PHP escapeShellCmd函数代码示例

 /**
  * Adds an at command
  *    This makes an "at" job, where $cmd is the shell command to run
  *    and $timespec describes when the function should run.  See the
  *    at man page for a description of the spec.
  *
  *    $queue is an optional 1 character string [a-zA-Z] that can define
  *    which queue to put the job in.
  *
  *    If $mail is set, then an email will be sent when the job runs,
  *    even if the job doesn't output anything.  The mail gets sent to
  *    the user running the script (probably the webserver, i.e.
  *    nobody@localhost).
  *
  *    The add() method returns false on error (in which case, check
  *    $at->error for the message), or the job number on success.
  *    On succes, $at->runtime is also set with the timestamp corresponding
  *    to when the job will run.
  *
  * @param $cmd        shell command
  * @param $timespec   time when command should run, formatted accoring to the spec for at
  * @param $queue      optional at queue specifier
  * @param $mail       optional flag to specify whether to send email
  *
  * @access public
  *
  */
 function add($cmd, $timespec, $queue = false, $mail = false)
 {
     $this->_reset();
     if ($queue && !preg_match('/^[a-zA-Z]{1,1}$/', $queue)) {
         return $this->raiseError('Invalid queue specification');
     }
     $cmd = escapeShellCmd($cmd);
     $exec = sprintf("echo \"%s\" | %s %s %s %s 2>&1", addslashes($cmd), $this->AT_PROG, $queue ? '-q ' . $queue : '', $mail ? '-m' : '', $timespec);
     $result = $this->_doexec($exec);
     if (preg_match('/garbled time/i', $result)) {
         return $this->raiseError('Garbled time');
     }
     if (preg_match('/job (\\d+) at (.*)/i', $result, $m)) {
         $this->runtime = $this->_parsedate($m[2]);
         $this->job = $m[1];
         return $this->job;
     } else {
         return $this->raiseError('Exec Error: ' . $result);
     }
 }

 /**
  * Implements Mail::send() function using the sendmail
  * command-line binary.
  * 
  * @param mixed $recipients Either a comma-seperated list of recipients
  *              (RFC822 compliant), or an array of recipients,
  *              each RFC822 valid. This may contain recipients not
  *              specified in the headers, for Bcc:, resending
  *              messages, etc.
  *
  * @param array $headers The array of headers to send with the mail, in an
  *              associative array, where the array key is the
  *              header name (ie, 'Subject'), and the array value
  *              is the header value (ie, 'test'). The header
  *              produced from those values would be 'Subject:
  *              test'.
  *
  * @param string $body The full text of the message body, including any
  *               Mime parts, etc.
  *
  * @return mixed Returns true on success, or a PEAR_Error
  *               containing a descriptive error message on
  *               failure.
  * @access public
  */
 function send($recipients, $headers, $body)
 {
     $recipients = escapeShellCmd(implode(' ', $this->parseRecipients($recipients)));
     list($from, $text_headers) = $this->prepareHeaders($headers);
     if (!isset($from)) {
         return new PEAR_Error('No from address given.');
     } elseif (strstr($from, ' ') || strstr($from, ';') || strstr($from, '&') || strstr($from, '`')) {
         return new PEAR_Error('From address specified with dangerous characters.');
     }
     $result = 0;
     if (@is_executable($this->sendmail_path)) {
         $from = escapeShellCmd($from);
         $mail = popen($this->sendmail_path . (!empty($this->sendmail_args) ? ' ' . $this->sendmail_args : '') . " -f{$from} -- {$recipients}", 'w');
         fputs($mail, $text_headers);
         fputs($mail, $this->sep);
         // newline to end the headers section
         fputs($mail, $body);
         $result = pclose($mail) >> 8 & 0xff;
         // need to shift the pclose result to get the exit code
     } else {
         return new PEAR_Error('sendmail [' . $this->sendmail_path . '] not executable');
     }
     if ($result != 0) {
         return new PEAR_Error('sendmail returned error code ' . $result);
     }
     return true;
 }

