From 62ce21c9ec393f9962515c88f0c489ace42bf656 Mon Sep 17 00:00:00 2001 From: Michael Kaufmann Date: Wed, 4 Mar 2020 19:35:57 +0100 Subject: [PATCH] secure shell-execution of mysqldump on installation if given database-name exists Signed-off-by: Michael Kaufmann --- install/lib/class.FroxlorInstall.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/install/lib/class.FroxlorInstall.php b/install/lib/class.FroxlorInstall.php index 11a16bfb..dc67120f 100644 --- a/install/lib/class.FroxlorInstall.php +++ b/install/lib/class.FroxlorInstall.php @@ -735,7 +735,7 @@ class FroxlorInstall } if ($do_backup) { - $command = $mysql_dump . " " . $this->_data['mysql_database'] . " -u " . $this->_data['mysql_root_user'] . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename; + $command = $mysql_dump . " " . escapeshellarg($this->_data['mysql_database']) . " -u " . escapeshellarg($this->_data['mysql_root_user']) . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename; $output = exec($command); if (stristr($output, "error")) { $content .= $this->_status_message('red', $this->_lng['install']['backup_failed']);