Ignore default-shell (and use /bin/sh) if it invalid not just if it is

tmux itself, also refuse to set the option to something invalid in the
first place. GitHub issue 2120.

5 files changed, 15 insertions, 6 deletions

diff --git a/cmd-set-option.c b/cmd-set-option.c
index 23b45230..2709dcdc 100644
--- a/cmd-set-option.c
+++ b/cmd-set-option.c
@@ -309,6 +309,13 @@ cmd_set_option_set(struct cmd *self, struct cmdq_item *item, struct options *oo,
 		old = xstrdup(options_get_string(oo, oe->name));
 		options_set_string(oo, oe->name, append, "%s", value);
 		new = options_get_string(oo, oe->name);
+		if (strcmp(oe->name, "default-shell") == 0 &&
+		    !checkshell(new)) {
+			options_set_string(oo, oe->name, 0, "%s", old);
+			free(old);
+			cmdq_error(item, "not a suitable shell: %s", value);
+			return (-1);
+		}
 		if (oe->pattern != NULL && fnmatch(oe->pattern, new, 0) != 0) {
 			options_set_string(oo, oe->name, 0, "%s", old);
 			free(old);
diff --git a/server-client.c b/server-client.c
index 02113386..f3a2b044 100644
--- a/server-client.c
+++ b/server-client.c
@@ -400,6 +400,8 @@ server_client_exec(struct client *c, const char *cmd)
 		shell = options_get_string(s->options, "default-shell");
 	else
 		shell = options_get_string(global_s_options, "default-shell");
+	if (!checkshell(shell))
+		shell = _PATH_BSHELL;
 	shellsize = strlen(shell) + 1;
 
 	msg = xmalloc(cmdsize + shellsize);
@@ -2009,7 +2011,7 @@ server_client_dispatch_shell(struct client *c)
 	const char	*shell;
 
 	shell = options_get_string(global_s_options, "default-shell");
-	if (*shell == '\0' || areshell(shell))
+	if (!checkshell(shell))
 		shell = _PATH_BSHELL;
 	proc_send(c->peer, MSG_SHELL, -1, shell, strlen(shell) + 1);
 
diff --git a/spawn.c b/spawn.c
index 6bcea168..9d2ccdf1 100644
--- a/spawn.c
+++ b/spawn.c
@@ -320,7 +320,7 @@ spawn_pane(struct spawn_context *sc, char **cause)
 	/* Then the shell. If respawning, use the old one. */
 	if (~sc->flags & SPAWN_RESPAWN) {
 		tmp = options_get_string(s->options, "default-shell");
-		if (*tmp == '\0' || areshell(tmp))
+		if (!checkshell(tmp))
 			tmp = _PATH_BSHELL;
 		free(new_wp->shell);
 		new_wp->shell = xstrdup(tmp);
diff --git a/tmux.c b/tmux.c
index 572e705c..60b35e5d 100644
--- a/tmux.c
+++ b/tmux.c
@@ -49,8 +49,8 @@ const char	*shell_command;
 static __dead void	 usage(void);
 static char		*make_label(const char *, char **);
 
+static int		 areshell(const char *);
 static const char	*getshell(void);
-static int		 checkshell(const char *);
 
 static __dead void
 usage(void)
@@ -79,7 +79,7 @@ getshell(void)
 	return (_PATH_BSHELL);
 }
 
-static int
+int
 checkshell(const char *shell)
 {
 	if (shell == NULL || *shell != '/')
@@ -91,7 +91,7 @@ checkshell(const char *shell)
 	return (1);
 }
 
-int
+static int
 areshell(const char *shell)
 {
 	const char	*progname, *ptr;
diff --git a/tmux.h b/tmux.h
index 786cb0dd..72e0e9b9 100644
--- a/tmux.h
+++ b/tmux.h
@@ -1771,7 +1771,7 @@ extern const char	*socket_path;
 extern const char	*shell_command;
 extern int		 ptm_fd;
 extern const char	*shell_command;
-int		 areshell(const char *);
+int		 checkshell(const char *);
 void		 setblocking(int, int);
 const char	*find_cwd(void);
 const char	*find_home(void);