Isaac Connor 7592fd933c Fix command injection vulnerability in image.php (CVE-2025-65791) ...

Add input validation and shell argument escaping to prevent OS command
injection via the 'show' parameter in web/views/image.php. The parameter
is now validated against an allowlist and all values passed to exec()
are wrapped with escapeshellarg().

Also fix PHP operator precedence bug in shutdown.php where 'and' was
used instead of '&&', causing the 'when' parameter validation to not
work as intended.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-02-03 16:39:38 -05:00

..

archive.php

Allow snapshot downloading

2021-08-18 10:53:59 -04:00

download.php

Fix variable name (download.php)

2026-01-09 16:21:47 +03:00

image.php

Fix command injection vulnerability in image.php (CVE-2025-65791)

2026-02-03 16:39:38 -05:00

no_database_connection.php

remove debug hello

2021-10-14 17:56:16 -04:00

view_video.php

Use substr instead of mb_substr. mb_substr is overkill and is not defined on all systems

2025-10-28 05:56:25 -04:00