Escaping shell arguments

Codiad · Jul 25, 2017 · b3645b4 · b3645b4
1 parent 4e47aa9
commit b3645b4
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/components/filemanager/class.filemanager.php b/components/filemanager/class.filemanager.php
@@ -57,7 +57,7 @@ public function __construct($get, $post, $files)
             $this->rel_path .= "/";
         }
         if (!empty($get['query'])) {
-            $this->query = $get['query'];
+            $this->query = escapeshellarg($get['query']);
         }
         if (!empty($get['options'])) {
             $this->foptions = $get['options'];
@@ -71,10 +71,10 @@ public function __construct($get, $post, $files)
         }
         // Search
         if (!empty($post['search_string'])) {
-            $this->search_string = $post['search_string'];
+            $this->search_string = escapeshellarg($post['search_string']);
         }
         if (!empty($post['search_file_type'])) {
-            $this->search_file_type = $post['search_file_type'];
+            $this->search_file_type = escapeshellarg($post['search_file_type']);
         }
         // Create
         if (!empty($get['type'])) {