bug 1273: replace backtick operators with shell_exec

+ fix 1 missing escapeshellarg
Commands used to locate:
1.
find includes -type f -name '*.php' -exec cat {} \; \
| tr '\n' '?' | sed 's/\(\$query .\?= \|\
mysql_query(\|query_init (\)"\([^"]\|".\(\(intval\|mysql_real_escape_string\)\
(\$[^\$)]\+)\|\$_SESSION\(\['_config'\]\['user'\]\['Q[1-5]'\]\
\|['_config']['disablelogin']\)\)[ ?]*."\)*"/mysql-substitute/g'\
| tr '?' '\n' |  grep --color=always "\`"|less -r

and reviewing the queries by hand.

This command replaces out strings obviously looking
like sql_queries and then outputting al remaining backticks:

starting with "$query = ,mysql_query, ..."
and are only interrupted by "safe" calls:
- mysql_real_escape_string
- intval
- pre_escaped session variables

(This command may also be used for locating
 bad escaped sql_queries)

2. grep -r "\`\(grep\|/\|echo\|dig\|openssl\|gpg\|rm\|../\)" www includes pages \
| grep -v '\(from\|update\|into\) `gpg'

2 files changed, 21 insertions, 21 deletions

diff --git a/includes/account.php b/includes/account.php
index b1ab984..0f2f05d 100644
--- a/includes/account.php
+++ b/includes/account.php
@@ -402,7 +402,7 @@ function buildSubjectFromSession() {
 			fclose($fp);
 			$challenge=$_SESSION['spkac_hash'];
 			$CSRname_esc = escapeshellarg($CSRname);
-			$res=`openssl spkac -verify -in $CSRname_esc`;
+			$res=shell_exec("openssl spkac -verify -in $CSRname_esc");
 			if(!strstr($res,"Challenge String: ".$challenge))
 			{
 				$id = $oldid;
@@ -466,7 +466,7 @@ function buildSubjectFromSession() {
 			$tmpname = tempnam("/tmp", "id4csr");
 			$tmpfname_esc = escapeshellarg($tmpfname);
 			$tmpname_esc = escapeshellarg($tmpname);
-			$do = `/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc`; // -subj "$csr"`;
+			$do = shell_exec("/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc"); // -subj "$csr";
 			@unlink($tmpfname);
 			$csr = "";
 			$fp = fopen($tmpname, "r");
@@ -570,7 +570,7 @@ function buildSubjectFromSession() {
 		$addy = array();
 		$adds = array();
 		if(strtolower(substr($newdom, -4, 3)) != ".jp")
-			$adds = explode("\n", trim(`/usr/bin/whois $newdom|grep "@"`));
+			$adds = explode("\n", trim(shell_exec("/usr/bin/whois $newdom|grep \"@\"")));
 		if(substr($newdomain, -4) == ".org" || substr($newdomain, -5) == ".info")
 		{
 			if(is_array($adds))
@@ -740,8 +740,8 @@ function buildSubjectFromSession() {
 		fputs($fp, $CSR);
 		fclose($fp);
 		$CSR = escapeshellarg($_SESSION['_config']['tmpfname']);
-		$_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in $CSR |tr -d "\\0"|grep "Subject:"`);
-		$bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in $CSR |tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+		$_SESSION['_config']['subject'] = trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep \"Subject:\""));
+		$bits = explode(",", trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
 		foreach($bits as $val)
 		{
 			$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -911,8 +911,8 @@ function buildSubjectFromSession() {
 				$newfile=generatecertpath("csr","server",$newid);
 				copy($row['csr_name'], $newfile);
 				$newfile_esc = escapeshellarg($newfile);
-				$_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d "\\0"|grep "Subject:"`);
-				$bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+				$_SESSION['_config']['subject'] = trim(shell_exec("/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d \"\\0\"|grep \"Subject:\""));
+				$bits = explode(",", trim(shell_exec("/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
 				foreach($bits as $val)
 				{
 					$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -942,7 +942,7 @@ function buildSubjectFromSession() {
 				} else {
 					$drow = mysql_fetch_assoc($res);
 					$crt_name = escapeshellarg($drow['crt_name']);
-					$cert = `/usr/bin/openssl x509 -in $crt_name`;
+					$cert = shell_exec("/usr/bin/openssl x509 -in $crt_name");
 					echo "<pre>\n$cert\n</pre>\n";
 				}
 			}
@@ -1559,7 +1559,7 @@ function buildSubjectFromSession() {
 			fclose($fp);
 			$challenge=$_SESSION['spkac_hash'];
 			$CSRname_esc = escapeshellarg($CSRname);
-			$res=`openssl spkac -verify -in $CSRname_esc`;
+			$res=shell_exec("openssl spkac -verify -in $CSRname_esc");
 			if(!strstr($res,"Challenge String: ".$challenge))
 			{
 				$id = $oldid;
@@ -1613,7 +1613,7 @@ function buildSubjectFromSession() {
 			$tmpname = tempnam("/tmp", "id17csr");
 			$tmpfname_esc = escapeshellarg($tmpfname);
 			$tmpname_esc = escapeshellarg($tmpname);
-			$do = `/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc`;
+			$do = shell_exec("/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc");
 			@unlink($tmpfname);
 			$csr = "";
 			$fp = fopen($tmpname, "r");
@@ -1867,8 +1867,8 @@ function buildSubjectFromSession() {
 		fputs($fp, $CSR);
 		fclose($fp);
 		$CSR = escapeshellarg($_SESSION['_config']['tmpfname']);
-		$_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in $CSR |tr -d "\\0"|grep "Subject:"`);
-		$bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in $CSR |tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+		$_SESSION['_config']['subject'] = trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep \"Subject:\""));
+		$bits = explode(",", trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
 		foreach($bits as $val)
 		{
 			$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -2091,7 +2091,7 @@ function buildSubjectFromSession() {
 				} else {
 					$drow = mysql_fetch_assoc($res);
 					$crtname = escapeshellarg($drow['crt_name']);
-					$cert = `/usr/bin/openssl x509 -in $crtname`;
+					$cert = shell_exec("/usr/bin/openssl x509 -in $crtname");
 					echo "<pre>\n$cert\n</pre>\n";
 				}
 			}
@@ -2812,8 +2812,8 @@ function buildSubjectFromSession() {
 	{
 		$CSR = clean_csr($CSR);
 		$_SESSION['_config']['CSR'] = $CSR;
-		$_SESSION['_config']['subject'] = trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep "Subject:"`);
-		$bits = explode(",", trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+		$_SESSION['_config']['subject'] = trim(shell_exec("echo \"$CSR\"|/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep \"Subject:\""));
+		$bits = explode(",", trim(shell_exec("echo \"$CSR\"|/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
 		foreach($bits as $val)
 		{
 			$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -2837,8 +2837,8 @@ function buildSubjectFromSession() {
 	if($process != "" && $oldid == 46)
 	{
 		$CSR = clean_csr($_SESSION['_config']['CSR']);
-		$_SESSION['_config']['subject'] = trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep "Subject:"`);
-		$bits = explode(",", trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+		$_SESSION['_config']['subject'] = trim(shell_exec("echo \"$CSR\"|/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep \"Subject:\""));
+		$bits = explode(",", trim(shell_exec("echo \"$CSR\"|/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
 		foreach($bits as $val)
 		{
 			$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
diff --git a/includes/general.php b/includes/general.php
index 854aab4..02b559b 100644
--- a/includes/general.php
+++ b/includes/general.php
@@ -219,7 +219,7 @@
 		//echo "Points due to name matches: $points<br/>";
 
