Update versions + convert to escapeshellarg

install/hst-install-debian.sh

@@ -31,7 +31,7 @@ HESTIA_INSTALL_DIR="$HESTIA/install/deb"
 VERBOSE='no'
 
 # Define software versions
-HESTIA_INSTALL_VER='1.6.9'
+HESTIA_INSTALL_VER='1.6.10'
 # Dependencies
 multiphp_v=("5.6" "7.0" "7.1" "7.2" "7.3" "7.4" "8.0" "8.1")
 fpm_v="8.0"

install/hst-install-ubuntu.sh

@@ -31,7 +31,7 @@ HESTIA_INSTALL_DIR="$HESTIA/install/deb"
 VERBOSE='no'
 
 # Define software versions
-HESTIA_INSTALL_VER='1.6.9'
+HESTIA_INSTALL_VER='1.6.10'
 # Dependencies
 multiphp_v=("5.6" "7.0" "7.1" "7.2" "7.3" "7.4" "8.0" "8.1")
 fpm_v="8.0"

src/deb/hestia/control

@@ -1,7 +1,7 @@
 Source: hestia
 Package: hestia
 Priority: optional
-Version: 1.6.9
+Version: 1.6.10
 Section: admin
 Maintainer: HestiaCP <info@hestiacp.com>
 Homepage: https://www.hestiacp.com

web/api/index.php

@@ -98,7 +98,7 @@ function api_legacy(array $request_data) {
             $v_password = stream_get_meta_data($fp)['uri'];
             fwrite($fp, $password."\n");
             unset($output);
-            exec(HESTIA_CMD . 'v-check-user-password "admin" '. quoteshellarg($v_password). ' '.$v_ip.' yes', $output, $return_var);
+            exec(HESTIA_CMD . 'v-check-user-password "admin" '. escapeshellarg($v_password). ' '.$v_ip.' yes', $output, $return_var);
             $hash = $output[0];
             fclose($fp);
             unset($output, $fp, $v_password);

web/login/index.php

@@ -132,7 +132,7 @@ function authenticate_user($user, $password, $twofa = '')
                 $fp = tmpfile();
                 $v_password = stream_get_meta_data($fp)['uri'];
                 fwrite($fp, $password."\n");
-                exec(HESTIA_CMD . 'v-check-user-password '. $v_user.' '. quoteshellarg($v_password). ' '.$v_ip.' yes', $output, $return_var);
+                exec(HESTIA_CMD . 'v-check-user-password '. $v_user.' '. escapeshellarg($v_password). ' '.$v_ip.' yes', $output, $return_var);
                 $hash = $output[0];
                 fclose($fp);
                 unset($output,$fp, $v_password);