Fixing command injection vulnerability

[0xTHMS]

Password field was vulnerable to command injection

[camlafit]

Hi Thanks for your PR. * Looks better with an unique sed and -e argument * can you provide a sample as vulnerability, with some should be great Thanks again

[0xTHMS]

Hi.

• I put everything under the same sed -e
• To trigger the injection, one could set his password to $(touch /tmp/vulnvuln) to trigger the vulnerabily.

Regards,

[fufroma]

Why not mysqli_real_escape_string?

[drousseau]

@fufroma Currently mysqli_real_escape_string() is not used anywhere in AlternC

You may propose a global patch to replace addslashes() by mysqli_real_escape_string() :o)

[fufroma]

Because previously we were lazy doesn't mean we should continue this way ^^

[camlafit]

HI

Do you solve #5 ?

[lelutin]

@camlafit the code seems to attempt fixing #1, #3, and #5
it looks like it might be a better attempt than what @fser and I already tried for #1. we'll have to test that the resulting code actually fixes the vulnerabilities. if it does, it should be merged ASAP since the security vulnerabilities have been open for many months already :|

[camlafit]

Hi

In review code I see you normalize also su/sudo use. Should be better to set it as specific commit can you improve this.
I know it's annoying but if we can do a PR readable why not :p

When you've do check/test about this we can merge it :) @vincib ? @albancrommer ?

[vincib]

shell issue not applicable (you have an old update_mailman.sh, that may be vulnerable)
and cocoadaemon fixed the sql by using PDO / Prepare