summaryrefslogtreecommitdiff
path: root/includes
diff options
context:
space:
mode:
authorFelix Dörre <felix@dogcraft.de>2014-06-15 10:39:04 +0200
committerFelix Dörre <felix@dogcraft.de>2014-06-15 10:59:31 +0200
commitb6ee5404b9dcc3df6ace5f640f522118d18b818d (patch)
treeeae5a40733cde853c993588bee9a1420bbbc9b3d /includes
parent6d0f414854b2c1aa1da9ec49889ac9bb3b69b966 (diff)
downloadcacert-devel-b6ee5404b9dcc3df6ace5f640f522118d18b818d.tar.gz
cacert-devel-b6ee5404b9dcc3df6ace5f640f522118d18b818d.tar.xz
cacert-devel-b6ee5404b9dcc3df6ace5f640f522118d18b818d.zip
bug 1273: replace backtick operators with shell_exec
+ fix 1 missing escapeshellarg Commands used to locate: 1. find includes -type f -name '*.php' -exec cat {} \; \ | tr '\n' '?' | sed 's/\(\$query .\?= \|\ mysql_query(\|query_init (\)"\([^"]\|".\(\(intval\|mysql_real_escape_string\)\ (\$[^\$)]\+)\|\$_SESSION\(\['_config'\]\['user'\]\['Q[1-5]'\]\ \|['_config']['disablelogin']\)\)[ ?]*."\)*"/mysql-substitute/g'\ | tr '?' '\n' | grep --color=always "\`"|less -r and reviewing the queries by hand. This command replaces out strings obviously looking like sql_queries and then outputting al remaining backticks: starting with "$query = ,mysql_query, ..." and are only interrupted by "safe" calls: - mysql_real_escape_string - intval - pre_escaped session variables (This command may also be used for locating bad escaped sql_queries) 2. grep -r "\`\(grep\|/\|echo\|dig\|openssl\|gpg\|rm\|../\)" www includes pages \ | grep -v '\(from\|update\|into\) `gpg'
Diffstat (limited to 'includes')
-rw-r--r--includes/account.php34
-rw-r--r--includes/general.php8
2 files changed, 21 insertions, 21 deletions
diff --git a/includes/account.php b/includes/account.php
index b1ab984..0f2f05d 100644
--- a/includes/account.php
+++ b/includes/account.php
@@ -402,7 +402,7 @@ function buildSubjectFromSession() {
fclose($fp);
$challenge=$_SESSION['spkac_hash'];
$CSRname_esc = escapeshellarg($CSRname);
- $res=`openssl spkac -verify -in $CSRname_esc`;
+ $res=shell_exec("openssl spkac -verify -in $CSRname_esc");
if(!strstr($res,"Challenge String: ".$challenge))
{
$id = $oldid;
@@ -466,7 +466,7 @@ function buildSubjectFromSession() {
$tmpname = tempnam("/tmp", "id4csr");
$tmpfname_esc = escapeshellarg($tmpfname);
$tmpname_esc = escapeshellarg($tmpname);
- $do = `/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc`; // -subj "$csr"`;
+ $do = shell_exec("/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc"); // -subj "$csr";
@unlink($tmpfname);
$csr = "";
$fp = fopen($tmpname, "r");
@@ -570,7 +570,7 @@ function buildSubjectFromSession() {
$addy = array();
$adds = array();
if(strtolower(substr($newdom, -4, 3)) != ".jp")
- $adds = explode("\n", trim(`/usr/bin/whois $newdom|grep "@"`));
+ $adds = explode("\n", trim(shell_exec("/usr/bin/whois $newdom|grep \"@\"")));
if(substr($newdomain, -4) == ".org" || substr($newdomain, -5) == ".info")
{
if(is_array($adds))
@@ -740,8 +740,8 @@ function buildSubjectFromSession() {
fputs($fp, $CSR);
fclose($fp);
$CSR = escapeshellarg($_SESSION['_config']['tmpfname']);
- $_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in $CSR |tr -d "\\0"|grep "Subject:"`);
- $bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in $CSR |tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+ $_SESSION['_config']['subject'] = trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep \"Subject:\""));
+ $bits = explode(",", trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
foreach($bits as $val)
{
$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -911,8 +911,8 @@ function buildSubjectFromSession() {
$newfile=generatecertpath("csr","server",$newid);
copy($row['csr_name'], $newfile);
$newfile_esc = escapeshellarg($newfile);
- $_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d "\\0"|grep "Subject:"`);
- $bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+ $_SESSION['_config']['subject'] = trim(shell_exec("/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d \"\\0\"|grep \"Subject:\""));
+ $bits = explode(",", trim(shell_exec("/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
foreach($bits as $val)
{
$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -942,7 +942,7 @@ function buildSubjectFromSession() {
} else {
