diff --git a/functions/exec.xml b/functions/exec.xml index 25e62f98f7..fdacb44c29 100644 --- a/functions/exec.xml +++ b/functions/exec.xml @@ -65,7 +65,10 @@ system("ls ".EscapeShellArg($dir)) -system(EscapeShellCmd($cmd)) +$e = EscapeShellCmd($userinput); +system("echo $e"); // here we don't care if $e has spaces +$f = EscapeShellCmd($filename); +system("touch \"/tmp/$f\"; ls -l \"/tmp/$f\""); // and here we do, so we use quotes