[web-doc] master: escape git diff args
| From: | Peter Cowburn | Date: | Thu, 29 Jul 2021 11:57:40 +0000 |
| Subject: | [web-doc] master: escape git diff args | ||
| Groups: | php.doc.web | ||
| Request: | Send a blank email to doc-web+get-2485@lists.php.net to get a copy of this message | ||
Author: Peter Cowburn (salathe)
Date: 2021-07-29T12:56:36+01:00
Commit: https://github.com/php/web-doc/commit/c6564224e178b0227d3fe0d030f3a60d354ea727
Raw diff: https://github.com/php/web-doc/commit/c6564224e178b0227d3fe0d030f3a60d354ea727.diff
escape git diff args
Changed paths:
M include/lib_revcheck.inc.php
Diff:
diff --git a/include/lib_revcheck.inc.php b/include/lib_revcheck.inc.php
index bdfbde1..3e31c2c 100644
--- a/include/lib_revcheck.inc.php
+++ b/include/lib_revcheck.inc.php
@@ -248,7 +248,9 @@ function showdiff ()
$c = $_GET['c'];
$cwd = getcwd();
chdir( GIT_DIR . 'en' );
- $file =
git diff {$h} -- {$gitfile};
+ $arg_h = escapeshellarg($h);
+ $arg_f = escapeshellarg($gitfile);
+ $file = git diff {$arg_h} -- {$arg_f};
chdir( $cwd );
$raw = htmlspecialchars( $file, ENT_XML1, 'UTF-8' );
if ( $c == 'on' ) {