$drow = mysql_fetch_assoc($res);
$crt_name = escapeshellarg($drow['crt_name']);
- $cert = `/usr/bin/openssl x509 -in $crt_name`;
+ $cert = shell_exec("/usr/bin/openssl x509 -in $crt_name");
echo "<pre>\n$cert\n</pre>\n";
}
}
@@ -1559,7 +1559,7 @@ function buildSubjectFromSession() {
fclose($fp);
$challenge=$_SESSION['spkac_hash'];
$CSRname_esc = escapeshellarg($CSRname);
- $res=`openssl spkac -verify -in $CSRname_esc`;
+ $res=shell_exec("openssl spkac -verify -in $CSRname_esc");
if(!strstr($res,"Challenge String: ".$challenge))
{
$id = $oldid;
@@ -1613,7 +1613,7 @@ function buildSubjectFromSession() {
$tmpname = tempnam("/tmp", "id17csr");
$tmpfname_esc = escapeshellarg($tmpfname);
$tmpname_esc = escapeshellarg($tmpname);
- $do = `/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc`;
+ $do = shell_exec("/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc");
@unlink($tmpfname);
$csr = "";
$fp = fopen($tmpname, "r");
@@ -1867,8 +1867,8 @@ function buildSubjectFromSession() {
fputs($fp, $CSR);
fclose($fp);
$CSR = escapeshellarg($_SESSION['_config']['tmpfname']);
- $_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in $CSR |tr -d "\\0"|grep "Subject:"`);
- $bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in $CSR |tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+ $_SESSION['_config']['subject'] = trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep \"Subject:\""));
+ $bits = explode(",", trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
foreach($bits as $val)
{
$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -2091,7 +2091,7 @@ function buildSubjectFromSession() {
} else {
$drow = mysql_fetch_assoc($res);
$crtname = escapeshellarg($drow['crt_name']);
- $cert = `/usr/bin/openssl x509 -in $crtname`;
+ $cert = shell_exec("/usr/bin/openssl x509 -in $crtname");
echo "<pre>\n$cert\n</pre>\n";
}
}
@@ -2812,8 +2812,8 @@ function buildSubjectFromSession() {
{
$CSR = clean_csr($CSR);
$_SESSION['_config']['CSR'] = $CSR;
- $_SESSION['_config']['subject'] = trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep "Subject:"`);
- $bits = explode(",", trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+ $_SESSION['_config']['subject'] = trim(shell_exec("echo \"$CSR\"|/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep \"Subject:\""));
+ $bits = explode(",", trim(shell_exec("echo \"$CSR\"|/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
foreach($bits as $val)
{
$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -2837,8 +2837,8 @@ function buildSubjectFromSession() {
if($process != "" && $oldid == 46)
{
$CSR = clean_csr($_SESSION['_config']['CSR']);
- $_SESSION['_config']['subject'] = trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep "Subject:"`);
- $bits = explode(",", trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+ $_SESSION['_config']['subject'] = trim(shell_exec("echo \"$CSR\"|/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep \"Subject:\""));
+ $bits = explode(",", trim(shell_exec("echo \"$CSR\"|/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
foreach($bits as $val)
{
$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
diff --git a/includes/general.php b/includes/general.php
index 854aab4..02b559b 100644
--- a/includes/general.php
+++ b/includes/general.php
@@ -219,7 +219,7 @@
//echo "Points due to name matches: $points<br/>";
$shellpwd = escapeshellarg($pwd);
- $do = `grep -F -- $shellpwd /usr/share/dict/american-english`;
+ $do = shell_exec("grep -F -- $shellpwd /usr/share/dict/american-english");
if($do)
$points--;
@@ -527,7 +527,7 @@
$fp = fopen($tmpfname, "w");
fputs($fp, $message);
fclose($fp);
- $do = `/usr/bin/gpg --homedir /home/gpg --clearsign "$tmpfname"|/usr/sbin/sendmail "$to"`;
+ $do = shell_exec("/usr/bin/gpg --homedir /home/gpg --clearsign \"$tmpfname\"|/usr/sbin/sendmail ".escapeshellarg($to));
@unlink($tmpfname);
}
@@ -538,9 +538,9 @@
{
list($username,$domain)=explode('@',$email,2);
$dom = escapeshellarg($domain);
- $line = trim(`dig +short MX $dom 2>&1`);
+ $line = trim(shell_exec("dig +short MX $dom 2>&1"));
#echo $email."-$dom-$line-\n";
-#echo `dig +short mx heise.de 2>&1`."-<br>\n";
+#echo shell_exec("dig +short mx heise.de 2>&1")."-<br>\n";
$list = explode("\n", $line);
foreach($list as $row) {