openwisp-controller 1.3__tar.gz → 1.3.2__tar.gz

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/CHANGES.rst

@@ -1,6 +1,114 @@
 Changelog
 =========
 
+Version 1.3.3 [2026-10-23]
+--------------------------
+
+Bugfixes
+~~~~~~~~
+
+- Prevented cross-organization configuration access in admin
+
+  Updated admin configuration download and context views to resolve
+  devices, VPNs, and templates through organization-scoped querysets and
+  object permissions.
+
+  This ensures users cannot access configuration data for resources
+  belonging to unauthorized organizations.
+
+  Advisory: `GHSA-2x7f-qxwh-m483
+  <https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-2x7f-qxwh-m483>`_.
+
+- Prevented cross-organization access to configuration downloads
+
+  Updated API configuration download views to resolve devices, VPNs, and
+  templates through organization-scoped querysets and object permissions.
+
+  This ensures users cannot access configuration downloads for resources
+  belonging to unauthorized organizations.
+
+  Advisory: `GHSA-5c5w-h9xc-3mq5
+  <https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-5c5w-h9xc-3mq5>`_.
+
+- Escaped OpenWrt change_password SSH command
+
+  The password and confirm_password values were interpolated into the
+  remote shell command without escaping, allowing shell command injection
+  on the device. They are now quoted with shlex.quote() and passed to
+  printf instead of echo -e, so backslashes are no longer interpreted.
+
+  Advisory: `GHSA-rcf7-q946-fvpg
+  <https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-rcf7-q946-fvpg>`_.
+
+- Prevented cross-organization access to CA CRLs
+
+  Organization managers with permission to view CAs could guess CA IDs and
+  download certificate revocation lists belonging to other organizations.
+
+  The issue did not expose CA private keys or allow changes. It primarily
+  affected deployments configured to protect CRLs, because CRLs are
+  publicly accessible by default.
+
+  Advisory: `GHSA-9gh4-xw24-9xh5
+  <https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-9gh4-xw24-9xh5>`_.
+
+Version 1.3.1 [2026-10-15]
+--------------------------
+
+Security
+~~~~~~~~
+
+- Fixed insecure multi-tenancy boundary in location REST API
+
+  Fixed a **security issue** that allowed organization managers to link
+  locations and floorplans belonging to other organizations to their
+  devices by submitting known object IDs.
+
+  The API now resolves related objects only from organizations managed by
+  the requesting user and validates the organization of all
+  device-location relationships. Device lists for a location are scoped to
+  managed organizations and no longer expose device keys.
+
+  Nested location and floorplan writes are validated before being saved
+  and run in a database transaction, preventing rejected requests from
+  leaving related database objects or files behind.
+
+  Advisory: `GHSA-39c4-xj33-j8j3
+  <https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-39c4-xj33-j8j3>`_.
+
+- Fixed XSS vulnerabilities in device and command admin UI
+
+  Fixed cross-site scripting (XSS) vulnerabilities caused by improper
+  escaping of user-controlled data in the following admin pages:
+
+  - Device and device group forms (template names).
+  - Device pages (command inputs, outputs, and management IP).
+  - Subnet administration (device names and links).
+
+  These vulnerabilities could allow attackers to execute malicious
+  JavaScript in an administrator's browser.
+
+  Advisory: `GHSA-4f2x-pxjx-h8m3
+  <https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-4f2x-pxjx-h8m3>`_.
+
+Bugfixes
+~~~~~~~~
+
+- Fixed loss of data in PATCH requests to device location endpoint `#1510
+  <https://github.com/openwisp/openwisp-controller/issues/1510>`_
+
+  Sending `PATCH` requests to the device location endpoint
+  (`/api/v1/controller/device/{id}/location/`) now doesn't set `location`
+  and `floorplan` to `NULL` when they are not included in the request
+  body.
+
+Changes
+~~~~~~~
+
+- Added IP address search to DeviceAdmin
+
+  Enabled searches by last and management IP addresses.
+
 Version 1.3.0 [2026-09-03]
 --------------------------
 

{openwisp_controller-1.3/openwisp_controller.egg-info → openwisp_controller-1.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openwisp-controller
-Version: 1.3
+Version: 1.3.2
 Summary: OpenWISP Controller
 Home-page: http://openwisp.org
 Download-URL: https://github.com/openwisp/openwisp-controller/releases

