cacti-addslashes-0.8.7g.patch

Index: lib/utility.php
===================================================================
--- lib/utility.php	(revision 7436)
+++ lib/utility.php	(working copy)
@@ -113,7 +113,7 @@
 				$data_source_item_name = "";
 			}
 
-			api_poller_cache_item_add($data_source["host_id"], array(), $local_data_id, $data_input["rrd_step"], $action, $data_source_item_name, 1, addslashes($script_path));
+			api_poller_cache_item_add($data_source["host_id"], array(), $local_data_id, $data_input["rrd_step"], $action, $data_source_item_name, 1, $script_path);
 		}else if ($data_input["type_id"] == DATA_INPUT_TYPE_SNMP) { /* snmp */
 			$host_fields = array_rekey(db_fetch_assoc("select
 				data_input_fields.type_code,
@@ -167,17 +167,22 @@
 						if (($data_input["type_id"] == DATA_INPUT_TYPE_QUERY_SCRIPT_SERVER) && (function_exists("proc_open"))) {
 							$action = POLLER_ACTION_SCRIPT_PHP;
 							$script_path = get_script_query_path((isset($script_queries["arg_prepend"]) ? $script_queries["arg_prepend"] : "") . " " . $script_queries["arg_get"] . " " . $identifier . " " . $data_source["snmp_index"], $script_queries["script_path"] . " " . $script_queries["script_function"], $data_source["host_id"]);
+							$script_path = addslashes($script_path);
 						}else if (($data_input["type_id"] == DATA_INPUT_TYPE_QUERY_SCRIPT_SERVER) && (!function_exists("proc_open"))) {
 							$action = POLLER_ACTION_SCRIPT;
 							$script_path = read_config_option("path_php_binary") . " -q " . get_script_query_path((isset($script_queries["arg_prepend"]) ? $script_queries["arg_prepend"] : "") . " " . $script_queries["arg_get"] . " " . $identifier . " " . $data_source["snmp_index"], $script_queries["script_path"], $data_source["host_id"]);
+							$script_path = addslashes($script_path);
 						}else{
 							$action = POLLER_ACTION_SCRIPT;
-							$script_path = get_script_query_path((isset($script_queries["arg_prepend"]) ? $script_queries["arg_prepend"] : "") . " " . $script_queries["arg_get"] . " " . $identifier . " " . $data_source["snmp_index"], $script_queries["script_path"], $data_source["host_id"]);
+							# I don't know why addslashes is used at all, but it's definitely *not* what
+							# we need for building command-line arguments, get_full_script_path uses 
+							# escapeshellarg for that for us
+							$script_path = get_script_query_path((isset($script_queries["arg_prepend"]) ? $script_queries["arg_prepend"] : "") . " " . $script_queries["arg_get"] . " " . $identifier . " " . $data_source["snmp_index"], addslashes($script_queries["script_path"]), $data_source["host_id"]);
 						}
 					}
 
 					if (isset($script_path)) {
-						api_poller_cache_item_add($data_source["host_id"], array(), $local_data_id, $data_input["rrd_step"], $action, get_data_source_item_name($output["data_template_rrd_id"]), sizeof($outputs), addslashes($script_path));
+						api_poller_cache_item_add($data_source["host_id"], array(), $local_data_id, $data_input["rrd_step"], $action, get_data_source_item_name($output["data_template_rrd_id"]), sizeof($outputs), $script_path);
 					}
 				}
 			}
Index: lib/functions.php
===================================================================
--- lib/functions.php	(revision 7436)
+++ lib/functions.php	(working copy)
@@ -1002,7 +1002,7 @@
 
 	if (sizeof($data) > 0) {
 	foreach ($data as $item) {
-		$full_path = str_replace("<" . $item["data_name"] . ">", $item["value"], $full_path);
+		$full_path = str_replace("<" . $item["data_name"] . ">", escapeshellarg($item["value"]), $full_path);
 	}
 	}