slackbuilds_ponce/network/newsbeuter/newsbeuter-2.9-cve-2017-14500-fix.patch
Benjamin Trigona-Harany 53c4653df2 network/newsbeuter: Patch remote code execution vulnerability.
Signed-off-by: Benjamin Trigona-Harany <bosth@alumni.sfu.ca>
2017-09-17 05:38:25 -07:00

30 lines
1 KiB
Diff

diff --git a/src/pb_controller.cpp b/src/pb_controller.cpp
index 09b5e897..213216cd 100644
--- a/src/pb_controller.cpp
+++ b/src/pb_controller.cpp
@@ -306,9 +306,9 @@ void pb_controller::play_file(const std::string& file) {
if (player == "")
return;
cmdline.append(player);
- cmdline.append(" \"");
- cmdline.append(utils::replace_all(file,"\"", "\\\""));
- cmdline.append("\"");
+ cmdline.append(" \'");
+ cmdline.append(utils::replace_all(file,"'", "%27"));
+ cmdline.append("\'");
stfl::reset();
LOG(LOG_DEBUG, "pb_controller::play_file: running `%s'", cmdline.c_str());
::system(cmdline.c_str());
diff --git a/src/queueloader.cpp b/src/queueloader.cpp
index c1dabdd8..ae725e04 100644
--- a/src/queueloader.cpp
+++ b/src/queueloader.cpp
@@ -130,7 +130,7 @@ std::string queueloader::get_filename(const std::string& str) {
strftime(lbuf, sizeof(lbuf), "%Y-%b-%d-%H%M%S.unknown", localtime(&t));
fn.append(lbuf);
} else {
- fn.append(base);
+ fn.append(utils::replace_all(base, "'", "%27"));
}
return fn;
}