system-wide: fix escaping of magic chars

* fix escaping of magic lua chars (#2800)
* fix redundant second gsub line in shellstartsqescape function
* fix return value of shellstartsqescape function

Signed-off-by: Dirk Brenken <dev@brenken.org>

diff --git a/applications/luci-app-ocserv/luasrc/model/cbi/ocserv/users.lua b/applications/luci-app-ocserv/luasrc/model/cbi/ocserv/users.lua
index 0fa997c8b31554a1904648f3e02ded5040113dda..3736471f5dcf671870acee65445ffbc15f5d6d4b 100644 (file)
--- a/applications/luci-app-ocserv/luasrc/model/cbi/ocserv/users.lua
+++ b/applications/luci-app-ocserv/luasrc/model/cbi/ocserv/users.lua
@@ -26,7 +26,7 @@ pwd.password = false
 
 function pwd.write(self, section, value)
        local pass
-       if string.match(value, "^\$%d\$.*") then
+       if string.match(value, "^%$%d%$.*") then
                pass = value
        else
                local t = tonumber(nixio.getpid()*os.time())

diff --git a/modules/luci-base/luasrc/cbi/datatypes.lua b/modules/luci-base/luasrc/cbi/datatypes.lua
index 33d018d2d03340bc892ec9c54344fd0815585604..c1cf01f9cdac26daab1dcdc97d050a43d2a1835a 100644 (file)
--- a/modules/luci-base/luasrc/cbi/datatypes.lua
+++ b/modules/luci-base/luasrc/cbi/datatypes.lua
@@ -418,7 +418,7 @@ function maxlength(val, max)
 end
 
 function phonedigit(val)
-       return (val:match("^[0-9\*#!%.]+$") ~= nil)
+       return (val:match("^[0-9%*#!%.]+$") ~= nil)
 end
 
 function timehhmmss(val)

diff --git a/modules/luci-base/luasrc/util.lua b/modules/luci-base/luasrc/util.lua
index 1a329f3f20eaec2dda2e097dd11af5a4cef0aebc..a30e8b72f31466d28bec20792c6648c9b6989cb2 100644 (file)
--- a/modules/luci-base/luasrc/util.lua
+++ b/modules/luci-base/luasrc/util.lua
@@ -207,9 +207,8 @@ end
 -- handling.  It may actually be a property of the getopt function
 -- rather than the shell proper.
 function shellstartsqescape(value)
-   res, _ = string.gsub(value, "^\-", "\\-")
-   res, _ = string.gsub(res, "^-", "\-")
-   return shellsqescape(value)
+   res, _ = string.gsub(value, "^%-", "\\-")
+   return shellsqescape(res)
 end
 
 -- containing the resulting substrings. The optional max parameter specifies