- replaces escapeshellcmd by escapeshellarg (Fixes #3456)

Marius Burkard

2016-02-19 676dd14daa242c7dbeaf169aae09da36115e997d

- replaces escapeshellcmd by escapeshellarg (Fixes #3456)

 server/plugins-available/backup_plugin.inc.php

@@ -127,7 +127,7 @@
                        //$db_name = $parts[1];
                        preg_match('@^db_(.+)_\d{4}-\d{2}-\d{2}_\d{2}-\d{2}\.sql\.gz$@', $backup['filename'], $matches);
                        $db_name = $matches[1];
                        $command = "gunzip --stdout ".escapeshellarg($backup_dir.'/'.$backup['filename'])." | mysql -h '".escapeshellcmd($clientdb_host)."' -u '".escapeshellcmd($clientdb_user)."' -p'".escapeshellcmd($clientdb_password)."' '".$db_name."'";
                        $command = "gunzip --stdout ".escapeshellarg($backup_dir.'/'.$backup['filename'])." | mysql -h '".escapeshellarg($clientdb_host)."' -u '".escapeshellarg($clientdb_user)."' -p'".escapeshellarg($clientdb_password)."' '".$db_name."'";
                        exec($command);
                    }
                    unset($clientdb_host);