Merge branch 'main' into test/lldp-interfaces-unit-tests

3 files changed, 36 insertions, 1 deletions

diff --git a/changelogs/fragments/vyos-user-quote-plaintext-password.yml b/changelogs/fragments/vyos-user-quote-plaintext-password.yml
new file mode 100644
index 00000000..487b592a
--- /dev/null
+++ b/changelogs/fragments/vyos-user-quote-plaintext-password.yml
@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - vyos_user - Quote and escape plaintext-password values in set commands so VyOS accepts special characters and embedded single quotes.
diff --git a/plugins/modules/vyos_user.py b/plugins/modules/vyos_user.py
index d2f23509..e47f5a05 100644
--- a/plugins/modules/vyos_user.py
+++ b/plugins/modules/vyos_user.py
@@ -205,6 +205,7 @@ commands:
 """
 
 import re
+import shlex
 
 from copy import deepcopy
 from functools import partial
@@ -276,7 +277,8 @@ def spec_to_commands(updates, module):
                 add(
                     commands,
                     want,
-                    "authentication plaintext-password %s" % want["configured_password"],
+                    "authentication plaintext-password %s"
+                    % shlex.quote(want["configured_password"]),
                 )
 
     return commands
diff --git a/tests/unit/modules/network/vyos/test_vyos_user.py b/tests/unit/modules/network/vyos/test_vyos_user.py
index d1e7f162..2cbd3820 100644
--- a/tests/unit/modules/network/vyos/test_vyos_user.py
+++ b/tests/unit/modules/network/vyos/test_vyos_user.py
@@ -62,6 +62,36 @@ class TestVyosUserModule(TestVyosModule):
             ["set system login user ansible authentication plaintext-password test"],
         )
 
+    def test_vyos_user_password_special_chars(self):
+        set_module_args(dict(name="ansible", configured_password="test$123!@"))
+        result = self.execute_module(changed=True)
+        self.assertEqual(
+            result["commands"],
+            [
+                "set system login user ansible authentication plaintext-password 'test$123!@'",
+            ],
+        )
+
+    def test_vyos_user_password_embedded_quote(self):
+        set_module_args(dict(name="ansible", configured_password="pa'ss"))
+        result = self.execute_module(changed=True)
+        self.assertEqual(
+            result["commands"],
+            [
+                "set system login user ansible authentication plaintext-password 'pa'\"'\"'ss'",
+            ],
+        )
+
+    def test_vyos_user_password_complex_special_chars(self):
+        set_module_args(dict(name="ansible", configured_password="P@ss w0rd!$#'xy\\"))
+        result = self.execute_module(changed=True)
+        self.assertEqual(
+            result["commands"],
+            [
+                "set system login user ansible authentication plaintext-password 'P@ss w0rd!$#'\"'\"'xy\\'",
+            ],
+        )
+
     def test_vyos_user_delete(self):
         set_module_args(dict(name="ansible", state="absent"))
         result = self.execute_module(changed=True)