 /**
  * Implements Mail::send() function using the sendmail
  * command-line binary.
  *
  * @param mixed $recipients Either a comma-seperated list of recipients
  *              (RFC822 compliant), or an array of recipients,
  *              each RFC822 valid. This may contain recipients not
  *              specified in the headers, for Bcc:, resending
  *              messages, etc.
  *
  * @param array $headers The array of headers to send with the mail, in an
  *              associative array, where the array key is the
  *              header name (ie, 'Subject'), and the array value
  *              is the header value (ie, 'test'). The header
  *              produced from those values would be 'Subject:
  *              test'.
  *
  * @param string $body The full text of the message body, including any
  *               Mime parts, etc.
  *
  * @return mixed Returns true on success, or a PEAR_Error
  *               containing a descriptive error message on
  *               failure.
  * @access public
  */
 function send($recipients, $headers, $body)
 {
     $recipients = $this->parseRecipients($recipients);
     if (PEAR::isError($recipients)) {
         return $recipients;
     }
     $recipients = escapeShellCmd(implode(' ', $recipients));
     $this->_sanitizeHeaders($headers);
     $headerElements = $this->prepareHeaders($headers);
     if (PEAR::isError($headerElements)) {
         return $headerElements;
     }
     list($from, $text_headers) = $headerElements;
     if (!isset($from)) {
         return PEAR::raiseError('No from address given.');
     } elseif (strpos($from, ' ') !== false || strpos($from, ';') !== false || strpos($from, '&') !== false || strpos($from, '`') !== false) {
         return PEAR::raiseError('From address specified with dangerous characters.');
     }
     $from = escapeShellCmd($from);
     $mail = @popen($this->sendmail_path . (!empty($this->sendmail_args) ? ' ' . $this->sendmail_args : '') . " -f{$from} -- {$recipients}", 'w');
     if (!$mail) {
         return PEAR::raiseError('Failed to open sendmail [' . $this->sendmail_path . '] for execution.');
     }
     // Write the headers following by two newlines: one to end the headers
     // section and a second to separate the headers block from the body.
     fputs($mail, $text_headers . $this->sep . $this->sep);
     fputs($mail, $body);
     $result = pclose($mail);
     if (version_compare(phpversion(), '4.2.3') == -1) {
         // With older php versions, we need to shift the pclose
         // result to get the exit code.
         $result = $result >> 8 & 0xff;
     }
     if ($result != 0) {
         return PEAR::raiseError('sendmail returned error code ' . $result, $result);
     }
     return true;
 }

    /**
     * Implements Mail::send() function using the sendmail
     * command-line binary.
     *
     * @param mixed $recipients Either a comma-seperated list of recipients
     *              (RFC822 compliant), or an array of recipients,
     *              each RFC822 valid. This may contain recipients not
     *              specified in the headers, for Bcc:, resending
     *              messages, etc.
     *
     * @param array $headers The array of headers to send with the mail, in an
     *              associative array, where the array key is the
     *              header name (ie, 'Subject'), and the array value
     *              is the header value (ie, 'test'). The header
     *              produced from those values would be 'Subject:
     *              test'.
     *
     * @param string $body The full text of the message body, including any
     *               Mime parts, etc.
     *
     * @return mixed Returns true on success, or a PEAR_Error
     *               containing a descriptive error message on
     *               failure.
     * @access public
     */
    function send($recipients, $headers, $body)
    {
        if (!is_array($headers)) {
            return PEAR::raiseError('$headers must be an array');
        }

        $result = $this->_sanitizeHeaders($headers);
        if (is_a($result, 'PEAR_Error')) {
            return $result;
        }

        $recipients = $this->parseRecipients($recipients);
        if (is_a($recipients, 'PEAR_Error')) {
            return $recipients;
        }
        $recipients = escapeShellCmd(implode(' ', $recipients));

