Merge remote-tracking branch 'stevee/next-cgi-geoip' into next

[ipfire-2.x.git] / src / patches / cacti / cacti-0.8.8b-remote-command-execution.patch

------------------------------------------------------------------------
r7442 | rony | 2014-03-30 18:41:56 -0500 (Sun, 30 Mar 2014) | 2 lines

bug#0002433: CVE-2014-2328 Unspecified Remote Command Execution Vulnerability

------------------------------------------------------------------------
Index: branches/0.8.8/lib/graph_export.php
===================================================================
--- branches/0.8.8/lib/graph_export.php	(revision 7441)
+++ branches/0.8.8/lib/graph_export.php	(revision 7442)
@@ -339,7 +339,7 @@
 	chdir($stExportDir);
 
 	/* set the initial command structure */
-	$stExecute = 'ncftpput -R -V -r 1 -u '.$aFtpExport['username'].' -p '.$aFtpExport['password'];
+	$stExecute = 'ncftpput -R -V -r 1 -u ' . cacti_escapeshellarg($aFtpExport['username']) . ' -p ' . cacti_escapeshellarg($aFtpExport['password']);
 
 	/* if the user requested passive mode, use it */
 	if ($aFtpExport['passive']) {
@@ -347,7 +347,7 @@
 	}
 
 	/* setup the port, server, remote directory and all files */
-	$stExecute .= ' -P ' . $aFtpExport['port'] . ' ' . $aFtpExport['server'] . ' ' . $aFtpExport['remotedir'] . ".";
+	$stExecute .= ' -P ' . cacti_escapeshellarg($aFtpExport['port']) . ' ' . cacti_escapeshellarg($aFtpExport['server']) . ' ' . cacti_escapeshellarg($aFtpExport['remotedir']) . ".";
 
 	/* run the command */
 	$iExecuteReturns = 0;