 		$shellpwd = escapeshellarg($pwd);
-		$do = `grep -F -- $shellpwd /usr/share/dict/american-english`;
+		$do = shell_exec("grep -F -- $shellpwd /usr/share/dict/american-english");
 		if($do)
 			$points--;
 
@@ -527,7 +527,7 @@
 		$fp = fopen($tmpfname, "w");
 		fputs($fp, $message);
 		fclose($fp);
-		$do = `/usr/bin/gpg --homedir /home/gpg --clearsign "$tmpfname"|/usr/sbin/sendmail "$to"`;
+		$do = shell_exec("/usr/bin/gpg --homedir /home/gpg --clearsign \"$tmpfname\"|/usr/sbin/sendmail ".escapeshellarg($to));
 		@unlink($tmpfname);
 	}
 
@@ -538,9 +538,9 @@
 		{
 			list($username,$domain)=explode('@',$email,2);
 			$dom = escapeshellarg($domain);
-			$line = trim(`dig +short MX $dom 2>&1`);
+			$line = trim(shell_exec("dig +short MX $dom 2>&1"));
 #echo $email."-$dom-$line-\n";
-#echo `dig +short mx heise.de 2>&1`."-<br>\n";
+#echo shell_exec("dig +short mx heise.de 2>&1")."-<br>\n";
 
 			$list = explode("\n", $line);
 			foreach($list as $row) {