Ticket #8210: ssh2.dash_and_shell.patch

wp-admin/includes/class-wp-filesystem-ssh2.php

@@ -217 +217 @@
                 return $ret;
         }
 
+        function escape_dot($str) {
+                if (substr($str, 0, 1) != '/') # not an absolute path
+                        $str = "./$str"; # assumes that "/" separates directories
+                $str = escapeshellarg($str);
+                return $str;
+        }
+
         function cwd() {
                 $this->debug("cwd();");
                 $cwd = $this->run_command($this->link, 'pwd');
@@ -227 +234 @@
 
         function chdir($dir) {
                 $this->debug("chdir();");
-                return $this->run_command($this->link, 'cd ' . $dir, true);
+                return $this->run_command($this->link, 'cd ' . escape_dot($dir), true);
         }
 
         function chgrp($file, $group, $recursive = false ) {
@@ -235 +242 @@
                 if ( ! $this->exists($file) )
                         return false;
                 if ( ! $recursive || ! $this->is_dir($file) )
-                        return $this->run_command($this->link, sprintf('chgrp %o %s', $mode, $file), true);
-                return $this->run_command($this->link, sprintf('chgrp -R %o %s', $mode, $file), true);
+                        return $this->run_command($this->link, sprintf('chgrp %o %s', $mode, escape_dot($file)), true);
+                return $this->run_command($this->link, sprintf('chgrp -R %o %s', $mode, escape_dot($file)), true);
         }
 
         function chmod($file, $mode = false, $recursive = false) {
@@ -248 +255 @@
                 if ( ! $this->exists($file) )
                         return false;
                 if ( ! $recursive || ! $this->is_dir($file) )
-                        return $this->run_command($this->link, sprintf('chmod %o %s', $mode, $file), true);
-                return $this->run_command($this->link, sprintf('chmod -R %o %s', $mode, $file), true);
+                        return $this->run_command($this->link, sprintf('chmod %o %s', $mode, escape_dot($file)), true);
+                return $this->run_command($this->link, sprintf('chmod -R %o %s', $mode, escape_dot($file)), true);
         }
 
         function chown($file, $owner, $recursive = false ) {
@@ -257 +264 @@
                 if ( ! $this->exists($file) )
                         return false;
                 if ( ! $recursive || ! $this->is_dir($file) )
-                        return $this->run_command($this->link, sprintf('chown %o %s', $mode, $file), true);
-                return $this->run_command($this->link, sprintf('chown -R %o %s', $mode, $file), true);
+                        return $this->run_command($this->link, sprintf('chown %o %s', $mode, escape_dot($file)), true);
+                return $this->run_command($this->link, sprintf('chown -R %o %s', $mode, escape_dot($file)), true);
         }
 
         function owner($file) {
@@ -311 +318 @@
 
         function exists($file) {
                 $this->debug("exists();");
-                return $this->run_command($this->link, sprintf('ls -lad %s', $file), true);
+                return $this->run_command($this->link, sprintf('ls -lad %s', escape_dot($file)), true);
         }
 
         function is_file($file) {
                 $this->debug("is_file();");
                 //DO NOT RELY ON dirlist()!
-                $list = $this->run_command($this->link, sprintf('ls -lad %s', $file));
+                $list = $this->run_command($this->link, sprintf('ls -lad %s', escape_dot($file)));
                 $list = $this->parselisting($list);
                 if ( ! $list )
                         return false;
@@ -328 +335 @@
         function is_dir($path) {
                 $this->debug("is_dir();");
                 //DO NOT RELY ON dirlist()!
-                $list = $this->parselisting($this->run_command($this->link, sprintf('ls -lad %s', untrailingslashit($path))));
+                $list = $this->parselisting($this->run_command($this->link, sprintf('ls -lad %s',
+                                                               escape_dot(untrailingslashit($path)))));
                 if ( ! $list )
                         return false;
                 else
@@ -448 +456 @@
                         $limitFile = false;
                 }
 
-                $list = $this->run_command($this->link, sprintf('ls -la %s', $path));
+                $list = $this->run_command($this->link, sprintf('ls -la %s', escape_dot($path)));
 
                 if ( $list === false )
                         return false;