Changeset 14323

Timestamp:

08/07/12 20:02:32 (12 years ago)

Author:

tbretz

Message:

Some security update to the escaping.

File:

• trunk/FACT++/www/smartfact/index.php (modified) (2 diffs)

trunk/FACT++/www/smartfact/index.php

@@ -177 +177 @@
         $args = "";
         foreach ($_GET as $key => $value)
-            $args .= ' '.$key.'="'.escape($value).'"';
+            $args .= ' "'.$key.'"="'.$value.'"';
 
         // $args = "filename":label --arg:"key1=value" --arg:"key2=value"
-        $cmd = $path.'/dimctrl --user "'.$_SERVER['PHP_AUTH_USER'].'"  --start "'.$script.escape($args).'"';
+        $cmd = $path.'/dimctrl --user "'.$_SERVER['PHP_AUTH_USER'].'"  --start '.escapeshellarg($script.$args);
 
         // Execute
@@ -200 +200 @@
 
         // $args = "filename":label --arg:"key1=value" --arg:"key2=value"
-        $cmd = $path.'/dimctrl --user "'.$_SERVER['PHP_AUTH_USER'].'"  --msg "'.$msg.'"';
+        $cmd = $path.'/dimctrl --user "'.$_SERVER['PHP_AUTH_USER'].'"  --msg '.escapeshellarg($msg);
 
         // Execute