From f73da9ca82ff8e0352c3942ea78ab7d1d0317668 Mon Sep 17 00:00:00 2001 From: Dirk Brenken Date: Sat, 29 Jun 2019 19:26:07 +0200 Subject: system-wide: fix escaping of magic chars * fix escaping of magic lua chars (#2800) * fix redundant second gsub line in shellstartsqescape function * fix return value of shellstartsqescape function Signed-off-by: Dirk Brenken --- modules/luci-base/luasrc/cbi/datatypes.lua | 2 +- modules/luci-base/luasrc/util.lua | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) (limited to 'modules') diff --git a/modules/luci-base/luasrc/cbi/datatypes.lua b/modules/luci-base/luasrc/cbi/datatypes.lua index 33d018d2d0..c1cf01f9cd 100644 --- a/modules/luci-base/luasrc/cbi/datatypes.lua +++ b/modules/luci-base/luasrc/cbi/datatypes.lua @@ -418,7 +418,7 @@ function maxlength(val, max) end function phonedigit(val) - return (val:match("^[0-9\*#!%.]+$") ~= nil) + return (val:match("^[0-9%*#!%.]+$") ~= nil) end function timehhmmss(val) diff --git a/modules/luci-base/luasrc/util.lua b/modules/luci-base/luasrc/util.lua index 1a329f3f20..a30e8b72f3 100644 --- a/modules/luci-base/luasrc/util.lua +++ b/modules/luci-base/luasrc/util.lua @@ -207,9 +207,8 @@ end -- handling. It may actually be a property of the getopt function -- rather than the shell proper. function shellstartsqescape(value) - res, _ = string.gsub(value, "^\-", "\\-") - res, _ = string.gsub(res, "^-", "\-") - return shellsqescape(value) + res, _ = string.gsub(value, "^%-", "\\-") + return shellsqescape(res) end -- containing the resulting substrings. The optional max parameter specifies -- cgit v1.2.3