aboutsummaryrefslogtreecommitdiffstats
path: root/plugins
diff options
context:
space:
mode:
authorTobias Mueller <tobiasmue@gnome.org>2009-11-04 08:09:27 +0800
committerTobias Mueller <tobiasmue@gnome.org>2009-11-06 03:00:31 +0800
commit8cff3c4e4cf078307c600bb5ce69f50912abdd63 (patch)
treedf6d662186dc6d60861758a40ba2b5797dba7b8f /plugins
parentc79efd6590bfabecd3a31c2a30d1ddb9a55349e4 (diff)
downloadgsoc2013-evolution-8cff3c4e4cf078307c600bb5ce69f50912abdd63.tar
gsoc2013-evolution-8cff3c4e4cf078307c600bb5ce69f50912abdd63.tar.gz
gsoc2013-evolution-8cff3c4e4cf078307c600bb5ce69f50912abdd63.tar.bz2
gsoc2013-evolution-8cff3c4e4cf078307c600bb5ce69f50912abdd63.tar.lz
gsoc2013-evolution-8cff3c4e4cf078307c600bb5ce69f50912abdd63.tar.xz
gsoc2013-evolution-8cff3c4e4cf078307c600bb5ce69f50912abdd63.tar.zst
gsoc2013-evolution-8cff3c4e4cf078307c600bb5ce69f50912abdd63.zip
Quote filename during restore to prevent user assisted arbitrary code execution
Fixes bug 540516.
Diffstat (limited to 'plugins')
-rw-r--r--plugins/backup-restore/backup-restore.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/plugins/backup-restore/backup-restore.c b/plugins/backup-restore/backup-restore.c
index 82309a787f..ed7401eb4c 100644
--- a/plugins/backup-restore/backup-restore.c
+++ b/plugins/backup-restore/backup-restore.c
@@ -73,10 +73,14 @@ sanity_check (const gchar *filename)
{
gchar *command;
gint result;
+ gchar *quotedfname;
- command = g_strdup_printf ("%s/evolution-backup --check %s", EVOLUTION_TOOLSDIR, filename);
+ quotedfname = g_shell_quote(filename);
+
+ command = g_strdup_printf ("%s/evolution-backup --check %s", EVOLUTION_TOOLSDIR, quotedfname);
result = system (command);
g_free (command);
+ g_free (quotedfname);
#ifdef HAVE_SYS_WAIT_H
g_message ("Sanity check result %d:%d %d", WIFEXITED (result), WEXITSTATUS (result), result);