From b71fd93f9d40a17809ad30048621d47960d8e79b Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Fri, 18 Sep 2026 17:04:17 -0400
Subject: [PATCH] Stop docker exec from consuming so-user's piped password

Adding a user failed with "Password does not meet the minimum requirements"
for passwords that were well over the eight character minimum.

so-user reads the password from stdin in updatePassword, but verifyEnvironment
runs first and calls kratosCurl, which ran docker exec with -i. That attaches
stdin and drains the pipe the caller sent the password on, so the later
read -rs saw EOF, password was empty, and expr length "" tripped the minimum
length check.

No kratosCurl or hydraCurl call sends a body on stdin; every one passes it as
a -d argument, so -i was never needed. Dropping it leaves the admin API
responses unchanged.

so-client had the same wrapper for the Hydra admin API. It does not currently
read stdin, but the flag drains its caller's pipe just the same, so it is
dropped there too.
---
 salt/manager/tools/sbin/so-client | 2 +-
 salt/manager/tools/sbin/so-user   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/salt/manager/tools/sbin/so-client b/salt/manager/tools/sbin/so-client
index 0bafde603..fb1fbb302 100755
--- a/salt/manager/tools/sbin/so-client
+++ b/salt/manager/tools/sbin/so-client
@@ -126,7 +126,7 @@ function fail() {
 }
 
 function hydraCurl() {
-  docker exec -i "$hydraContainer" curl "$@"
+  docker exec "$hydraContainer" curl "$@"
 }
 
 function require() {
diff --git a/salt/manager/tools/sbin/so-user b/salt/manager/tools/sbin/so-user
index e5537173f..ce5130257 100755
--- a/salt/manager/tools/sbin/so-user
+++ b/salt/manager/tools/sbin/so-user
@@ -156,7 +156,7 @@ function fail() {
 }
 
 function kratosCurl() {
-  docker exec -i "$kratosContainer" curl "$@"
+  docker exec "$kratosContainer" curl "$@"
 }
 
 function require() {