htpasswd sets incorrect password when the password has special characters

Question

The Problem
I am attempting to update passwords for a large list of users using htpasswd. I am using a csv file to pull in the new passwords. When the script runs it appears to successfully update the users. However, users are unable to log in using their new passwords. here is the script:

#!/bin/bash

# Bash to update passwords from csv
CSV=intranet_users.csv
OLDIFS=$IFS
IFS=','
[ ! -f $CSV ] && { echo "$CSV file not found"; exit 99; }
  while read name dept username password
   do
     if [ "${username}" != '#N/A' ] && [ "${username}" != 0 ]; then
        echo "Resetting password for $username to: ${password}"
        htpasswd -b /path/to/passwdFile $username '${password}'
     fi
   done < $CSV
IFS=$OLDIFS

If I run the script against a test csv with no special characters in the passwords, it works.
If I run htpasswd -b /path/to/passwdFile username 'password' on the command line (passwords with special chars), everything works as it should.

Why does the script fail to set the password correctly?

What I have tried
I have tried running htpasswd using eval I have tried various methods of quoting $password i.e "'", '\'', "\'"

Replace the problematic characters in the CSV file. And don't generate such passwords on the first place. — Gerald Schneider, Jun 15 '22 at 16:16
try read -r and using htpasswd -b /path/to/passwdFile "$username" "${password}", maybe. — walder, Jun 17 '22 at 01:15
Do you have some examples of intranet_users.csv containing problematic characters? — Angel115, Jun 17 '22 at 14:09

score 0 · Accepted Answer · answered Jun 17 '22 at 14:33

Posting in hope of helping someone.

It turns out the problem was not with the script. The csv file was not clean.

The csv was generated from Excel in a Windows environment. The file had dos line endings - \r

I added the line below before the line that calls htpasswd
password="${password/$'\r'/}"

Here's the working code:

CSV=intranet_users.csv
OLDIFS=$IFS
IFS=','
[ ! -f $CSV ] && { echo "$CSV file not found"; exit 99; }
while read name dept username password
do
    if [ "${username}" != '#N/A' ] && [ "${username}" != 0 ]; then
       password="${password/$'\r'/}"
       echo "Resetting password for $username to: $password"
       htpasswd -b /path/to/passwdFile $username ${password}
    fi
done < $CSV
IFS=$OLDIFS

htpasswd sets incorrect password when the password has special characters

1 Answers1