Merge branch 'master-2.22'

mantisbt · Sep 21, 2019 · fa538d1 · fa538d1
2 parents aa429d3 + 5fb9796
commit fa538d1
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/config_defaults_inc.php b/config_defaults_inc.php
@@ -4360,7 +4360,7 @@
 	'ldap_simulation_file_path', 'plugin_path', 'bottom_include_page', 'top_include_page',
 	'default_home_page', 'logout_redirect_page', 'manual_url', 'logo_url', 'wiki_engine_url',
 	'cdn_enabled', 'public_config_names', 'email_login_enabled', 'email_ensure_unique',
-	'impersonate_user_threshold', 'email_retry_in_days'
+	'impersonate_user_threshold', 'email_retry_in_days', 'neato_tool', 'dot_tool'
 );
 
 /**

diff --git a/core/graphviz_api.php b/core/graphviz_api.php
@@ -350,7 +350,7 @@ function output( $p_format = 'dot', $p_headers = false ) {
 
 		# Start dot process
 
-		$t_command = $this->graphviz_tool . ' -T' . $p_format;
+		$t_command = escapeshellcmd( $this->graphviz_tool . ' -T' . $p_format );
 		$t_descriptors = array(
 			0 => array( 'pipe', 'r', ),
 			1 => array( 'pipe', 'w', ),