clpctl user:reset:password fails with passwords containing a dollar sign ($)

[CLPGithub]

CloudPanel version(s) affected​

2.5.4 (package 2.5.4-3+clp-bookworm)

Description​

Setting an admin/user password that contains the "$" character through the clpctl CLI
(user:resetassword or user:add) reports success, but the password is stored incorrectly,
so logging into the web UI with that exact password fails.


Setting the identical password through the web UI works normally — so the defect is specific
to the clpctl CLI path. It looks like clpctl performs shell/variable interpolation on the
--password value (expanding "$..." before hashing), even when the value is passed literally
inside single quotes.

How to reproduce​

Environment: Debian 12, CloudPanel 2.5.4.

1. Set the admin password via clpctl. Single quotes guarantee the login shell passes "$"
   literally (no shell expansion on our side):
   clpctl user:resetassword --userName='admin' --password='Abcd1234$XYZ'
   Output: Password for "admin" has been reset.
2. Open https://:8443 and log in as "admin" with Abcd1234$XYZ
   -> login FAILS.
3. Now set the SAME password from the web UI (Admin Area -> Users -> edit admin),
   then log in with Abcd1234$XYZ
   -> works.
4. Set a password that differs ONLY by replacing "$" with another symbol, via clpctl:
   clpctl user:resetassword --userName='admin' --password='Abcd1234%XYZ'
   Log in with Abcd1234%XYZ
   -> works.

Only the "$" variant fails, and only via clpctl. Because step 1 uses single quotes, the login
shell is not responsible — the corruption happens inside clpctl.