treewide: filter shell arguments through shellquote() where applicable

[project/luci.git] / applications / luci-app-cshark / luasrc / controller / cshark.lua

diff --git a/applications/luci-app-cshark/luasrc/controller/cshark.lua b/applications/luci-app-cshark/luasrc/controller/cshark.lua
index 4d9bbba..43410a0 100644 (file)
--- a/applications/luci-app-cshark/luasrc/controller/cshark.lua
+++ b/applications/luci-app-cshark/luasrc/controller/cshark.lua
@@ -53,7 +53,13 @@ function cshark_iface_dump_start(ifname, value, flag, filter)
 
        luci.http.prepare_content("text/plain")
 
 
        luci.http.prepare_content("text/plain")
 

-       local res = os.execute("(/sbin/cshark -i " .. ifname .. " -" .. flag .. " " .. value .. " -p /tmp/cshark-luci.pid " .. filter .. " > /tmp/cshark-luci.out 2>&1) &")
+       local res = os.execute("(/sbin/cshark -i %s -%s %s -p /tmp/cshark-luci.pid %s > /tmp/cshark-luci.out 2>&1) &" %{
+               luci.util.shellquote(ifname),
+               luci.util.shellquote(flag),
+               luci.util.shellquote(value),
+               luci.util.shellquote(filter)
+       })
+

        luci.http.write(tostring(res))
 end
 
        luci.http.write(tostring(res))
 end