commit 6cab78970f212a30ea923835510ffd1fb77a6ad0
author Andrey Andreev <narf@devilix.net> Mon Jul 17 13:14:00 2017 +0300
committer Andrey Andreev <narf@devilix.net> Mon Jul 17 13:14:00 2017 +0300
tree b64f47cd2d16564edab6d507e47c939770d73e6e
parent 29740e442a1d78bd65b569c92575cdbf4fc2d614

[ci skip] escapeshellarg on the image src path passed to NetPBM by Image_lib

system/libraries/Image_lib.php

diff --git a/system/libraries/Image_lib.php b/system/libraries/Image_lib.php
index 88c9e7e..8786d9d 100644
--- a/system/libraries/Image_lib.php
+++ b/system/libraries/Image_lib.php
@@ -972,7 +972,7 @@
 			$cmd_inner = 'pnmscale -xysize '.$this->width.' '.$this->height;
 		}
 
-		$cmd = $this->library_path.$cmd_in.' '.$this->full_src_path.' | '.$cmd_inner.' | '.$cmd_out.' > '.$this->dest_folder.'netpbm.tmp';
+		$cmd = $this->library_path.$cmd_in.' '.escapeshellarg($this->full_src_path).' | '.$cmd_inner.' | '.$cmd_out.' > '.$this->dest_folder.'netpbm.tmp';
 
 		$retval = 1;
 		// exec() might be disabled