Added escapespecialcharacters to format.lua to escape shell special characters. Reviewed all calls to io.popen and os.execute to escape special characters. Fixed file uploads in openssl and ipsectools with viewfunctions.lua. Tried to fix openssl renew when subject contains special characters, but not done yet.

git-svn-id: svn://svn.alpinelinux.org/acf/devtools/trunk@1687 ab2d0c66-481e-0410-8bed-d214d4d58bed

1 files changed, 8 insertions, 7 deletions

diff --git a/acfupdate-model.lua b/acfupdate-model.lua
index be4f3ef..b90becc 100644
--- a/acfupdate-model.lua
+++ b/acfupdate-model.lua
@@ -10,6 +10,7 @@ local svnurl = "svn://svn.alpinelinux.org/acf/"
 -- ################################################################################
 -- LOCAL FUNCTIONS
 
+-- Make sure to escape special characters before calling this function
 local function querycmd ( cmdline )
 	local cmd = io.popen( cmdline )
 	local cmd_result = cmd:read("*a") or "unknown"
@@ -55,7 +56,7 @@ function read(repository)
 	})
 
 	status.repository = cfe({ value=repository, label="SVN Repository" })
-	if "" == querycmd("/usr/bin/svn list "..repository) then
+	if "" == querycmd("/usr/bin/svn list "..format.escapespecialcharacters(repository)) then
 		status.repository.errtxt = "Repository cannot be reached"
 	end
 
@@ -77,15 +78,15 @@ function update(repository, sessiondata)
 				mustrestart = true
 			end
 		end
-		local updateresult = querycmd("/usr/bin/svn co "..repository.."/"..list.."trunk "..dir.." 2>&1")
+		local updateresult = querycmd("/usr/bin/svn co "..format.escapespecialcharacters(repository).."/"..list.."trunk "..dir.." 2>&1")
 		-- Hide projects without updates
 		if (string.match(updateresult, "^Checked out revision.*")) then updateresult = "" end
 		table.insert(cmdresult, {name=list, updates=updateresult})
 	end
 
-	if "" ~= querycmd("/usr/bin/svn list "..repository) then
+	if "" ~= querycmd("/usr/bin/svn list "..format.escapespecialcharacters(repository)) then
 		work("core/")
-		for list in string.gmatch((querycmd("/usr/bin/svn list " .. repository )), "%S+") do
+		for list in string.gmatch((querycmd("/usr/bin/svn list " .. format.escapespecialcharacters(repository) )), "%S+") do
 			if list~="core/" and list~="sandbox/" then
 				work(list)
 			end
@@ -106,7 +107,7 @@ end
 function diffs(repository)
 	repository = determinerepository(repository)
 	local cmdresult = {}
-	for list in string.gmatch((querycmd("/usr/bin/svn list " .. repository )), "%S+") do
+	for list in string.gmatch((querycmd("/usr/bin/svn list " .. format.escapespecialcharacters(repository) )), "%S+") do
 		if (list ~= "sandbox/") then
 			local updateresult = querycmd("/usr/bin/svn diff "..svndir(list).." 2>&1")
 			if updateresult ~= "" then
@@ -120,7 +121,7 @@ end
 function status(repository)
 	repository = determinerepository(repository)
 	local cmdresult = {}
-	for list in string.gmatch((querycmd("/usr/bin/svn list " .. repository )), "%S+") do
+	for list in string.gmatch((querycmd("/usr/bin/svn list " .. format.escapespecialcharacters(repository) )), "%S+") do
 		if (list ~= "sandbox/") then
 			local updateresult = querycmd("/usr/bin/svn st -u "..svndir(list).." 2>&1")
 			-- Hide projects without diffs
@@ -134,6 +135,6 @@ end
 function log (repository)
 	repository = determinerepository(repository)
 	local enddate = tostring(os.date("%Y-%m-%d",  (os.time() - (3600 * 24) * 7)))
-	local svnresult = querycmd("/usr/bin/svn log -v -rHEAD:{".. enddate .. "} " .. repository )
+	local svnresult = querycmd("/usr/bin/svn log -v -rHEAD:{".. enddate .. "} " .. format.escapespecialcharacters(repository) )
 	return cfe({ type="longtext", value=svnresult, label="SVN log Result" })
 end