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/openwisp_controller/__init__.py

@@ -1,4 +1,4 @@
-VERSION = (1, 3, 0, "final")
+VERSION = (1, 3, 2, "final")
 __version__ = VERSION  # alias
 
 

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/openwisp_controller/config/admin.py

@@ -13,6 +13,7 @@ from django.contrib.contenttypes.models import ContentType
 from django.core.exceptions import (
     FieldDoesNotExist,
     ObjectDoesNotExist,
+    PermissionDenied,
     ValidationError,
 )
 from django.db import models
@@ -318,7 +319,10 @@ class BaseConfigAdmin(BaseAdmin):
         )
 
     def download_view(self, request, pk):
-        instance = get_object_or_404(self.model, pk=pk)
+        instance = self._get_instance(request, pk)
+        return self.get_download_response(instance)
+
+    def get_download_response(self, instance):
         if hasattr(instance, "generate"):
             config = instance
         elif hasattr(instance, "config"):
@@ -333,10 +337,16 @@ class BaseConfigAdmin(BaseAdmin):
         )
 
     def context_view(self, request, pk):
-        instance = get_object_or_404(self.model, pk=pk)
+        instance = self._get_instance(request, pk)
         context = json.dumps(instance.get_context())
         return HttpResponse(context, content_type="application/json")
 
+    def _get_instance(self, request, pk):
+        instance = get_object_or_404(self.get_queryset(request), pk=pk)
+        if not self.has_view_permission(request, instance):
+            raise PermissionDenied
+        return instance
+
 
 class BaseForm(forms.ModelForm):
     """
@@ -542,6 +552,8 @@ class DeviceAdmin(MultitenantAdminMixin, BaseConfigAdmin, CopyableFieldsAdmin):
         "model",
         "os",
         "system",
+        "last_ip",
+        "management_ip",
         "devicelocation__location__address",
     ]
     readonly_fields = ["last_ip", "uuid"]

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/openwisp_controller/config/api/download_views.py

@@ -17,29 +17,29 @@ Template = load_model("config", "Template")
 
 class DownloadVpnView(ProtectedAPIMixin, RetrieveAPIView):
     serializer_class = VpnSerializer
-    queryset = Vpn.objects.none()
+    queryset = Vpn.objects.all()
     model = Vpn
 
     def retrieve(self, request, *args, **kwargs):
-        return BaseConfigAdmin.download_view(self, request, pk=kwargs["pk"])
+        return BaseConfigAdmin.get_download_response(self, self.get_object())
 
 
 class DownloadDeviceView(ProtectedAPIMixin, RetrieveAPIView):
     serializer_class = DeviceListSerializer
-    queryset = Device.objects.none()
+    queryset = Device.objects.all()
     model = Device
 
     def retrieve(self, request, *args, **kwargs):
-        return BaseConfigAdmin.download_view(self, request, pk=kwargs["pk"])
+        return BaseConfigAdmin.get_download_response(self, self.get_object())
 
 
 class DownloadTemplateconfiguration(ProtectedAPIMixin, RetrieveAPIView):
     serializer_class = TemplateSerializer
-    queryset = Template.objects.none()
+    queryset = Template.objects.all()
     model = Template
 
     def retrieve(self, request, *args, **kwargs):
-        return BaseConfigAdmin.download_view(self, request, pk=kwargs["pk"])
+        return BaseConfigAdmin.get_download_response(self, self.get_object())
 
 
 download_vpn_config = DownloadVpnView.as_view()

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/openwisp_controller/config/static/config/js/management_ip.js

@@ -3,6 +3,14 @@ django.jQuery(function ($) {
   if ($(".add-form").length || !$("#device_form").length) {
     return;
   }
+  // For XSS prevention
+  function escapeHtml(text) {
+    if (text === null || text === undefined) return "";
+    const div = document.createElement("div");
+    div.textContent = text;
+    return div.innerHTML;
+  }
+
   var editAltText = gettext("Edit"),
     cancelAltText = gettext("Cancel");
 
