From bca527aca5684ac31a42c4e6a727e7fa7db86360 Mon Sep 17 00:00:00 2001
From: Saxodwarf <40502346+Saxodwarf@users.noreply.github.com>
Date: Sun, 10 Jan 2021 12:09:04 +0100
Subject: [PATCH] Add the -F flag to prevent grep from using the user password
 as a regex pattern

---
 src/yunohost/utils/password.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/yunohost/utils/password.py b/src/yunohost/utils/password.py
index e7ff6c275..14f42ca31 100644
--- a/src/yunohost/utils/password.py
+++ b/src/yunohost/utils/password.py
@@ -171,7 +171,7 @@ class PasswordValidator(object):
         # Grep the password in the file
         # We use '-f -' to feed the pattern (= the password) through
         # stdin to avoid it being shown in ps -ef --forest...
-        command = "grep -q -f - %s" % MOST_USED_PASSWORDS
+        command = "grep -q -F -f - %s" % MOST_USED_PASSWORDS
         p = subprocess.Popen(command.split(), stdin=subprocess.PIPE)
         p.communicate(input=password)
         return not bool(p.returncode)