Merge pull request #722 from nextcloud/fix-hardening-setup-wizard

Quote paths when invoking notify_push binary

Author: icewind1991

lib/SetupWizard.php

@@ -56,7 +56,7 @@ public function testBinary(): bool {
 		$path = $this->getBinaryPath();
 		@chmod($path, 0755);
 		$output = [];
-		exec("$path --version", $output);
+		exec(escapeshellarg($path) . ' --version', $output);
 		return count($output) === 1 && strpos($output[0], 'notify_push') === 0;
 	}
 
@@ -113,7 +113,7 @@ public function testAutoConfig(bool $selfSigned) {
 			2 => ['pipe', 'w'],
 		];
 		$pipes = [];
-		$proc = proc_open("exec $path $config", $descriptorSpec, $pipes, null, [
+		$proc = proc_open('exec ' . escapeshellarg($path) . ' ' . escapeshellarg($config), $descriptorSpec, $pipes, null, [
 			'PORT' => 7867,
 			'ALLOW_SELF_SIGNED' => $selfSigned ? 'true' : 'false',
 			'LOG' => 'notify_push=info',