Bug #8603

function _fileAutoDetect() uses System_Command incorrectly

Details

Submitted	2006-08-31 21:36 UTC
From	cconstantine at php dot net
Assigned	cweiske
Status	Closed
Package	MIME_Type
PHP Version	4.3.11
Roadmaps	(Not assigned)

Comments

[2006-08-31 21:36 UTC] cconstantine at php dot net

Description:
------------
line 389 in Type.php in function _fileAutoDetect() reads...

$cmd->pushCommand($fileCmd, "-bi '{$file}'");

notice the singlequotes, which were apparently added as the
resolution to bug #2078 in Apr-2004. This does not work
correctly as written -- we'd have to also escape any SQs in
the $file variable...

Just let System_Command handle the escaping; change line 389
to pass a list of separate arguments...

$cmd->pushCommand($fileCmd, '-bi', $file);

Test script:
---------------
$file = "Somebody's Nasty Filename.jpg";
$type = MIME_Type::autoDetect($file);

will return you a Pear_error because System_Command detects the shell