treewide: filter shell arguments through shellquote() where applicable

[project/luci.git] / applications / luci-app-splash / luasrc / controller / splash / splash.lua

diff --git a/applications/luci-app-splash/luasrc/controller/splash/splash.lua b/applications/luci-app-splash/luasrc/controller/splash/splash.lua
index b4fdbd5..af7a3a3 100644 (file)
--- a/applications/luci-app-splash/luasrc/controller/splash/splash.lua
+++ b/applications/luci-app-splash/luasrc/controller/splash/splash.lua
@@ -9,7 +9,7 @@ function index()
        entry({"admin", "services", "splash", "splashtext" }, form("splash/splashtext"), _("Splashtext"), 10)
 
        local e
        entry({"admin", "services", "splash", "splashtext" }, form("splash/splashtext"), _("Splashtext"), 10)
 
        local e

-       
+

        e = node("splash")
        e.target = call("action_dispatch")
 
        e = node("splash")
        e.target = call("action_dispatch")
 


@@ -82,7 +82,7 @@ function action_activate()
                        end
                end)
 
                        end
                end)
 

-               if blacklisted then     
+               if blacklisted then

                        luci.http.redirect(luci.dispatcher.build_url("splash" ,"blocked"))
                else
                        local id = tostring(mac):gsub(':', ''):lower()
                        luci.http.redirect(luci.dispatcher.build_url("splash" ,"blocked"))
                else
                        local id = tostring(mac):gsub(':', ''):lower()


@@ -106,7 +106,7 @@ function action_status_admin()
        local uci = luci.model.uci.cursor_state()
        local macs = luci.http.formvaluetable("save")
 
        local uci = luci.model.uci.cursor_state()
        local macs = luci.http.formvaluetable("save")
 

-       local changes = { 
+       local changes = {

                whitelist = { },
                blacklist = { },
                lease     = { },
                whitelist = { },
                blacklist = { },
                lease     = { },


@@ -129,22 +129,22 @@ function action_status_admin()
 
        if #changes.whitelist > 0 then
                os.execute("luci-splash whitelist %s >/dev/null"
 
        if #changes.whitelist > 0 then
                os.execute("luci-splash whitelist %s >/dev/null"

-                       % table.concat(changes.whitelist))
+                       % util.shellquote(table.concat(changes.whitelist)))

        end
 
        if #changes.blacklist > 0 then
                os.execute("luci-splash blacklist %s >/dev/null"
        end
 
        if #changes.blacklist > 0 then
                os.execute("luci-splash blacklist %s >/dev/null"

-                       % table.concat(changes.blacklist))
+                       % util.shellquote(table.concat(changes.blacklist)))

        end
 
        if #changes.lease > 0 then
                os.execute("luci-splash lease %s >/dev/null"
        end
 
        if #changes.lease > 0 then
                os.execute("luci-splash lease %s >/dev/null"

-                       % table.concat(changes.lease))
+                       % util.shellquote(table.concat(changes.lease)))

        end
 
        if #changes.remove > 0 then
                os.execute("luci-splash remove %s >/dev/null"
        end
 
        if #changes.remove > 0 then
                os.execute("luci-splash remove %s >/dev/null"

-                       % table.concat(changes.remove))
+                       % util.shellquote(table.concat(changes.remove)))

        end
 
        luci.template.render("admin_status/splash", { is_admin = true })
        end
 
        luci.template.render("admin_status/splash", { is_admin = true })