From a65b09f05191ea24e80c6a3d7ea85deb573c13f1 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Wed, 25 Apr 2018 11:15:46 +0200
Subject: [PATCH] mvc: this looks unsafe, adapt to what exec_safe() is doing

---
 .../mvc/app/library/OPNsense/Core/Backend.php       | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/opnsense/mvc/app/library/OPNsense/Core/Backend.php b/src/opnsense/mvc/app/library/OPNsense/Core/Backend.php
index a8a669f49..a4d489ef1 100644
--- a/src/opnsense/mvc/app/library/OPNsense/Core/Backend.php
+++ b/src/opnsense/mvc/app/library/OPNsense/Core/Backend.php
@@ -1,8 +1,7 @@
 <?php
 
-/**
+/*
  *    Copyright (C) 2015 Deciso B.V.
- *
  *    All rights reserved.
  *
  *    Redistribution and use in source and binary forms, with or without
@@ -25,8 +24,8 @@
  *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  *    POSSIBILITY OF SUCH DAMAGE.
- *
  */
+
 namespace OPNsense\Core;
 
 use Phalcon\Logger\Adapter\Syslog;
@@ -142,9 +141,13 @@ class Backend
      */
     public function configdpRun($event, $params = array(), $detach = false, $timeout = 120)
     {
+        if (!is_array($params)) {
+           /* just in case there's only one parameter */
+           $params = array($params);
+        }
+
         foreach ($params as $param) {
-            // quote parameters
-            $event .= ' "' . str_replace('"', '\\"', $param) . '"';
+            $event .= ' ' . escapeshellarg($param);
         }
 
         return $this->configdRun($event, $detach, $timeout);