made calls to FFMPEG a bit safer #33

added beta version of new Poodll Audio Player
justinhunt · May 26, 2020 · 1cce07d · 1cce07d
1 parent 30394a0
commit 1cce07d
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 4 deletions.
diff --git a/CHANGES.txt b/CHANGES.txt
@@ -1,5 +1,9 @@
 Change List
 =========
+Version 3.1.31 (Build 2020052600)
+-made FFMPEG calls a little safer
+-added beta version of Poodll Audio Player
+
 Version 3.1.30 (Build 2020052000)
 -Added support for audio/x-m4a mimetype
 -Added multipart uploader (experimental)

diff --git a/classes/poodlltools.php b/classes/poodlltools.php
@@ -1163,7 +1163,7 @@ public static function get_splash_ffmpeg($videofile, $newfilename) {
 
         //branch logic if windows
         $iswindows = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN');
-        $command = $ffmpegpath . " -i " . $tempvideofilepath . " " . $ffmpegopts . " " . $tempsplashfilepath;
+        $command = $ffmpegpath . " -i " . escapeshellarg($tempvideofilepath) . " " . escapeshellcmd($ffmpegopts) . " " . escapeshellarg($tempsplashfilepath);
 
         if ($iswindows) {
             $output = system($command, $fv);
@@ -1287,7 +1287,7 @@ public static function convert_with_ffmpeg($filerecord, $tempfilename, $convfile
 
         //branch logic depending on if windows or nopt
         $iswindows = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN');
-        $command = $ffmpegpath . " -i " . $tempdir . $tempfilename . " " . $ffmpegopts . " " . $tempdir . $convfilename;
+        $command = $ffmpegpath . " -i " . escapeshellarg($tempdir . $tempfilename) . " " . escapeshellcmd($ffmpegopts) . " " . escapeshellarg($tempdir . $convfilename);
 
         if ($iswindows) {
             $output = system($command, $fv);

diff --git a/version.php b/version.php
@@ -25,9 +25,9 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version = 2020052000;
+$plugin->version = 2020052600;
 $plugin->requires = 2016052300;//moodle 3.1.0
 $plugin->component = 'filter_poodll';
 $plugin->maturity = MATURITY_STABLE;
-$plugin->release = '3.1.30(Build 2020052000)';
+$plugin->release = '3.1.31 (Build 2020052600)';