From 47f431b1d69354d5e3843087ef3c62a3ab09e880 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Sun, 26 Apr 2020 08:02:03 +0200
Subject: [PATCH] Fix remote code execution via crafted 'im_convert_path' or
 'im_identify_path' settings

---
 program/lib/Roundcube/rcube_image.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/program/lib/Roundcube/rcube_image.php b/program/lib/Roundcube/rcube_image.php
index 08eecb664..6aecfe1ba 100644
--- a/program/lib/Roundcube/rcube_image.php
+++ b/program/lib/Roundcube/rcube_image.php
@@ -159,7 +159,8 @@ class rcube_image
                             'size'    => $width . 'x' . $height,
                         );
 
-                        $result = rcube::exec($convert . ' 2>&1 -flatten -auto-orient -colorspace sRGB -strip'
+                        $result = rcube::exec(escapeshellcmd($convert)
+                            . ' 2>&1 -flatten -auto-orient -colorspace sRGB -strip'
                             . ' -quality {quality} -resize {size} {intype}:{in} {type}:{out}', $p);
                     }
                     // use PHP's Imagick class
@@ -324,7 +325,8 @@ class rcube_image
             $p['out']  = $filename;
             $p['type'] = self::$extensions[$type];
 
-            $result = rcube::exec($convert . ' 2>&1 -colorspace sRGB -strip -flatten -quality 75 {in} {type}:{out}', $p);
+            $result = rcube::exec(escapeshellcmd($convert)
+                . ' 2>&1 -colorspace sRGB -strip -flatten -quality 75 {in} {type}:{out}', $p);
 
             if ($result === '') {
                 chmod($filename, 0600);
@@ -418,7 +420,7 @@ class rcube_image
         // use ImageMagick in command line
         if ($cmd = $rcube->config->get('im_identify_path')) {
             $args = array('in' => $this->image_file, 'format' => "%m %[fx:w] %[fx:h]");
-            $id   = rcube::exec($cmd. ' 2>/dev/null -format {format} {in}', $args);
+            $id   = rcube::exec(escapeshellcmd($cmd) . ' 2>/dev/null -format {format} {in}', $args);
 
             if ($id) {
                 return explode(' ', strtolower($id));