Code injection in cinnamon-settings-users.py

[Bernd Dietzel]

See attached screenshot.
If you edit a group name or add a new group , the edit field allows to inject shell commands with root permissions.
If the administrator types in the character ";" into the group name field , the text behind the";" will be executed as root.

File :
cinnamon-settings-users.py

Functions :
on_group_addition
on_group_edition

theregrunner@mintdeb ~ $ uname -a
Linux mintdeb 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt11-1+deb8u3 (2015-08-04) x86_64 GNU/Linux

theregrunner@mintdeb ~ $ lsb_release -a
No LSB modules are available.
Distributor ID: LinuxMint
Description: LMDE 2 Betsy
Release: 2
Codename: betsy

[Bernd Dietzel (l-ubuntuone1104)]

Bug was fixed
https://github.com/linuxmint/Cinnamon/issues/4649