--- session.c	Thu May 24 12:19:05 2001
+++ session.c.bin_sh	Thu May 24 12:19:05 2001
@@ -124,10 +124,10 @@
 void	session_set_fds(Session *s, int fdin, int fdout, int fderr);
 void	session_pty_cleanup(Session *s);
 void	session_proctitle(Session *s);
-void	do_exec_pty(Session *s, const char *command);
-void	do_exec_no_pty(Session *s, const char *command);
+void	do_exec_pty(Session *s, const char *command, const char *shell);
+void	do_exec_no_pty(Session *s, const char *command, const char *shell);
 void	do_login(Session *s, const char *command);
-void	do_child(Session *s, const char *command);
+void	do_child(Session *s, const char *command, const char *shell);
 void	do_motd(void);
 int	check_quietlogin(Session *s, const char *command);
 
@@ -436,9 +436,9 @@
 				debug("Forced command '%.500s'", forced_command);
 			}
 			if (have_pty)
-				do_exec_pty(s, command);
+				do_exec_pty(s, command, NULL);
 			else
-				do_exec_no_pty(s, command);
+				do_exec_no_pty(s, command, NULL);
 
 			if (command != NULL)
 				xfree(command);
@@ -472,7 +472,7 @@
  * setting up file descriptors and such.
  */
 void
-do_exec_no_pty(Session *s, const char *command)
+do_exec_no_pty(Session *s, const char *command, const char *shell)
 {
 	int pid;
 
@@ -549,7 +549,7 @@
 #endif /* USE_PIPES */
 
 		/* Do processing for the child (exec command etc). */
-		do_child(s, command);
+		do_child(s, command, shell);
 		/* NOTREACHED */
 	}
 #ifdef HAVE_CYGWIN
@@ -599,7 +599,7 @@
  * lastlog, and other such operations.
  */
 void
-do_exec_pty(Session *s, const char *command)
+do_exec_pty(Session *s, const char *command, const char *shell)
 {
 	int fdout, ptyfd, ttyfd, ptymaster;
 	pid_t pid;
@@ -647,7 +647,7 @@
 #endif
 
 		/* Do common processing for the child, such as execing the command. */
-		do_child(s, command);
+		do_child(s, command, shell);
 		/* NOTREACHED */
 	}
 #ifdef HAVE_CYGWIN
@@ -1032,9 +1032,9 @@
  * ids, and executing the command or shell.
  */
 void
-do_child(Session *s, const char *command)
+do_child(Session *s, const char *command, const char *shell)
 {
-	const char *shell, *hostname = NULL, *cp = NULL;
+	const char *hostname = NULL, *cp = NULL;
 	struct passwd * pw = s->pw;
 	char buf[256];
 	char cmd[1024];
@@ -1202,10 +1202,12 @@
 	 * Get the shell from the password data.  An empty shell field is
 	 * legal, and means /bin/sh.
 	 */
-	shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
+	if (!shell) {
+		shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
 #ifdef HAVE_LOGIN_CAP
-	shell = login_getcapstr(lc, "shell", (char *)shell, (char *)shell);
+		shell = login_getcapstr(lc, "shell", (char *)shell, (char *)shell);
 #endif
+	}
 
 #ifdef AFS
 	/* Try to get AFS tokens for the local cell. */
@@ -1698,7 +1700,7 @@
 		if(strcmp(subsys, options.subsystem_name[i]) == 0) {
 			debug("subsystem: exec() %s", options.subsystem_command[i]);
 			s->is_subsystem = 1;
-			do_exec_no_pty(s, options.subsystem_command[i]);
+			do_exec_no_pty(s, options.subsystem_command[i], _PATH_BSHELL);
 			success = 1;
 		}
 	}
@@ -1773,9 +1775,9 @@
 	char *shell = forced_command;
 	packet_done();
 	if (s->ttyfd == -1)
-		do_exec_no_pty(s, shell);
+		do_exec_no_pty(s, shell, NULL);
 	else
-		do_exec_pty(s, shell);
+		do_exec_pty(s, shell, NULL);
 	return 1;
 }
 
@@ -1791,9 +1793,9 @@
 		debug("Forced command '%.500s'", forced_command);
 	}
 	if (s->ttyfd == -1)
-		do_exec_no_pty(s, command);
+		do_exec_no_pty(s, command, NULL);
 	else
-		do_exec_pty(s, command);
+		do_exec_pty(s, command, NULL);
 	if (forced_command == NULL)
 		xfree(command);
 	return 1;
