#! /bin/sh /usr/share/dpatch/dpatch-run
## 12_metaInfo_remote_command.dpatch by  <camrdale@gmail.com>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Fix remote command execution vulnerability in metaInfo.php

@DPATCH@
diff -urNad torrentflux~/html/details.php torrentflux/html/details.php
--- torrentflux~/html/details.php	2006-11-03 01:10:36.000000000 -0800
+++ torrentflux/html/details.php	2006-12-09 12:27:17.000000000 -0800
@@ -29,7 +29,7 @@
 
 global $cfg;
 
-$torrent = getRequestVar('torrent');
+$torrent = SecurityClean(getRequestVar('torrent'));
 
 DisplayHead(_TORRENTDETAILS);
 
diff -urNad torrentflux~/html/metaInfo.php torrentflux/html/metaInfo.php
--- torrentflux~/html/metaInfo.php	2006-12-09 12:27:15.000000000 -0800
+++ torrentflux/html/metaInfo.php	2006-12-09 12:31:04.000000000 -0800
@@ -251,7 +251,7 @@
     }
     else
     {
-        $result = shell_exec("cd " . $cfg["torrent_file_path"]."; " . $cfg["pythonCmd"] . " -OO " . $cfg["btshowmetainfo"]." \"".$torrent."\"");
+        $result = shell_exec("cd " . $cfg["torrent_file_path"]."; " . $cfg["pythonCmd"] . " -OO " . $cfg["btshowmetainfo"]." ".escapeshellarg($torrent));
         echo "<pre>";
         echo htmlentities($result, ENT_QUOTES);
         echo "</pre>";
diff -urNad torrentflux~/html/startpop.php torrentflux/html/startpop.php
--- torrentflux~/html/startpop.php	2006-12-09 12:27:15.000000000 -0800
+++ torrentflux/html/startpop.php	2006-12-09 12:29:07.000000000 -0800
@@ -26,7 +26,7 @@
 include_once("functions.php");
 require_once("metaInfo.php");
 
-$torrent = getRequestVar('torrent');
+$torrent = SecurityClean(getRequestVar('torrent'));
 $displayName = $torrent;
 
 if (!file_exists($cfg["torrent_file_path"].$torrent))