From 6ad83534799eb8aac1ab8229f3b0745e5b176f18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sevban=20D=C3=B6nmez?=
 <82449360+byjanke@users.noreply.github.com>
Date: Fri, 4 Sep 2026 23:27:52 +0300
Subject: [PATCH] =?UTF-8?q?fix:=20Yorum=20alanlar=C4=B1nda=20Pango=20marku?=
 =?UTF-8?q?p=20ka=C3=A7=C4=B1=C5=9Flamas=C4=B1=20ve=20Group=20beti=C4=9Fin?=
 =?UTF-8?q?de=20girdi=20do=C4=9Frulamas=C4=B1=20(CWE-116,=20CWE-250)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- MainWindow.py: Uygulama yorumları bölümünde (label_author, label_appversion) ve ayarlar hata mesajında (ui_settings_password_info_label) kullanıcı/sunucu kaynaklı metinler GLib.markup_escape_text ile kaçışlandı (CWE-116, CWE-79).
- MainWindow.py: label_distro için doğrudan güvenli set_text kullanıldı.
- Group.py: Eksik argüman durumundaki IndexError giderildi, kullanıcı adı regex ve pwd.getpwnam ile doğrulandı, yetkilendirme akışında dönüş kodları (sys.exit) düzgün şekilde iletildi (CWE-250, CWE-20).
- Pardus 25.2 lab ortamında X11 UI testleri ve CLI senaryoları ile doğrulanmıştır.
---
 src/Group.py      | 60 +++++++++++++++++++++++++++++++++++++++--------
 src/MainWindow.py | 11 +++++----
 2 files changed, 57 insertions(+), 14 deletions(-)

diff --git a/src/Group.py b/src/Group.py
index 5e0a740..1a4aa5d 100755
--- a/src/Group.py
+++ b/src/Group.py
@@ -6,24 +6,64 @@
 @author: fatih
 """
 
+import os
+import pwd
+import re
+import shutil
 import subprocess
 import sys
 
+USERNAME_REGEX = re.compile(r"^[a-zA-Z0-9_.][a-zA-Z0-9_.-]*\$?$")
+
+
+def validate_username(username):
+    if not username or not USERNAME_REGEX.match(username):
+        sys.stderr.write(f"Error: Invalid username format: '{username}'.\n")
+        return False
+    try:
+        pwd.getpwnam(username)
+        return True
+    except KeyError:
+        sys.stderr.write(f"Error: User '{username}' does not exist.\n")
+        return False
+
 
 def main():
-    def addtogroup(user):
-        subprocess.call(["adduser", user, "pardus-software"])
+    if len(sys.argv) < 3:
+        sys.stderr.write("Usage: Group.py <add|del> <username>\n")
+        sys.exit(1)
+
+    action = sys.argv[1]
+    user = sys.argv[2]
+
+    if not validate_username(user):
+        sys.exit(1)
 
-    def delfromgroup(user):
-        subprocess.call(["deluser", user, "pardus-software"])
+    target_group = "pardus-software"
 
-    if len(sys.argv) > 1:
-        if sys.argv[1] == "add":
-            addtogroup(sys.argv[2])
-        elif sys.argv[1] == "del":
-            delfromgroup(sys.argv[2])
+    if action == "add":
+        cmd_name = "adduser"
+        cmd_path = shutil.which(cmd_name) or (
+            f"/usr/sbin/{cmd_name}" if os.path.exists(f"/usr/sbin/{cmd_name}") else None
+        )
+        if not cmd_path:
+            sys.stderr.write(f"Error: Command '{cmd_name}' not found on system.\n")
+            sys.exit(1)
+        rc = subprocess.call([cmd_path, user, target_group])
+        sys.exit(rc)
+    elif action == "del":
+        cmd_name = "deluser"
+        cmd_path = shutil.which(cmd_name) or (
+            f"/usr/sbin/{cmd_name}" if os.path.exists(f"/usr/sbin/{cmd_name}") else None
+        )
+        if not cmd_path:
+            sys.stderr.write(f"Error: Command '{cmd_name}' not found on system.\n")
+            sys.exit(1)
+        rc = subprocess.call([cmd_path, user, target_group])
+        sys.exit(rc)
     else:
-        print("no argument passed")
+        sys.stderr.write(f"Error: Unknown action '{action}'. Valid actions are 'add' or 'del'.\n")
+        sys.exit(1)
 
 
 if __name__ == "__main__":
diff --git a/src/MainWindow.py b/src/MainWindow.py
index ab45045..c03f3d1 100644
--- a/src/MainWindow.py
+++ b/src/MainWindow.py
@@ -3652,7 +3652,7 @@ def create_comment_widget(self, comment, gnome=False):
             comment = "{}\n{}".format(comment["summary"], comment["description"])
 
         label_author = Gtk.Label.new()
-        label_author.set_markup("<b>{}</b>".format(author))
+        label_author.set_markup("<b>{}</b>".format(GLib.markup_escape_text(str(author), -1)))
         label_author.set_selectable(True)
 
         label_date = Gtk.Label.new()
@@ -3693,11 +3693,11 @@ def create_comment_widget(self, comment, gnome=False):
         label_comment.set_xalign = 0.0
 
         label_distro = Gtk.Label.new()
-        label_distro.set_markup("{}".format(distro))
+        label_distro.set_text("{}".format(distro))
         label_distro.set_selectable(True)
 
         label_appversion = Gtk.Label.new()
-        label_appversion.set_markup("{}: {}".format(_("App"), app_version))
+        label_appversion.set_markup("{}: {}".format(_("App"), GLib.markup_escape_text(str(app_version), -1)))
         label_appversion.set_selectable(True)
 
         box_bottom = Gtk.Box.new(Gtk.Orientation.HORIZONTAL, 8)
@@ -5076,7 +5076,10 @@ def on_group_process_exit(self, pid, status):
         self.control_groups()
         if status != 0:
             self.ui_settings_password_info_label.set_markup(
-                "<small><span color='red' weight='light'>{}</span></small>".format(self.grouperrormessage))
+                "<small><span color='red' weight='light'>{}</span></small>".format(
+                    GLib.markup_escape_text(str(self.grouperrormessage), -1)
+                )
+            )
         else:
             self.ui_settings_password_info_label.set_text("")