Skip to content

Commit 841a073

Browse files
committed
Security: Avoid wrapping commands in double quotes as escapeshellarg() does not escape them from args
1 parent e864127 commit 841a073

File tree

3 files changed

+9
-12
lines changed

3 files changed

+9
-12
lines changed

main/lp/openoffice_presentation.class.php

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -253,11 +253,10 @@ public function add_command_parameters()
253253
$this->slide_height = (int) $h;
254254
}
255255

256-
return ' -w '.$this->slide_width.' -h '.$this->slide_height.' -d oogie "'
256+
return ' -w '.$this->slide_width.' -h '.$this->slide_height.' -d oogie '
257257
.Security::sanitizeExecParam($this->base_work_dir.'/'.$this->file_path)
258-
.'" "'
259-
.Security::sanitizeExecParam($this->base_work_dir.$this->created_dir.'.html')
260-
.'"';
258+
.' '
259+
.Security::sanitizeExecParam($this->base_work_dir.$this->created_dir.'.html');
261260
}
262261

263262
public function set_slide_size($width, $height)

main/lp/openoffice_text.class.php

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -331,11 +331,10 @@ public function dealPerPage($header, $body)
331331
*/
332332
public function add_command_parameters()
333333
{
334-
return ' -d woogie "'
334+
return ' -d woogie '
335335
.Security::sanitizeExecParam($this->base_work_dir.'/'.$this->file_path)
336-
.'" "'
337-
.Security::sanitizeExecParam($this->base_work_dir.$this->created_dir.'/'.$this->file_name.'.html')
338-
.'"';
336+
.' '
337+
.Security::sanitizeExecParam($this->base_work_dir.$this->created_dir.'/'.$this->file_name.'.html');
339338
}
340339

341340
/**

main/lp/openoffice_text_document.class.php

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -333,11 +333,10 @@ public function dealPerPage($header, $body)
333333
*/
334334
public function add_command_parameters()
335335
{
336-
return ' -d woogie "'
336+
return ' -d woogie '
337337
.Security::sanitizeExecParam($this->base_work_dir.'/'.$this->file_path)
338-
.'" "'
339-
.Security::sanitizeExecParam($this->base_work_dir.$this->created_dir.'/'.$this->file_name.'.html')
340-
.'"';
338+
.' '
339+
.Security::sanitizeExecParam($this->base_work_dir.$this->created_dir.'/'.$this->file_name.'.html');
341340
}
342341

343342
/**

0 commit comments

Comments
 (0)