Merge pull request #232 from drAlberT/patch-1

security fix, use escapeshellcmd()
10 years ago · 4c8b5f508f
1 changed files with 1 additions and 1 deletions
--- a/Mage/Console.php
+++ b/Mage/Console.php
@ -212,7 +212,7 @@ class Console

        $return = 1;
        $log = array();
-        exec($command . ' 2>&1', $log, $return);
+        exec(escapeshellcmd($command . ' 2>&1'), $log, $return);
        $log = implode(PHP_EOL, $log);

        if (!$return) {