From e8dda462f3b02628b4d878ed2c133f1f04d26a50 Mon Sep 17 00:00:00 2001
From: Pascal Dreissen <pascal@dreissen.nl>
Date: Fri, 08 Jul 2016 05:25:42 -0400
Subject: [PATCH] escapeshellarg document root for security reasons (fixes #3984)

---
 server/plugins-available/apache2_plugin.inc.php |    2 +-
 server/plugins-available/cron_plugin.inc.php    |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/plugins-available/apache2_plugin.inc.php b/server/plugins-available/apache2_plugin.inc.php
index e3b8bfe..f4b6ab7 100644
--- a/server/plugins-available/apache2_plugin.inc.php
+++ b/server/plugins-available/apache2_plugin.inc.php
@@ -884,7 +884,7 @@
 			}
             
           // get the primitive folder for document_root and the filesystem, will need it later.
-          $df_output=explode(" ", exec("df -T " . $data['new']['document_root'] . "|awk 'END{print \$2,\$NF}'"));
+          $df_output=explode(" ", exec("df -T " . escapeshellarg($data['new']['document_root']) . "|awk 'END{print \$2,\$NF}'"));
           $file_system = $df_output[0];
           $primitive_root = $df_output[1];
 
diff --git a/server/plugins-available/cron_plugin.inc.php b/server/plugins-available/cron_plugin.inc.php
index 00ea6d3..c7109a5 100644
--- a/server/plugins-available/cron_plugin.inc.php
+++ b/server/plugins-available/cron_plugin.inc.php
@@ -136,7 +136,7 @@
             }
 
             // get the primitive folder for document_root and the filesystem, will need it later.
-            $df_output=explode(" ", exec("df -T " . $parent_domain["document_root"] . "|awk 'END{print \$2,\$NF}'"));
+            $df_output=explode(" ", exec("df -T " . escapeshellarg($parent_domain["document_root"]) . "|awk 'END{print \$2,\$NF}'"));
             $file_system = $df_output[0];
             $primitive_root = $df_output[1];
 

--
Gitblit v1.9.1