        $headerElements = $this->prepareHeaders($headers);
        if (is_a($headerElements, 'PEAR_Error')) {
            return $headerElements;
        }
        list($from, $text_headers) = $headerElements;

        /* Since few MTAs are going to allow this header to be forged
         * unless it's in the MAIL FROM: exchange, we'll use
         * Return-Path instead of From: if it's set. */
        if (!empty($headers['Return-Path'])) {
            $from = $headers['Return-Path'];
        }

        if (!isset($from)) {
            return PEAR::raiseError('No from address given.');
        } elseif (strpos($from, ' ') !== false ||
                  strpos($from, ';') !== false ||
                  strpos($from, '&') !== false ||
                  strpos($from, '`') !== false) {
            return PEAR::raiseError('From address specified with dangerous characters.');
        }

        $from = escapeShellCmd($from);
        $mail = @popen($this->sendmail_path . (!empty($this->sendmail_args) ? ' ' . $this->sendmail_args : '') . " -f$from -- $recipients", 'w');
        if (!$mail) {
            return PEAR::raiseError('Failed to open sendmail [' . $this->sendmail_path . '] for execution.');
        }

        // Write the headers following by two newlines: one to end the headers
        // section and a second to separate the headers block from the body.
        fputs($mail, $text_headers . $this->sep . $this->sep);

        fputs($mail, $body);
        $result = pclose($mail);
        if (version_compare(phpversion(), '4.2.3') == -1) {
            // With older php versions, we need to shift the pclose
            // result to get the exit code.
            $result = $result >> 8 & 0xFF;
        }

        if ($result != 0) {
            return PEAR::raiseError('sendmail returned error code ' . $result,
                                    $result);
        }

        return true;
    }

 /**
  * Implements Mail::send() function using the sendmail
  * command-line binary.
  *
  * @param mixed $recipients Either a comma-seperated list of recipients
  *              (RFC822 compliant), or an array of recipients,
  *              each RFC822 valid. This may contain recipients not
  *              specified in the headers, for Bcc:, resending
  *              messages, etc.
  *
  * @param array $headers The array of headers to send with the mail, in an
  *              associative array, where the array key is the
  *              header name (ie, 'Subject'), and the array value
  *              is the header value (ie, 'test'). The header
  *              produced from those values would be 'Subject:
  *              test'.
  *
  * @param string $body The full text of the message body, including any
  *               Mime parts, etc.
  *
  * @return mixed Returns true on success, or a PEAR_Error
  *               containing a descriptive error message on
  *               failure.
  * @access public
  */
 function send($recipients, $headers, $body)
 {
     $recipients = $this->parseRecipients($recipients);
     if (PEAR::isError($recipients)) {
         return $recipients;
     }
     $recipients = escapeShellCmd(implode(' ', $recipients));
     $headerElements = $this->prepareHeaders($headers);
     if (PEAR::isError($headerElements)) {
         return $headerElements;
     }
     list($from, $text_headers) = $headerElements;
     if (!isset($from)) {
         return PEAR::raiseError('No from address given.');
     } elseif (strstr($from, ' ') || strstr($from, ';') || strstr($from, '&') || strstr($from, '`')) {
         return PEAR::raiseError('From address specified with dangerous characters.');
     }
     $result = 0;
     if (@is_file($this->sendmail_path)) {
         $from = escapeShellCmd($from);
         $mail = popen($this->sendmail_path . (!empty($this->sendmail_args) ? ' ' . $this->sendmail_args : '') . " -f{$from} -- {$recipients}", 'w');
         fputs($mail, $text_headers);
         fputs($mail, $this->sep);
         // newline to end the headers section
         fputs($mail, $body);
         $result = pclose($mail);
         if (version_compare(phpversion(), '4.2.3') == -1) {
             // With older php versions, we need to shift the
             // pclose result to get the exit code.
             $result = $result >> 8 & 0xff;
         }
     } else {
         return PEAR::raiseError('sendmail [' . $this->sendmail_path . '] is not a valid file');
     }
     if ($result != 0) {
         return PEAR::raiseError('sendmail returned error code ' . $result, $result);
     }
     return true;
 }

