From 87c7a7981317aa2d866fc7d35ebd61876a5deabc Mon Sep 17 00:00:00 2001 From: nao-pon Date: Mon, 11 Jul 2016 14:23:00 +0900 Subject: [PATCH] [VD:FTP] fix #1514 security vulnerability in the archive command --- php/elFinderVolumeFTP.class.php | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/php/elFinderVolumeFTP.class.php b/php/elFinderVolumeFTP.class.php index 3ce35e32c..bd0c45ee4 100644 --- a/php/elFinderVolumeFTP.class.php +++ b/php/elFinderVolumeFTP.class.php @@ -1095,15 +1095,13 @@ class elFinderVolumeFTP extends elFinderVolumeDriver { $file_names_string = ""; foreach (scandir($tmpDir) as $filename) { - if ('.' == $filename) { + if ('.' === $filename || '..' === $filename) { continue; } - if ('..' == $filename) { - continue; - } - $file_names_string = $file_names_string . '"' . $filename . '" '; + $filename = escapeshellarg('.'.DIRECTORY_SEPARATOR.$filename); + $file_names_string .= $filename . ' '; } - $command = escapeshellcmd($arc['cmd'] . ' ' . $arc['argc'] . ' "' . $name . '" ' . $file_names_string); + $command = escapeshellcmd($arc['cmd'] . ' ' . $arc['argc'] . ' ' . escapeshellarg($name) . ' ' . $file_names_string); $descriptorspec = array( 0 => array("pipe", "r"), // stdin is a pipe that the child will read from