Merge pull request #11 from DoubleYo/master

add escapeshellarg to shell_exec file path
tonchik-tm · Jun 27, 2018 · 6bce319 · 6bce319
2 parents ec57b5e + ff211c0
commit 6bce319
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/Pdf.php b/src/Pdf.php
@@ -111,7 +111,7 @@ public function setOutputDir($dir)
      */
     private function setInfoObject()
     {
-        $content = shell_exec($this->getOptions('pdfinfo_path') . ' ' . $this->file);
+        $content = shell_exec($this->getOptions('pdfinfo_path') . ' ' . escapeshellarg($this->file));
         $options = explode("\n", $content);
         $info = [];
         foreach($options as &$item) {
@@ -185,7 +185,7 @@ public function getCommand() {
             $this->setOptions(['generate'=>['noFrames' => false]]);
         $output = $this->getOutputDir() . '/' . preg_replace("/\.pdf$/", '', basename($this->file)) . '.html';
         $options = $this->generateOptions();
-        $command = $this->getOptions('pdftohtml_path') . ' ' . $options . ' ' . $this->file . ' ' . $output;
+        $command = $this->getOptions('pdftohtml_path') . ' ' . $options . ' ' . escapeshellarg($this->file) . ' ' . escapeshellarg($output);
         return $command;
     }