-  string_sub(chatsequence,"%o",oldpass);
-  string_sub(chatsequence,"%n",newpass);
+  all_string_sub(chatsequence,"%o",oldpass);
+  all_string_sub(chatsequence,"%n",newpass);
   return(chat_with_program(passwordprogram,name,chatsequence, as_root));
 }
 
diff --git a/source3/web/statuspage.c b/source3/web/statuspage.c
index 81564390a0..faf1dcb20d 100644
--- a/source3/web/statuspage.c
+++ b/source3/web/statuspage.c
@@ -26,7 +26,7 @@ static char *tstring(time_t t)
 {
 	static pstring buf;
 	pstrcpy(buf, asctime(LocalTime(&t)));
-	string_sub(buf," ","&nbsp;");
+	all_string_sub(buf," ","&nbsp;");
 	return buf;
 }