@@ -12,7 +20,7 @@ django.jQuery(function ($) {
   ipInput.after(function () {
     ipInput.hide();
     return (
-      `<span class="readonly" id="management_ip_text">${initialIp}</span>` +
+      `<span class="readonly" id="management_ip_text">${escapeHtml(initialIp)}</span>` +
       `<a class="related-widget-wrapper-link change-related" id="edit_management_ip"><img value="edit" src="${window.staticUrl}admin/img/icon-changelink.svg"` +
       ` alt="${editAltText}" title="${editAltText}"></a>`
     );

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/openwisp_controller/config/static/config/js/relevant_templates.js

@@ -30,10 +30,25 @@ django.jQuery(function ($) {
           isDeviceGroup() && templateConfig.backend
             ? ` (backend: ${templateConfig.backend})`
             : "",
-        element = $(
-          `<li class="sortedm2m-item"><label for="id_config-${prefix}templates_${index}"><input type="checkbox" value="${templateId}" id="id_config-${prefix}templates_${index}" class="sortedm2m" data-required=${templateConfig.required}> ${templateConfig.name}${requiredString}${backendString}</label></li>`,
-        ),
-        inputField = element.children().children("input");
+        inputId = `id_config-${prefix}templates_${index}`,
+        inputField = $("<input>")
+          .attr({
+            type: "checkbox",
+            value: templateId,
+            id: inputId,
+            "data-required": templateConfig.required,
+          })
+          .addClass("sortedm2m"),
+        element = $('<li class="sortedm2m-item">').append(
+          $("<label>")
+            .attr("for", inputId)
+            .append(inputField)
+            .append(
+              document.createTextNode(
+                ` ${templateConfig.name}${requiredString}${backendString}`,
+              ),
+            ),
+        );
 
       if (templateConfig.required) {
         inputField.prop("disabled", true);

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/openwisp_controller/config/templates/admin/config/device/delete_selected_confirmation.html

@@ -51,7 +51,7 @@
                     {% endblocktranslate %}
                 </p>
                 <span>
-                    <button class="danger-btn" id="warning-ack">"{% blocktranslate count counter=active_devices|length %}I understand the risks, delete the device{% plural %}I understand the risks, delete the devices{% endblocktranslate %}</button>
+                    <button class="danger-btn" id="warning-ack">{% blocktranslate count counter=active_devices|length %}I understand the risks, delete the device{% plural %}I understand the risks, delete the devices{% endblocktranslate %}</button>
                     <button class="button cancel-link">{% translate 'No, take me back' %}</button>
                 </span>
             </li>

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/openwisp_controller/config/tests/test_admin.py

@@ -507,6 +507,69 @@ class TestAdmin(
             ],
         )
 
+    def test_config_download_and_context_views_multitenancy(self):
+        data = self._create_multitenancy_test_env(vpn=True)
+        self.client.force_login(data["operator"])
+        instances = {
+            "device": (data["c1"].device, data["c2"].device),
+            "template": (data["t1"], data["t2"]),
+            "vpn": (data["vpn1"], data["vpn2"]),
+        }
+
+        for model, (managed, unmanaged) in instances.items():
+            with self.subTest(model=model, view="download", organization="managed"):
+                response = self.client.get(
+                    reverse(
+                        f"admin:{self.app_label}_{model}_download", args=[managed.pk]
+                    )
+                )
+                self.assertEqual(response.status_code, 200)
+
+            with self.subTest(model=model, view="download", organization="unmanaged"):
+                response = self.client.get(
+                    reverse(
+                        f"admin:{self.app_label}_{model}_download", args=[unmanaged.pk]
+                    )
+                )
+                self.assertEqual(response.status_code, 404)
+
+            with self.subTest(model=model, view="context", organization="managed"):
+                response = self.client.get(
+                    reverse(
+                        f"admin:{self.app_label}_{model}_context", args=[managed.pk]
+                    )
+                )
+                self.assertEqual(response.status_code, 200)
+
+            with self.subTest(model=model, view="context", organization="unmanaged"):
+                response = self.client.get(
+                    reverse(
+                        f"admin:{self.app_label}_{model}_context", args=[unmanaged.pk]
+                    )
+                )
+                self.assertEqual(response.status_code, 404)
+
+            with (
+                self.subTest(model=model, permission="denied"),
+                patch.object(
+                    admin.site._registry[managed.__class__],
+                    "has_view_permission",
+                    return_value=False,
+                ),
+            ):
+                response = self.client.get(
+                    reverse(
+                        f"admin:{self.app_label}_{model}_download", args=[managed.pk]
+                    )
+                )
+                self.assertEqual(response.status_code, 403)
+                response = self.client.get(
+                    reverse(
+                        f"admin:{self.app_label}_{model}_context", args=[managed.pk]
+                    )
+                )
+                self.assertEqual(response.status_code, 403)
+
     def test_vpn_organization_fk_autocomplete_view(self):
         data = self._create_multitenancy_test_env()
         self._test_multitenant_admin(
@@ -1476,13 +1539,25 @@ class TestAdmin(
         self.assertContains(response, '<option value="netjsonconfig.OpenWisp" selected')
 