 *
 * @author  Anil Madhavapeddy <anil@recoil.org>
 * @author  Chuck Hagenbuch <chuck@horde.org>
 * @package Chora
 */
require_once __DIR__ . '/lib/Application.php';
Horde_Registry::appInit('chora');
// Exit if cvsgraph isn't active or it's not supported.
if (empty($conf['paths']['cvsgraph']) || !$VC->hasFeature('branches')) {
    Chora::url('browsefile', $where)->redirect();
}
if (!is_file($fullname . ',v')) {
    Chora::fatal(sprintf(_("%s: no such file or directory"), $where), '404 Not Found');
}
$root = escapeShellCmd($VC->sourceroot);
$file = escapeShellCmd($where . ',v');
if (Horde_Util::getFormData('show_image')) {
    // Pipe out the actual image.
    $args = array('c' => $conf['paths']['cvsgraph_conf'], 'r' => $root);
    // Build up the argument string.
    $argstr = '';
    if (!strncasecmp(PHP_OS, 'WIN', 3)) {
        foreach ($args as $key => $val) {
            $argstr .= "-{$key} \"{$val}\" ";
        }
    } else {
        foreach ($args as $key => $val) {
            $argstr .= "-{$key} '{$val}' ";
        }
    }
    header('Content-Type: image/png');

<?php

if ($_REQUEST['modfunc'] != 'backup') {
    DrawHeader(ProgramTitle());
}
if ($_REQUEST['modfunc'] == 'backup' && $_REQUEST['_ROSARIO_PDF'] == 'true') {
    //modif Francois: code inspired by phpPgAdmin
    putenv('PGHOST=' . $DatabaseServer);
    putenv('PGPORT=' . $DatabasePort);
    putenv('PGDATABASE=' . $DatabaseName);
    putenv('PGUSER=' . $DatabaseUsername);
    putenv('PGPASSWORD=' . $DatabasePassword);
    $exe = escapeShellCmd($pg_dumpPath);
    // Obtain the pg_dump version number and check if the path is good
    $version = array();
    preg_match("/(\\d+(?:\\.\\d+)?)(?:\\.\\d+)?.*\$/", exec($exe . " --version"), $version);
    if (empty($version)) {
        $error[] = sprintf('The path to the database dump utility specified in the configuration file is wrong! (%s)', $pg_dumpPath);
        ErrorMessage($error, 'fatal');
    }
    $ctype = "application/force-download";
    header("Pragma: public");
    header("Expires: 0");
    header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
    header("Cache-Control: public");
    header("Content-Description: File Transfer");
    header("Content-Type: {$ctype}");
    $filename = 'RosarioSIS_database_backup_' . date('Y.m.d') . '.sql';
    $header = "Content-Disposition: attachment; filename=" . $filename . ";";
    header($header);
    header("Content-Transfer-Encoding: binary");

