escape filenames passed on to exec(); fixes SEC-CORE-007

classes/image/imagemagick.php

@@ -46,15 +46,15 @@ public function load($filename, $return_data = false, $force_extension = false)
		{
			throw new \RuntimeException("Could not write in the temp directory.");
		}
		$this->exec('convert', '"'.$image_fullpath.'"[0] "'.$this->image_temp.'"');
		$this->exec('convert', "'".$image_fullpath."'[0] '".$this->image_temp."'");

		return $this;
	}

	protected function _crop($x1, $y1, $x2, $y2)
	{
		extract(parent::_crop($x1, $y1, $x2, $y2));
		$image = '"'.$this->image_temp.'"';
		$image = "'".$this->image_temp."'";
		$this->exec('convert', $image.' -crop '.($x2 - $x1).'x'.($y2 - $y1).'+'.$x1.'+'.$y1.' +repage '.$image);
		$this->clear_sizes();
	}
@@ -63,7 +63,7 @@ protected function _resize($width, $height = null, $keepar = true, $pad = true)
	{
		extract(parent::_resize($width, $height, $keepar, $pad));

		$image = '"'.$this->image_temp.'"';
		$image = "'".$this->image_temp."'";
		$this->exec('convert', "-define png:size=".$cwidth."x".$cheight." ".$image." ".
			"-background none ".
			"-resize \"".($pad ? $width : $cwidth)."x".($pad ? $height : $cheight)."!\" ".
@@ -76,7 +76,7 @@ protected function _rotate($degrees)
	{
		extract(parent::_rotate($degrees));

		$image = '"'.$this->image_temp.'"';
		$image = "'".$this->image_temp."'";
		$this->exec('convert', $image." -background none -virtual-pixel background +distort ScaleRotateTranslate ".$degrees." +repage ".$image);

		$this->clear_sizes();
@@ -100,7 +100,7 @@ protected function _flip($direction)

			default: return false;
		}
		$image = '"'.$this->image_temp.'"';
		$image = "'".$this->image_temp."'";
		$this->exec('convert', $image.' '.$arg.' '.$image);
	}

@@ -116,7 +116,7 @@ protected function _watermark($filename, $position, $padding = array(5,5))
		$x >= 0 and $x = '+'.$x;
		$y >= 0 and $y = '+'.$y;

		$image = '"'.$this->image_temp.'"';
		$image = "'".$this->image_temp."'";
		$this->exec(
			'composite',
			'-compose atop -geometry '.$x.$y.' '.
@@ -129,7 +129,7 @@ protected function _border($size, $color = null)
	{
		extract(parent::_border($size, $color));

		$image = '"'.$this->image_temp.'"';
		$image = "'".$this->image_temp."'";
		$color = $this->create_color($color, 100);
		$command = $image.' -compose copy -bordercolor '.$color.' -border '.$size.'x'.$size.' '.$image;
		$this->exec('convert', $command);
@@ -141,8 +141,8 @@ protected function _mask($maskimage)
	{
		extract(parent::_mask($maskimage));

		$mimage = '"'.$maskimage.'"';
		$image = '"'.$this->image_temp.'"';
		$mimage = "'".$maskimage."'";
		$image = "'".$this->image_temp."'";
		$command = $image.' '.$mimage.' +matte  -compose copy-opacity -composite '.$image;
		$this->exec('convert', $command);
	}
@@ -158,7 +158,7 @@ protected function _rounded($radius, $sides, $antialias = 0)
	{
		extract(parent::_rounded($radius, $sides, null));

		$image = '"'.$this->image_temp.'"';
		$image = "'".$this->image_temp."'";
		$r = $radius;
		$command = $image." \\( +clone -alpha extract ".
			( ! $tr ? '' : "-draw \"fill black polygon 0,0 0,$r $r,0 fill white circle $r,$r $r,0\" ")."-flip ".
@@ -171,7 +171,7 @@ protected function _rounded($radius, $sides, $antialias = 0)

	protected function _grayscale()
	{
		$image = '"'.$this->image_temp.'"';
		$image = "'".$this->image_temp."'";
		$this->exec('convert', $image." -colorspace Gray ".$image);
	}

@@ -188,7 +188,7 @@ public function sizes($filename = null, $usecache = true)
				$filename = $this->image_temp;
			}

			$output = $this->exec('identify', '-format "%w %h" "'.$filename.'"[0]');
			$output = $this->exec('identify', "-format '%w %h' '".$filename."'[0]");
			list($width, $height) = explode(" ", $output[0]);
			$return = (object) array(
				'width' => $width,
@@ -217,12 +217,12 @@ public function save($filename = null, $permissions = null)
		$this->add_background();

		$filetype = $this->image_extension;
		$old = '"'.$this->image_temp.'"';
		$new = '"'.$filename.'"';
		$old = "'".$this->image_temp."'";
		$new = "'".$filename."'";

		if(($filetype == 'jpeg' or $filetype == 'jpg') and $this->config['quality'] != 100)
		{
			$quality = '"'.$this->config['quality'].'%"';
			$quality = "'".$this->config['quality']."%'";
			$this->exec('convert', $old.' -quality '.$quality.' '.$new);
		}
		else
@@ -245,11 +245,11 @@ public function output($filetype = null)
		$this->run_queue();
		$this->add_background();

		$image = '"'.$this->image_temp.'"';
		$image = "'".$this->image_temp."'";

		if(($filetype == 'jpeg' or $filetype == 'jpg') and $this->config['quality'] != 100)
		{
			$quality = '"'.$this->config['quality'].'%"';
			$quality = "'".$this->config['quality']."%'";
			$this->exec('convert', $image.' -quality '.$quality.' '.strtolower($filetype).':-', true);
		}
		elseif (substr($this->image_temp, -1 * strlen($filetype)) != $filetype)
@@ -288,7 +288,7 @@ protected function add_background()
		if ($this->config['bgcolor'] != null)
		{
			$bgcolor = $this->config['bgcolor'] == null ? '#000' : $this->config['bgcolor'];
			$image   = '"'.$this->image_temp.'"';
			$image   = "'".$this->image_temp."'";
			$color   = $this->create_color($bgcolor, 100);
			$sizes   = $this->sizes();
			$command = '-size '.$sizes->width.'x'.$sizes->height.' '.'canvas:'.$color.' '.