     def test_device_search(self):
-        d = self._create_device(name="admin-search-test")
+        d = self._create_device(
+            name="admin-search-test",
+            last_ip="192.0.2.1",
+            management_ip="198.51.100.1",
+        )
         path = reverse(f"admin:{self.app_label}_device_changelist")
         response = self.client.get(path, {"q": str(d.pk.hex)})
         self.assertContains(response, "admin-search-test")
         response = self.client.get(path, {"q": "ZERO-RESULTS-PLEASE"})
         self.assertNotContains(response, "admin-search-test")
 
+        for field, ip_address in {
+            "last_ip": d.last_ip,
+            "management_ip": d.management_ip,
+        }.items():
+            with self.subTest(field=field):
+                response = self.client.get(path, {"q": ip_address})
+                self.assertContains(response, "admin-search-test")
+
         with self.subTest("test device location search"):
             response = self.client.get(path, {"q": "Estonia"})
             self.assertNotContains(response, "admin-search-test")

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/openwisp_controller/config/tests/test_api.py

@@ -559,6 +559,68 @@ class TestConfigApi(
             r = self.client.get(path)
         self.assertEqual(r.status_code, 200)
 
+    def test_download_api_multitenancy(self):
+        org1 = self._create_org(name="org1")
+        org2 = self._create_org(name="org2")
+        device1 = self._create_config(organization=org1).device
+        device2 = self._create_config(organization=org2).device
+        template1 = self._create_template(name="template1", organization=org1)
+        template2 = self._create_template(name="template2", organization=org2)
+        vpn1 = self._create_vpn(name="vpn1", organization=org1)
+        vpn2 = self._create_vpn(name="vpn2", organization=org2)
+        shared_vpn = self._create_vpn(name="shared-vpn", organization=None)
+        operator = self._create_operator(organizations=[org1])
+        self.client.force_login(operator)
+
+        with self.subTest("Device of managed organization"):
+            r = self.client.get(
+                reverse("config_api:download_device_config", args=[device1.pk])
+            )
+            self.assertEqual(r.status_code, 200)
+
+        with self.subTest("Device of other organization"):
+            r = self.client.get(
+                reverse("config_api:download_device_config", args=[device2.pk])
+            )
+            self.assertEqual(r.status_code, 404)
+
+        with self.subTest("Template of managed organization"):
+            r = self.client.get(
+                reverse("config_api:download_template_config", args=[template1.pk])
+            )
+            self.assertEqual(r.status_code, 200)
+
+        with self.subTest("Template of other organization"):
+            r = self.client.get(
+                reverse("config_api:download_template_config", args=[template2.pk])
+            )
+            self.assertEqual(r.status_code, 404)
+
+        with self.subTest("VPN of managed organization"):
+            r = self.client.get(
+                reverse("config_api:download_vpn_config", args=[vpn1.pk])
+            )
+            self.assertEqual(r.status_code, 200)
+
+        with self.subTest("VPN of other organization"):
+            r = self.client.get(
+                reverse("config_api:download_vpn_config", args=[vpn2.pk])
+            )
+            self.assertEqual(r.status_code, 404)
+
+        vpn2.get_cached_configuration()
+        with self.subTest("Cached VPN of other organization"):
+            r = self.client.get(
+                reverse("config_api:download_vpn_config", args=[vpn2.pk])
+            )
+            self.assertEqual(r.status_code, 404)
+
+        with self.subTest("Shared VPN"):
+            r = self.client.get(
+                reverse("config_api:download_vpn_config", args=[shared_vpn.pk])
+            )
+            self.assertEqual(r.status_code, 200)
+
     def test_update_deactivated_device(self):
         device = self._create_device(_is_deactivated=True)
         path = reverse("config_api:device_detail", args=[device.pk])

