treewide: filter shell arguments through shellquote() where applicable

[project/luci.git] / applications / luci-app-statistics / luasrc / statistics / rrdtool.lua

diff --git a/applications/luci-app-statistics/luasrc/statistics/rrdtool.lua b/applications/luci-app-statistics/luasrc/statistics/rrdtool.lua
index e29a2e1..47e1696 100644 (file)
--- a/applications/luci-app-statistics/luasrc/statistics/rrdtool.lua
+++ b/applications/luci-app-statistics/luasrc/statistics/rrdtool.lua
@@ -87,7 +87,7 @@ function Graph._rrdtool( self, def, rrd )
        fs.mkdirr( dir )
 
        -- construct commandline
-       local cmdline = "rrdtool graph"
+       local cmdline = { "rrdtool", "graph" }
 
        -- copy default arguments to def stack
        for i, opt in ipairs(self.args) do
@@ -102,15 +102,11 @@ function Graph._rrdtool( self, def, rrd )
                        opt = opt:gsub( "{file}", rrd )
                end
 
-               if opt:match("[^%w]") then
-                       cmdline = cmdline .. " '" .. opt .. "'"
-               else
-                       cmdline = cmdline .. " " .. opt
-               end
+               cmdline[#cmdline+1] = luci.util.shellquote(opt)
        end
 
        -- execute rrdtool
-       local rrdtool = io.popen( cmdline )
+       local rrdtool = io.popen(table.concat(cmdline, " "))
        rrdtool:close()
 end