Use escapeshellcmd instead of escapeshellarg to prevent abuse like on C…

…VE-2024-0986. Bump to release 3
IssabelFoundation · Aug 23, 2024 · 5473a73 · 5473a73
1 parent 3616461
commit 5473a73
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/modules/backup_restore/restore.php b/modules/backup_restore/restore.php
@@ -41,8 +41,7 @@
 echo "<html><head></head><body>";
 
 if (isset($_REQUEST['filename'])){
-    $filename = escapeshellarg($_REQUEST['filename']);
-    $filename = substr($filename,1,-1);
+    $filename = escapeshellcmd($_REQUEST['filename']);
     $filename = $backup_dir."/".$filename;
     if(is_file($filename)) { 
         echo "<div style='font-family: \"Lucida Console\", Monaco, monospace'>";