Core

Bug #31278

Missing quoting in t3lib_extFileFunc

Added by Andreas Wolf over 1 year ago. Updated 9 months ago.

Status:

Resolved

Start date:

2011-10-25

Priority:

Should have

Due date:

Assignee:

% Done:

100%

Category:

Target version:

TYPO3 Version:

4.6

Complexity:

PHP Version:

Votes:

Description

During a FAL code sprint, we discovered that t3lib_extFileFunc does not escape file names when using them for exec calls. This could possibly lead to unwanted side-effects.

See e.g. this snippet from func_copy():

1 if ($this->PHPFileFunctions) {
2     copy($theFile, $theDestFile);
3 } else {
4     $cmd = 'cp "' . $theFile . '" "' . $theDestFile . '"';
5     t3lib_utility_Command::exec($cmd);
6 }

$theFile and $theDestFile are not escaped anywhere; from what I read in t3lib_utility_Command::imageMagickCommand(), I guess we would have to use escapeshellarg() here.

31278.diff (2.3 kB) Andreas Wolf, 2011-10-25 13:43

Associated revisions

Revision a1cd99f5
Added by Dmitry Dulepov about 1 year ago

[BUGFIX] Shell command arguments are not escaped

Shell command arguments should be escaped with escapeshellarg()
PHP function, which adds single quotes around the argument and
escapes all single quotes inside the argument.

Change-Id: I4fb655e6496e1d0f09d6386831daa8d2f7a95351
Resolves: #31278
Releases: 4.7, 4.6, 4.5
Reviewed-on: http://review.typo3.org/6779
Reviewed-by: Oliver Hader
Reviewed-by: Tolleiv Nietsch
Tested-by: Tolleiv Nietsch
Reviewed-by: Andy Grunwald
Reviewed-by: Wouter Wolters
Reviewed-by: Steffen Ritter
Tested-by: Steffen Ritter

Revision f145fd32
Added by Dmitry Dulepov about 1 year ago

[BUGFIX] Shell command arguments are not escaped

Shell command arguments should be escaped with escapeshellarg()
PHP function, which adds single quotes around the argument and
escapes all single quotes inside the argument.

Change-Id: I4fb655e6496e1d0f09d6386831daa8d2f7a95351
Resolves: #31278
Releases: 4.7, 4.6, 4.5
Reviewed-on: http://review.typo3.org/9484
Reviewed-by: Steffen Ritter
Tested-by: Steffen Ritter

Revision 59353946
Added by Mario Rimann 10 months ago

[BUGFIX] Shell command arguments are not escaped

Shell command arguments should be escaped with
escapeshellarg() PHP function, which adds single quotes
around the argument and escapes all single quotes inside the
argument.

Change-Id: If6f0dd507828510893d11ebea5da88748dc7cd0c
Resolves: #31278
Releases: 4.7, 4.6, 4.5
Reviewed-on: http://review.typo3.org/12855
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel

Revision 689bb9d9
Added by Dmitry Dulepov 10 months ago

[BUGFIX] Shell command arguments are not escaped

Shell command arguments should be escaped with escapeshellarg()
PHP function, which adds single quotes around the argument and
escapes all single quotes inside the argument.

Change-Id: I195c159048a69535b6f863f9f598613be49a0db7
Resolves: #31278
Releases: 4.7, 4.6, 4.5
Reviewed-on: http://review.typo3.org/12856
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel