treewide: filter shell arguments through shellquote() where applicable

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

2 files changed, 3 insertions, 2 deletions

diff --git a/modules/luci-mod-admin-full/luasrc/model/cbi/admin_network/vlan.lua b/modules/luci-mod-admin-full/luasrc/model/cbi/admin_network/vlan.lua
index 89a73a5ca8..b52dff13ac 100644
--- a/modules/luci-mod-admin-full/luasrc/model/cbi/admin_network/vlan.lua
+++ b/modules/luci-mod-admin-full/luasrc/model/cbi/admin_network/vlan.lua
@@ -5,6 +5,7 @@
 m = Map("network", translate("Switch"), translate("The network ports on this device can be combined to several <abbr title=\"Virtual Local Area Network\">VLAN</abbr>s in which computers can communicate directly with each other. <abbr title=\"Virtual Local Area Network\">VLAN</abbr>s are often used to separate different network segments. Often there is by default one Uplink port for a connection to the next greater network like the internet and other ports for a local network."))
 
 local fs = require "nixio.fs"
+local ut = require "luci.util"
 local nw = require "luci.model.network"
 local switches = { }
 
@@ -74,7 +75,7 @@ m.uci:foreach("network", "switch",
 		end
 
 		-- Parse some common switch properties from swconfig help output.
-		local swc = io.popen("swconfig dev %q help 2>/dev/null" % switch_name)
+		local swc = io.popen("swconfig dev %s help 2>/dev/null" % ut.shellquote(switch_name))
 		if swc then
 
 			local is_port_attr = false
diff --git a/modules/luci-mod-admin-full/luasrc/model/cbi/admin_network/wifi.lua b/modules/luci-mod-admin-full/luasrc/model/cbi/admin_network/wifi.lua
index c0bb380307..a574d35979 100644
--- a/modules/luci-mod-admin-full/luasrc/model/cbi/admin_network/wifi.lua
+++ b/modules/luci-mod-admin-full/luasrc/model/cbi/admin_network/wifi.lua
@@ -63,7 +63,7 @@ function m.parse(map)
 	Map.parse(map)
 
 	if m:get(wdev:name(), "type") == "mac80211" and new_cc and new_cc ~= old_cc then
-		luci.sys.call("iw reg set %q" % new_cc)
+		luci.sys.call("iw reg set %s" % ut.shellquote(new_cc))
 		luci.http.redirect(luci.dispatcher.build_url("admin/network/wireless", arg[1]))
 		return
 	end