fix: direct mode allows injecting unauthorized filesystem operations

lsyncd · Oct 27, 2015 · c4f4ac3 · c4f4ac3
1 parent cce7db5
commit c4f4ac3
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/default-direct.lua b/default-direct.lua
@@ -109,13 +109,13 @@ direct.action = function(inlet)
 			error('Refusing to erase your harddisk!')
 		end
 
-		local command = '/bin/mv $1 $2 || /bin/rm -rf $1'
+		local command = '/bin/mv "$1" "$2" || /bin/rm -rf "$1"'
 
 		if
 			config.delete ~= true and
 			config.delete ~= 'running'
 		then
-			command = '/bin/mv $1 $2'
+			command = '/bin/mv "$1" "$2"'
 		end
 
 		spawnShell(