Changeset 37094

Timestamp:

03/30/2016 01:57:40 PM (9 years ago)

Author:

nbachiyski

Message:

Snoopy: use escapeshellarg instead of escapeshellcmd

We are escaping arguments, not commands, so we'd better use the semantically correct function, even though they are similar.

File:

• trunk/src/wp-includes/class-snoopy.php (modified) (1 diff)

trunk/src/wp-includes/class-snoopy.php

@@ -1000 +1000 @@
             $headers[] = "Authorization: BASIC ".base64_encode($this->user.":".$this->pass);
 
-        for($curr_header = 0; $curr_header < count($headers); $curr_header++) {
-            $safer_header = strtr( $headers[$curr_header], "\"", " " );
-            $cmdline_params .= " -H \"".$safer_header."\"";
-        }
-
-        if(!empty($body))
-            $cmdline_params .= " -d \"$body\"";
-
-        if($this->read_timeout > 0)
-            $cmdline_params .= " -m ".$this->read_timeout;
-
-        $headerfile = tempnam($this->temp_dir, "sno");
-
-        exec($this->curl_path." -k -D \"$headerfile\"".$cmdline_params." \"".escapeshellcmd($URI)."\"",$results,$return);
+        $headerfile = tempnam( $this->temp_dir, "sno" );
+        $cmdline_params = '-k -D ' . escapeshellarg( $headerfile );
+
+        foreach ( $headers as $header ) {
+            $cmdline_params .= ' -H ' . escapeshellarg( $header );
+        }
+
+        if ( ! empty( $body ) ) {
+            $cmdline_params .= ' -d ' . escapeshellarg( $body );
+        }
+
+        if ( $this->read_timeout > 0 ) {
+            $cmdline_params .= ' -m ' . escapeshellarg( $this->read_timeout );
+        }
+
+
+        exec( $this->curl_path . ' ' . $cmdline_params . ' ' . escapeshellarg( $URI ), $results, $return );
 
         if($return)