fortify DrupalSetup (#4563)

* fortify DrupalSetup

* Run npm format

---------

Co-authored-by: Jaap Marcus <9754650+jaapmarcus@users.noreply.github.com>

web/src/app/WebApp/AppWizard.php

@@ -74,7 +74,7 @@ class AppWizard {
 
 		if ($this->appsetup->withDatabase()) {
 			exec(HESTIA_CMD . "v-list-database-hosts json", $output, $return_var);
-			$db_hosts_tmp1 = json_decode(implode("", $output), true);
+			$db_hosts_tmp1 = json_decode(implode("", $output), true, flags: JSON_THROW_ON_ERROR);
 			$db_hosts_tmp2 = array_map(function ($host) {
 				return $host["HOST"];
 			}, $db_hosts_tmp1);

web/src/app/WebApp/Installers/Drupal/DrupalSetup.php

@@ -3,6 +3,7 @@
 namespace Hestia\WebApp\Installers\Drupal;
 
 use Hestia\WebApp\Installers\BaseSetup as BaseSetup;
+use function Hestiacp\quoteshellarg\quoteshellarg;
 
 class DrupalSetup extends BaseSetup {
 	protected $appname = "drupal";
@@ -61,28 +62,28 @@ class DrupalSetup extends BaseSetup {
 			"v-run-cli-cmd",
 			[
 				"/usr/bin/php" . $options["php_version"],
-				$this->getDocRoot("/vendor/drush/drush/drush"),
+				quoteshellarg($this->getDocRoot("/vendor/drush/drush/drush")),
 				"site-install",
 				"standard",
-				"--db-url=mysql://" .
-				$this->appcontext->user() .
-				"_" .
-				$options["database_user"] .
-				":" .
-				$options["database_password"] .
-				"@" .
-				$options["database_host"] .
-				":3306/" .
-				$this->appcontext->user() .
-				"_" .
-				$options["database_name"] .
-				"",
-				"--account-name=" .
-				$options["username"] .
-				" --account-pass=" .
-				$options["password"],
+				"--db-url=" .
+				quoteshellarg(
+					"mysql://" .
+						$this->appcontext->user() .
+						"_" .
+						$options["database_user"] .
+						":" .
+						$options["database_password"] .
+						"@" .
+						$options["database_host"] .
+						":3306/" .
+						$this->appcontext->user() .
+						"_" .
+						$options["database_name"],
+				),
+				"--account-name=" . quoteshellarg($options["username"]),
+				"--account-pass=" . quoteshellarg($options["password"]),
 				"--site-name=Drupal",
-				"--site-mail=" . $options["email"],
+				"--site-mail=" . quoteshellarg($options["email"]),
 			],
 			$status,
 		);