Merge pull request #1423 from opscode/btm/CHEF-5247

CHEF-5247: Fix Useradd#manage_user backdoor

2 files changed, 11 insertions, 1 deletions

diff --git a/lib/chef/provider/user/useradd.rb b/lib/chef/provider/user/useradd.rb
index 409da10e53..201bcbe542 100644
--- a/lib/chef/provider/user/useradd.rb
+++ b/lib/chef/provider/user/useradd.rb
@@ -38,7 +38,7 @@ class Chef
         end
 
         def manage_user
-          if universal_options != ""
+          unless universal_options.empty?
             command = compile_command("usermod") do |u|
               u.concat(universal_options)
             end
diff --git a/spec/unit/provider/user/useradd_spec.rb b/spec/unit/provider/user/useradd_spec.rb
index 5862ee3716..64734c499f 100644
--- a/spec/unit/provider/user/useradd_spec.rb
+++ b/spec/unit/provider/user/useradd_spec.rb
@@ -37,4 +37,14 @@ describe Chef::Provider::User::Useradd do
   }
 
   include_examples "a useradd-based user provider", supported_useradd_options
+
+  describe "manage_user" do
+    # CHEF-5247: Chef::Provider::User::Solaris subclasses Chef::Provider::User::Useradd, but does not use usermod to change passwords.
+    # Thus, a call to Solaris#manage_user calls Solaris#manage_password and Useradd#manage_user, but the latter should be a no-op.
+    it "should not run the command if universal_options is an empty array" do
+      provider.stub(:universal_options).and_return([])
+      expect(provider).not_to receive(:shell_out!)
+      provider.manage_user
+    end
+  end
 end