* Port [3139] to 1.2.13

 * Fix security hole in all shell cmds. (fixes #321)


svn: 3140

doc/UPDATES

@@ -8,6 +8,7 @@ Lines prefixed with '-' were disabled before release and are not finished, or ar
 * Fix set not allowing defaults under the lower limit. (addresses #315)
 * For ./binary -C prefer environment variable EDITOR over VISUAL.
 * Fix ./binary -C not signalling the correct process under some situations. (fixes #315)
+* Fix security hole in all shell cmds. (fixes #321)
 
 1.2.12 - http://wraith.shatow.net/milestone/1.2.12
 * Clearing a variable via 'set var -' now resets that variable to default settings. (implements #111)

src/cmds.c

@@ -2649,9 +2649,9 @@ static void cmd_ps(int idx, char *par) {
     return;
   }
 
-  if (strchr(par, '|') || strchr(par, '<') || strchr(par, ';') || strchr(par, '>')) {
+  if (strchr(par, '|') || strchr(par, '<') || strchr(par, ';') || strchr(par, '>') || strchr(par, '`')) {
     putlog(LOG_WARN, "*", "%s attempted 'ps' with pipe/semicolon in parameters: %s", dcc[idx].nick, par);
-    dprintf(idx, "No.");
+    dprintf(idx, "No.\n");
     return;
   }
 
@@ -2666,9 +2666,9 @@ static void cmd_ps(int idx, char *par) {
 
 static void cmd_last(int idx, char *par) {
   putlog(LOG_CMDS, "*", "#%s# last %s", dcc[idx].nick, par);
-  if (strchr(par, '|') || strchr(par, '<') || strchr(par, ';') || strchr(par, '>')) {
+  if (strchr(par, '|') || strchr(par, '<') || strchr(par, ';') || strchr(par, '>') || strchr(par, '`')) {
     putlog(LOG_WARN, "*", "%s attempted 'last' with pipe/semicolon in parameters: %s", dcc[idx].nick, par);
-    dprintf(idx, "No.");
+    dprintf(idx, "No.\n");
     return;
   }
 
@@ -3814,9 +3814,9 @@ static void cmd_netps(int idx, char * par) {
     return;
   }
 
-  if (strchr(par, '|') || strchr(par, '<') || strchr(par, ';') || strchr(par, '>')) {
+  if (strchr(par, '|') || strchr(par, '<') || strchr(par, ';') || strchr(par, '>') || strchr(par, '`')) {
     putlog(LOG_WARN, "*", "%s attempted 'netps' with pipe/semicolon in parameters: %s", dcc[idx].nick, par);
-    dprintf(idx, "No.");
+    dprintf(idx, "No.\n");
     return;
   }
 
@@ -3834,9 +3834,9 @@ static void cmd_netlast(int idx, char * par) {
     return;
   }
 
-  if (strchr(par, '|') || strchr(par, '<') || strchr(par, ';') || strchr(par, '>')) {
+  if (strchr(par, '|') || strchr(par, '<') || strchr(par, ';') || strchr(par, '>') || strchr(par, '`')) {
     putlog(LOG_WARN, "*", "%s attempted 'netlast' with pipe/semicolon in parameters: %s", dcc[idx].nick, par);
-    dprintf(idx, "No.");
+    dprintf(idx, "No.\n");
     return;
   }