freeradius: user passwords containing % are silently discarded, leaving the account unable to authenticate #5694

Environment

• Plugin: os-freeradius 1.10.2
• FreeRADIUS: 3.2.10
• OPNsense: 26.7.3_8-amd64 (FreeBSD 15.1-RELEASE-p3)
• GUI page: Services > FreeRADIUS > Users (/ui/freeradius/user)
• First affected version: the plugin's first commit 1391330 (2017-07-06), so there is no earlier version without it

Problem

User.xml permits % in the password field:

<Mask><![CDATA[/^([0-9a-zA-Z._\-\!\$\%\/\(\)\+\#\=\{\}:&]){1,128}$/u]]></Mask>

The users template renders that password inside double quotes:

{{ user_list.username }} {{ user_list.passwordencryption }} := "{{ user_list.password }}"

FreeRADIUS applies dynamic expansion to double-quoted strings, so it reads % as the start
of an expansion sequence. Parsing the value fails, rlm_files skips the whole user entry,
and the server rejects the user for having no Auth-Type. The rejection is the same one a
wrong password produces. The GUI reports no error, and the account continues to show as
enabled in the user list.

Steps to reproduce

1. Under Services > FreeRADIUS > Users, add an enabled user whose password contains %,
   for example abc%cB%7def. The GUI accepts the password, because the mask permits %.
2. Apply the change, then restart the service.
3. radtest <user> 'abc%cB%7def' 127.0.0.1 0 <secret> returns Access-Reject.
4. /var/log/radius.log contains:

files: WARNING: Failed parsing expanded value for check item, skipping entry:
Auth: Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject)

A second user configured the same way, with no % in the password, authenticates normally.

Related observations

The mask excludes ^ and most punctuation. The field help text in
dialogEditFreeRADIUSUser.xml lists a comma that the mask does not permit.

The template renders Tunnel-Password without quotes at lines 28 and 124, and that field
carries a comparable mask.