Use escapeshellarg() on the query string passed to shell_exec(), …

…to make sure its treated safely as a single argument.
shesek · Oct 23, 2011 · 947a06e · 947a06e · singpolyma · Oct 25, 2011
1 parent cd13c31
commit 947a06e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/web/show.php b/web/show.php
@@ -29,7 +29,7 @@
 echo "\n<p>".str_replace("\n\n","</p>\n\n<p>",$ticket[1])."</p>\n";
 
 // XXX support threaded comments
-$comments = explode("\n",shell_exec("cd '".REPOSITORY_PATH."/.tickets'; git ticket list comments '".basename($_SERVER['QUERY_STRING'])."'"));
+$comments = explode("\n",shell_exec("cd '".REPOSITORY_PATH."/.tickets'; git ticket list comments '".escapeshellarg(basename($_SERVER['QUERY_STRING']))."'"));
 if(count($comments)) {
 	echo "\n<ul>\n";
 	foreach($comments as $comment) {