update.php fixes

Re-check the resolved #command path stays inside the document root before
executing it, so an authenticated request cannot use realpath() traversal
(e.g. starting at $docroot then '../') to run a binary outside the webgui.

Refs: OS-489

Author: elibosley

emhttp/update.php

@@ -114,7 +114,7 @@ function write_log($string) {
   if (strpos($command, $docroot) !== 0)
     $command = "$docroot/$command";
   $command = realpath($command);
-  if ($command === false)
+  if ($command === false || strpos($command, rtrim(realpath($docroot), '/') . '/') !== 0)
     syslog(LOG_INFO, "Invalid #command: {$_POST['#command']}");
   else {
     $command = escapeshellcmd($command);