Added escapespecialcharacters to format.lua to escape shell special characters. Reviewed all calls to io.popen and os.execute to escape special characters. Fixed file uploads in openssl and ipsectools with viewfunctions.lua. Tried to fix openssl renew when subject contains special characters, but not done yet.

git-svn-id: svn://svn.alpinelinux.org/acf/gnats/trunk@1687 ab2d0c66-481e-0410-8bed-d214d4d58bed

1 files changed, 6 insertions, 6 deletions

diff --git a/gnats-model.lua b/gnats-model.lua
index a3afc02..c273fbc 100644
--- a/gnats-model.lua
+++ b/gnats-model.lua
@@ -115,7 +115,7 @@ end
 
 local function get_array(name)
 	local a = {}
-	local f = assert(io.popen("/usr/bin/query-pr "..gnatsopts.." --valid-values " .. tostring(name)))
+	local f = assert(io.popen("/usr/bin/query-pr "..gnatsopts.." --valid-values " .. format.escapespecialcharacters(name)))
 	for line in f:lines() do
 		table.insert(a, line)
 	end
@@ -170,7 +170,7 @@ function summary()
 		end
 	end
 
-	local f = assert(io.popen("query-pr "..gnatsopts.. (search_opts or "")))
+	local f = assert(io.popen("query-pr "..gnatsopts.. format.escapespecialcharacters(search_opts)))
 
 	i = 0
 	for line in f:lines() do
@@ -278,7 +278,7 @@ end
 -- read pr to header, sfields and mfields
 function read_pr(self, id)
 	local cmd = "query-pr -F "..gnatsopts.." "..tostring(id)
-	local f = assert(io.popen(cmd))
+	local f = assert(io.popen(format.escapespecialcharacters(cmd)))
 	local line
 	local section = SECT_HEADER
 
@@ -353,7 +353,7 @@ end
 
 function get_logfile ()
 	local file = {}
-	local cmdtxt = "cat /var/log/messages | grep " .. processname
+	local cmdtxt = "cat /var/log/messages | grep " .. format.escapespecialcharacters(processname)
 	local cmd, error = io.popen(cmdtxt ,r)
 	local cmdoutput = cmd:read("*a")
 	cmd:close()
@@ -475,12 +475,12 @@ function sendbug (self, message)
 	local mailtxt = "outgoing_mail"
 	fs.write_file(mailtxt, table.concat(message , "\n"))
 
-	local cmdtxt = "/usr/sbin/sendmail -oi -t < " .. mailtxt .. " 2>&1"
+	local cmdtxt = "/usr/sbin/sendmail -oi -t < " .. format.escapespecialcharacters(mailtxt) .. " 2>&1"
 	local cmd, error = io.popen(cmdtxt ,r)
 	local cmdoutput = cmd:read("*a")
 	cmd:close()
 
-	local cmd, error = io.popen("/bin/rm -f " .. mailtxt ,r)
+	local cmd, error = io.popen("/bin/rm -f " .. format.escapespecialcharacters(mailtxt) ,r)
 	cmd:close()
 
 	if (#cmdoutput > 0) then