Ampersand in password a problem in multiple areas

[barney_1]

Using ampersands in passwords seems to be a problem in multiple areas.

Mythbuntu 9.04 Beta:

Using an ampersand as a mythconverg password caused my encoder card not to load on reboot. I posted a thread concerning this here: http://ubuntuforums.org/showthread.php?t=1129315

Further troubleshooting shows an error in parsing /home/mythtv/.mythtv/config.xml:

2009-04-18 15:32:14.165 Configuration::Load - Error parsing: /home/mythtv/.mythtv/config.xml at line: 7 column: 32
2009-04-18 15:32:14.226 Configuration::Load - Error Msg: error occurred while parsing reference

This corresponds to the password line of the xml file. My password is displayed correctly, but not enclosed in quotes (as I think it would need to be to pass the & as string and not a command).

I used sudo dpkg-reconfigure mythtv-common to change the password. I then manually changed mythtv users password in mysql and this fixed the problem.

I did, however, run into this bug in mythweb as a result: https://bugs.launchpad.net/mythbuntu/+bug/221532

Furthermore, yesterday I encountered another & related bug and reported it: https://bugs.launchpad.net/mythbuntu/+bug/363153
I have previously reported a similar problem: https://bugs.launchpad.net/mythbuntu/+bug/241402

It seems password handling may have a systemic problem in this package.

portion of mythbackend.log attached. Thanks!

[barney_1 (szczys)]

My reboot problems seem to be unrelated to the parsing error message. Changing the password has prevented that error from showing in the logs, but my reboot issue persists.

[Mario Limonciello (superm1)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. However, I am closing it because the bug has been fixed in the latest development version of Ubuntu - Lucid Lynx. It won't be fixed in previous versions of Ubuntu because the package doesn't fit the requirements for backporting. See https://help.ubuntu.com/community/UbuntuBackports for more information.

The backend code has been converted to be more shell safe.
If you find that this information is invalid, please re-open this bug.