treewide: filter shell arguments through shellquote() where applicable

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

1 files changed, 3 insertions, 7 deletions

diff --git a/applications/luci-app-statistics/luasrc/statistics/rrdtool.lua b/applications/luci-app-statistics/luasrc/statistics/rrdtool.lua
index e29a2e17d..47e1696ec 100644
--- a/applications/luci-app-statistics/luasrc/statistics/rrdtool.lua
+++ b/applications/luci-app-statistics/luasrc/statistics/rrdtool.lua
@@ -87,7 +87,7 @@ function Graph._rrdtool( self, def, rrd )
 	fs.mkdirr( dir )
 
 	-- construct commandline
-	local cmdline = "rrdtool graph"
+	local cmdline = { "rrdtool", "graph" }
 
 	-- copy default arguments to def stack
 	for i, opt in ipairs(self.args) do
@@ -102,15 +102,11 @@ function Graph._rrdtool( self, def, rrd )
 			opt = opt:gsub( "{file}", rrd )
 		end
 
-		if opt:match("[^%w]") then
-			cmdline = cmdline .. " '" .. opt .. "'"
-		else
-			cmdline = cmdline .. " " .. opt
-		end
+		cmdline[#cmdline+1] = luci.util.shellquote(opt)
 	end
 
 	-- execute rrdtool
-	local rrdtool = io.popen( cmdline )
+	local rrdtool = io.popen(table.concat(cmdline, " "))
 	rrdtool:close()
 end