From 84c84e29dd3f8b336de6c1f8e62780cb438f3042 Mon Sep 17 00:00:00 2001
From: Nikolai R Kristiansen <nikolai@lucida.no>
Date: Wed, 11 Jan 2017 23:16:23 +0100
Subject: [PATCH] sec: fix password escaping

---
 neuf_kerberos/utils.py | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/neuf_kerberos/utils.py b/neuf_kerberos/utils.py
index 99951f7..3c06092 100644
--- a/neuf_kerberos/utils.py
+++ b/neuf_kerberos/utils.py
@@ -38,12 +38,14 @@ def has_kerberos_principal(username):
 
 def set_kerberos_password(username, raw_password):
     principal = "{}@{}".format(username, settings.KERBEROS_REALM)
-    kadmin_query = " -p {} -w {} -q 'change_password -pw {} {}'".format(
-        settings.KERBEROS_ADMIN_PRINCIPAL,
-        settings.KERBEROS_PASSWORD,
-        raw_password,
-        principal)
-    p = Popen('kadmin' + kadmin_query, shell=True, stdout=PIPE, stderr=PIPE)
+    kadmin_query = 'change_password -pw {} {}'.format(raw_password, principal)
+    kadmin_params = [
+        '-p', settings.KERBEROS_ADMIN_PRINCIPAL,
+        '-w', settings.KERBEROS_PASSWORD,
+        '-q', kadmin_query]
+    cmd = ['kadmin'] + kadmin_params
+
+    p = Popen(cmd, stdout=PIPE, stderr=PIPE)
     output, error = p.communicate()
     if error:
         # Can not init with KDC?