Changeset 14209 for trunk/FACT++

Timestamp:

06/22/12 10:05:19 (12 years ago)

Author:

tbretz

Message:

Properly escape the command line arguments to dimctrl.

File:

• trunk/FACT++/www/smartfact/index.php (modified) (3 diffs)

trunk/FACT++/www/smartfact/index.php

@@ -2 +2 @@
 
 require_once("config.php");
+
+function escape($msg)
+{
+    $msg = str_replace("\\", "\\\\", $msg);
+    $msg = str_replace('\"', '\"',   $msg);
+    return $msg;
+}
 
 function login()
@@ -86 +93 @@
     fwrite($file,
            date("Y-m-d H:i:s\t").$addr.
-           "\t".$dns.
-           "\t".$user.
            "\t".$info->Platform.
            "\t".$info->Browser.
            "\t".$info->Version.
-           "\t".$info->isMobileDevice."\n");
+           "\t".($info->isMobileDevice?"mobile":"").
+           "\t".$user.
+           "\t".$dns."\n");
     fclose($file);
+
+    // http://ip-address-lookup-v4.com/ip/92.205.118.219
 
     return;
@@ -152 +161 @@
     }
 
+    $msg = "";
+    if (isset($_GET['msg']))
+    {
+        if ($_GET['msg']>=0)
+            $msg = $_GET['msg'];
+        unset($_GET['msg']);
+    }
+
     // Arguments
     foreach ($_GET as $key => $value)
-        $args .= ' --arg:"'.$key.'='.$value.'"';
-
-    // $args = "filename":label --arg:"key1=value" --arg:"key2=value"
-    $cmd = $path.'/dimctrl --user "'.$_SERVER['PHP_AUTH_USER'].'"  --start '.$args;
-
-    // Execute
-    $str = exec($cmd, $out, $rc);
+        $args .= ' --arg:"'.$key.'='.escape($value).'"';
+
+    if (!empty($args) && empty($msg))
+    {
+        // $args = "filename":label --arg:"key1=value" --arg:"key2=value"
+        $cmd = $path.'/dimctrl --user "'.$_SERVER['PHP_AUTH_USER'].'"  --start '.$args;
+
+        // Execute
+        $str = exec($cmd, $out, $rc);
+
+        // Logging (mainly for debugging)
+        $d = date("Y/m");
+
+        $path = "log/".$d;
+
+        if (!file_exists($path))
+            mkdir($path, 0777, true);
+
+        $file = fopen($path."/exec.log", "a");
+        fwrite($file, $cmd."\n".$str."\n\n");
+        fclose($file);
+    }
+
+    if (!empty($msg))
+    {
+        $msg = escape($msg);
+
+        // $args = "filename":label --arg:"key1=value" --arg:"key2=value"
+        $cmd = $path.'/dimctrl --user "'.$_SERVER['PHP_AUTH_USER'].'"  --msg "'.$msg.'"';
+
+        // Execute
+        $str = exec($cmd, $out, $rc);
+    }
+
+    // -------------------------------------------
+
 }