Escape MaxMind database file wget command

mailwatch · Jan 24, 2024 · 2ff5e1e · 2ff5e1e
1 parent 27cb35c
commit 2ff5e1e
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,7 @@
 - Validate on new exim id format (#1294)
 - Permit + and = chars in email for sendmail (#1291)
 - Fix Message Listing on Mysql 8+ (#1295)
+- Fix MaxMind database download when curl extension is not available (#1297)
 
 ## 1.2.21
 ### Improvements

diff --git a/mailscanner/geoip_update.php b/mailscanner/geoip_update.php
@@ -137,11 +137,13 @@
                     }
                 }
 
-                exec(
-                    'wget ' . $proxyString . ' -N ' . $files_base_url . $file['path'] . ' -O ' . $file['destination'],
+                $command = escapeshellcmd('wget ' . $proxyString . ' -N ' . $files_base_url . $file['path'] . ' -O ' . $file['destination']);
+                $result = exec(
+                    $command,
                     $output_wget,
                     $retval_wget
                 );
+
                 if ($retval_wget > 0) {
                     echo __('downbad15') . ' ' . $file['description'] . "<br>\n";
                 } else {

diff --git a/tools/Cron_jobs/mailwatch_geoip_update.php b/tools/Cron_jobs/mailwatch_geoip_update.php
@@ -133,8 +133,9 @@
         }
     }
 
+    $command = escapeshellcmd('wget ' . $proxyString . ' -N ' . $files_base_url . $file['path'] . ' -O ' . $file['destination']);
     exec(
-        'wget ' . $proxyString . ' -N ' . $files_base_url . $file['path'] . ' -O ' . $file['destination'],
+        $command,
         $output_wget,
         $retval_wget
     );