composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-07-20 21:56:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°3412 - Command Injection vulnerability in the Setup Wizard - do not use escapeshellcmd before execution in Windows envt

Browse Source
This commit is contained in:
odain
2021-02-17 10:09:39 +01:00
parent a12959d60e
commit bb877a244b
3 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
setup/setuputils.class.inc.php
View File

@@ -566,7 +566,9 @@ class SetupUtils
"$sGraphvizPath could not be executed: Please make sure it is installed and in the path");
}
$sGraphvizPath = escapeshellcmd($sGraphvizPath);
if (!utils::IsWindows()){
$sGraphvizPath = escapeshellcmd($sGraphvizPath);
}
}
$sCommand = "\"$sGraphvizPath\" -V 2>&1";