summaryrefslogtreecommitdiffstats
path: root/system/libraries
diff options
context:
space:
mode:
authorAndrey Andreev <narf@devilix.net>2016-03-22 10:31:58 +0100
committerAndrey Andreev <narf@devilix.net>2016-03-22 10:31:58 +0100
commitb3f6934cb870f2da9c9891968e6f4d98effa741e (patch)
treea5b73d5949a1fa67f9cf3749b7b032efcb020ae2 /system/libraries
parenteac4adfc24d1ad60af2bc3e08222ee7e5858f638 (diff)
[ci skip] Escape image paths passed as shell arguments to imagemagick
Diffstat (limited to 'system/libraries')
-rw-r--r--system/libraries/Image_lib.php15
1 files changed, 8 insertions, 7 deletions
diff --git a/system/libraries/Image_lib.php b/system/libraries/Image_lib.php
index edd13372d..24fe8c68d 100644
--- a/system/libraries/Image_lib.php
+++ b/system/libraries/Image_lib.php
@@ -866,27 +866,28 @@ class CI_Image_lib {
if ($action === 'crop')
{
- $cmd .= ' -crop '.$this->width.'x'.$this->height.'+'.$this->x_axis.'+'.$this->y_axis.' "'.$this->full_src_path.'" "'.$this->full_dst_path .'" 2>&1';
+ $cmd .= ' -crop '.$this->width.'x'.$this->height.'+'.$this->x_axis.'+'.$this->y_axis;
}
elseif ($action === 'rotate')
{
- $angle = ($this->rotation_angle === 'hor' OR $this->rotation_angle === 'vrt')
- ? '-flop' : '-rotate '.$this->rotation_angle;
-
- $cmd .= ' '.$angle.' "'.$this->full_src_path.'" "'.$this->full_dst_path.'" 2>&1';
+ $cmd .= ($this->rotation_angle === 'hor' OR $this->rotation_angle === 'vrt')
+ ? ' -flop'
+ : ' -rotate '.$this->rotation_angle;
}
else // Resize
{
if($this->maintain_ratio === TRUE)
{
- $cmd .= ' -resize '.$this->width.'x'.$this->height.' "'.$this->full_src_path.'" "'.$this->full_dst_path.'" 2>&1';
+ $cmd .= ' -resize '.$this->width.'x'.$this->height;
}
else
{
- $cmd .= ' -resize '.$this->width.'x'.$this->height.'\! "'.$this->full_src_path.'" "'.$this->full_dst_path.'" 2>&1';
+ $cmd .= ' -resize '.$this->width.'x'.$this->height.'\!';
}
}
+ $cmd .= ' "'.escapeshellarg($this->full_src_path).'" "'.escapeshellarg($this->full_dst_path).'" 2>&1';
+
$retval = 1;
// exec() might be disabled
if (function_usable('exec'))