 /**
  * Implements Mail::send() function using the sendmail
  * command-line binary.
  *
  * @param mixed $recipients Either a comma-seperated list of recipients
  *              (RFC822 compliant), or an array of recipients,
  *              each RFC822 valid. This may contain recipients not
  *              specified in the headers, for Bcc:, resending
  *              messages, etc.
  *
  * @param array $headers The array of headers to send with the mail, in an
  *              associative array, where the array key is the
  *              header name (ie, 'Subject'), and the array value
  *              is the header value (ie, 'test'). The header
  *              produced from those values would be 'Subject:
  *              test'.
  *
  * @param string $body The full text of the message body, including any
  *               Mime parts, etc.
  *
  * @return mixed Returns true on success, or a PEAR_Error
  *               containing a descriptive error message on
  *               failure.
  * @access public
  */
 function send($recipients, $headers, $body)
 {
     if (!is_array($headers)) {
         return PEAR::raiseError('$headers deve ser uma matriz');
     }
     $result = $this->_sanitizeHeaders($headers);
     if (is_a($result, 'PEAR_Error')) {
         return $result;
     }
     $recipients = $this->parseRecipients($recipients);
     if (is_a($recipients, 'PEAR_Error')) {
         return $recipients;
     }
     $recipients = escapeShellCmd(implode(' ', $recipients));
     $headerElements = $this->prepareHeaders($headers);
     if (is_a($headerElements, 'PEAR_Error')) {
         return $headerElements;
     }
     list($from, $text_headers) = $headerElements;
     /* Since few MTAs are going to allow this header to be forged
      * unless it's in the MAIL FROM: exchange, we'll use
      * Return-Path instead of From: if it's set. */
     if (!empty($headers['Return-Path'])) {
         $from = $headers['Return-Path'];
     }
     if (!isset($from)) {
         return PEAR::raiseError('Sem endereço determinado.');
     } elseif (strpos($from, ' ') !== false || strpos($from, ';') !== false || strpos($from, '&') !== false || strpos($from, '`') !== false) {
         return PEAR::raiseError('A partir do endereço especificado com caracteres perigosos.');
     }
     $from = escapeshellarg($from);
     // Security bug #16200
     $mail = @popen($this->sendmail_path . (!empty($this->sendmail_args) ? ' ' . $this->sendmail_args : '') . " -f{$from} -- {$recipients}", 'w');
     if (!$mail) {
         return PEAR::raiseError('Falha ao abrir o envio de e-mail [' . $this->sendmail_path . '] para execução.');
     }
     // Write the headers following by two newlines: one to end the headers
     // section and a second to separate the headers block from the body.
     fputs($mail, $text_headers . $this->sep . $this->sep);
     fputs($mail, $body);
     $result = pclose($mail);
     if (version_compare(phpversion(), '4.2.3') == -1) {
         // With older php versions, we need to shift the pclose
         // result to get the exit code.
         $result = $result >> 8 & 0xff;
     }
     if ($result != 0) {
         return PEAR::raiseError('código de erro ao enviar o e-mail' . $result, $result);
     }
     return true;
 }

function process_voice($voice_entry, $lang)
{
    global $options;
    $timestamp = time();
    $dirname = dirname($voice_entry['filename']);
    $work_path = $options['w'] . '/' . $lang . '/';
    if ($dirname == '.') {
        $dirname = '';
    }
    if ($dirname) {
        if (is_dir($work_path . $dirname) == false) {
            mkdir($work_path . $dirname);
        }
    }
    $fp = fopen($work_path . TEMP_FILE, "w");
    if ($fp == NULL) {
        print_error("cannot open file: " . $work_path . TEMP_FILE . " for writing!");
        return 0;
    }
    fprintf($fp, '%s', $voice_entry[$lang]);
    fclose($fp);
    $option_translations = array('{INFILE}' => $work_path . TEMP_FILE, '{OUTFILE}' => $work_path . TEMP_FILE . $options['s']);
    $cmd = strtr($options['g'], $option_translations);
    $cmd_array = explode('&&', $cmd);
    foreach ($cmd_array as $key => $cmd) {
        @exec(escapeShellCmd($cmd) . ' 2>>/dev/null', $out, $err);
        if ($err) {
            print_error(" File processor: " . ($key + 1) . " return code: {$err} on processing string \"" . $voice_entry[$lang] . '"');
        }
    }
    unlink($work_path . TEMP_FILE);
    if (!file_exists($work_path . TEMP_FILE . $options['s']) || filemtime($work_path . TEMP_FILE . $options['s']) < $timestamp) {
        print_error(' Temporary voice file not created properly!');
        return 0;
    }
    if (rename($work_path . TEMP_FILE . $options['s'], $work_path . $voice_entry['filename'] . $options['s']) == false) {
        print_error(' Cannot rename file to ' . $voice_entry['filename'] . $options['s']);
        return 0;
    }
    return 1;
}