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/openwisp_controller/config/tests/test_selenium.py

@@ -479,6 +479,33 @@ class TestDeviceAdmin(
             self.find_element(by=By.NAME, value="_save").click()
             self.wait_for_admin_success_message()
 
+    def test_device_form_shows_template_name_as_text(self):
+        name = '<b class="injected">template</b>'
+        template = self._create_template(name=name, organization=None)
+        device = self._create_config(organization=self._get_org()).device
+        self.login()
+        self.open(
+            reverse(f"admin:{self.config_app_label}_device_change", args=[device.id])
+            + "#config-group"
+        )
+        self.hide_loading_overlay()
+        label = self.find_element(
+            by=By.XPATH,
+            value=(
+                f'//ul[contains(@class,"sortedm2m-items")]'
+                f'//input[@value="{template.id}" and @data-required]/parent::label'
+            ),
+        )
+        self.assertEqual(
+            label.text.strip(), name, "the template name is not displayed as text"
+        )
+        self.assertFalse(
+            self.web_driver.find_elements(
+                By.CSS_SELECTOR, "ul.sortedm2m-items .injected"
+            ),
+            "the template name was rendered as HTML",
+        )
+
 
 @tag("selenium_tests")
 class TestDeviceGroupAdmin(

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/openwisp_controller/connection/connectors/openwrt/ssh.py

@@ -1,4 +1,5 @@
 import logging
+from shlex import quote
 
 from packaging import version
 
@@ -47,7 +48,8 @@ class OpenWrt(Ssh):
 
     def change_password(self, password, confirm_password, user="root"):
         return self.exec_command(
-            f'echo -e "{password}\n{confirm_password}" | passwd {user}'
+            f"printf '%s\\n%s\\n' {quote(password)} {quote(confirm_password)} "
+            f"| passwd {quote(user)}"
         )
 
 

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/openwisp_controller/connection/static/connection/js/commands.js

@@ -7,6 +7,14 @@ var gettext =
   };
 var interpolate = interpolate || function () {};
 
+// For XSS prevention
+function escapeHtml(text) {
+  if (text === null || text === undefined) return "";
+  const div = document.createElement("div");
+  div.textContent = text;
+  return div.innerHTML;
+}
+
 const deviceId = getObjectIdFromUrl();
 
 django.jQuery(function ($) {
@@ -73,7 +81,9 @@ function initCommandDropdown($) {
     }
 
     Object.keys(schema).forEach(function (el) {
-      owCommandBtns += `<button class="ow-command-btn option" data-command="${el}">${schema[el].title}</button>`;
+      owCommandBtns += `<button class="ow-command-btn option" data-command="${escapeHtml(el)}">${escapeHtml(
+        schema[el].title,
+      )}</button>`;
     });
     widgetElement = `
             <li>
@@ -468,24 +478,24 @@ function initCommandOverlay($) {
         input = "";
       }
       return `<div class="inline-related has_original dynamic-command_set-2" id="command_set-2-${counter}">
-                <h3><b>Recent Commands:</b>&nbsp;<span class="inline_label">«${
-                  response.type
-                }» ${sentOn} ${dateTimeStampToDateTimeLocaleString(
+                <h3><b>Recent Commands:</b>&nbsp;<span class="inline_label">«${escapeHtml(
+                  response.type,
+                )}» ${sentOn} ${dateTimeStampToDateTimeLocaleString(
                   new Date(response.created),
                 )}</span></h3>
                     <fieldset class="module aligned ">
                     <div class="form-row field-status">
-                        <div><label>Status:</label><div class="readonly">${
-                          response.status
-                        }</div></div>
+                        <div><label>Status:</label><div class="readonly">${escapeHtml(
+                          response.status,
+                        )}</div></div>
                     </div>
                     <div class="form-row field-type">
-                        <div><label>Type:</label><div class="readonly">${
-                          response.type
-                        }</div></div>
+                        <div><label>Type:</label><div class="readonly">${escapeHtml(
+                          response.type,
+                        )}</div></div>
                     </div>
                     <div class="form-row field-input">
-                        <div><label>Input:</label><div class="readonly">${input}</div></div>
+                        <div><label>Input:</label><div class="readonly">${escapeHtml(input)}</div></div>
                     </div>
                     <div class="form-row field-output_data">
                         <div>
@@ -493,7 +503,7 @@ function initCommandOverlay($) {
                             <div class="readonly">${
                               response.status === "in-progress"
                                 ? '<div class="loader recent-commands-loader"></div>'
-                                : response.output
+                                : escapeHtml(response.output)
                             }
                             </div>
                         </div>
@@ -555,9 +565,9 @@ function initCommandWebSockets($, commandWebSocket) {
       input = "";
     }
 
