meebey		Sat Jun 12 15:29:52 2004 EDT

  Modified files:              
    /pearbot/modules	pearcmds.php 
  Log:
  - added security for shell commands (big thanks to Cipriano Groenendal)
  
  
  
http://cvs.php.net/diff.php/pearbot/modules/pearcmds.php?r1=1.8&r2=1.9&ty=u
Index: pearbot/modules/pearcmds.php
diff -u pearbot/modules/pearcmds.php:1.8 pearbot/modules/pearcmds.php:1.9
--- pearbot/modules/pearcmds.php:1.8	Sat Jul 26 09:06:18 2003
+++ pearbot/modules/pearcmds.php	Sat Jun 12 15:29:51 2004
@@ -1,9 +1,9 @@
 <?php
 /**
- * $Id: pearcmds.php,v 1.8 2003/07/26 13:06:18 meebey Exp $
- * $Revision: 1.8 $
+ * $Id: pearcmds.php,v 1.9 2004/06/12 19:29:51 meebey Exp $
+ * $Revision: 1.9 $
  * $Author: meebey $
- * $Date: 2003/07/26 13:06:18 $
+ * $Date: 2004/06/12 19:29:51 $
  *
  * Copyright (c) 2003 Nicolas CHAILLAN <nicos@php.net>
 */
@@ -46,14 +46,12 @@
                 }
                 $print = $this->pear_info($data->messageex[2]);
                 break;
-                
             case 'list':
             case 'lists':
             case 'list-all':
             case 'remote-list':
                 $print = $this->pear_listing();
                 break;
-                
             case 'search':
             case 'find':
                 if (!isset($data->messageex[2]) || empty($data->messageex[2])) {
@@ -62,7 +60,6 @@
                 }
                 $print = $this->pear_search($data->messageex[2]);
                 break;
-                
             case 'help':
             default:
                 $print = $this->pear_help();
@@ -77,7 +74,7 @@
     
     function pear_info($package) 
     {
-        exec($this->pear_binary.' remote-info '.$package, $buf);
+        exec($this->pear_binary.' remote-info '.escapeshellarg($package), $buf);
         $buf = implode("\n", $buf);
         $buf = "Here is the information for $package:\n".$buf;
         return $buf;
@@ -93,7 +90,7 @@
     
     function pear_search($search_for) 
     {
-        exec($this->pear_binary.' search '.$search_for, $buf);
+        exec($this->pear_binary.' search '.escapeshellarg($search_for), $buf);
         $buf = implode("\n", $buf);
         $buf = "Here are the PEAR packages that match ".$search_for.":\n".$buf;
         return $buf;