-    commandObjectFieldset.find(".field-status .readonly").html(data.status);
-    commandObjectFieldset.find(".field-input .readonly").html(input);
-    commandObjectFieldset.find(".field-output_data .readonly").html(data.output);
+    commandObjectFieldset.find(".field-status .readonly").text(data.status);
+    commandObjectFieldset.find(".field-input .readonly").text(input);
+    commandObjectFieldset.find(".field-output_data .readonly").text(data.output);
 
     // Is it required to update modified timestamp?
     // We will require to to manipulation for rendering dates tp maintain consistency

{openwisp_controller-1.3 → openwisp_controller-1.3.2}/openwisp_controller/connection/tests/test_models.py

@@ -782,7 +782,7 @@ HZAAAAgAhZz8ve4sK9Wbopq43Cu2kQDgX4NoA6W+FCmxCKf5AhYIzYQxIqyCazd7MrjCwS""",
             connect_mocked.assert_called_once()
             mocked_exec_command.assert_called_once()
             mocked_exec_command.assert_called_with(
-                'echo -e "Newpasswd@123\nNewpasswd@123" | passwd root',
+                "printf '%s\\n%s\\n' Newpasswd@123 Newpasswd@123 | passwd root",
                 timeout=app_settings.SSH_COMMAND_TIMEOUT,
             )
         command.refresh_from_db()
@@ -790,6 +790,49 @@ HZAAAAgAhZz8ve4sK9Wbopq43Cu2kQDgX4NoA6W+FCmxCKf5AhYIzYQxIqyCazd7MrjCwS""",
         self.assertEqual(command.output, "Changed password for user root.\n")
         self.assertEqual(list(command.arguments), ["********"])
 
+    @mock.patch(_connect_path)
+    def test_execute_change_password_shell_metacharacters(self, connect_mocked):
+        dc = self._create_device_connection()
+
+        def _assert_quoted(password, expected):
+            command = Command(
+                device=dc.device,
+                connection=dc,
+                type="change_password",
+                input={"password": password, "confirm_password": password},
+            )
+            command.full_clean()
+            with mock.patch(_exec_command_path) as mocked_exec_command:
+                mocked_exec_command.return_value = self._exec_command_return_value(
+                    stdout="Changed password for user root."
+                )
+                command.save()
+                command.execute()
+                mocked_exec_command.assert_called_once_with(
+                    f"printf '%s\\n%s\\n' {expected} {expected} | passwd root",
+                    timeout=app_settings.SSH_COMMAND_TIMEOUT,
+                )
+            command.refresh_from_db()
+            self.assertEqual(command.status, "success")
+
+        with self.subTest("safe password left unquoted"):
+            _assert_quoted("N3w-p@ss.word", "N3w-p@ss.word")
+
+        with self.subTest("double quote breakout"):
+            _assert_quoted(
+                'x"; touch /tmp/PWNED; echo "',
+                "'x\"; touch /tmp/PWNED; echo \"'",
+            )
+
+        with self.subTest("command substitution"):
+            _assert_quoted("$(touch /tmp/PWNED)", "'$(touch /tmp/PWNED)'")
+
+        with self.subTest("single quote breakout"):
+            _assert_quoted("x'; touch /tmp/PWNED", "'x'\"'\"'; touch /tmp/PWNED'")
+
+        with self.subTest("backslash kept literal"):
+            _assert_quoted("New\\pass123", "'New\\pass123'")
+
     @mock.patch(_connect_path)
     @mock.patch.dict(
         ORGANIZATION_ENABLED_COMMANDS, {"__all__": ("callable_ping", "path_ping")}