From ef0fa8c8b02c67006cc80761dae9d9f1150f1ab2 Mon Sep 17 00:00:00 2001
From: Nicolas Rannou <nicolas_rannou@hms.harvard.edu>
Date: Fri, 2 Dec 2011 17:45:12 -0500
Subject: [PATCH] ENH: missing stripslash

---
 ajax/executecommand.php | 2 ++
 upload.php              | 5 +++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/ajax/executecommand.php b/ajax/executecommand.php
index 7a15663..f329bd5 100644
--- a/ajax/executecommand.php
+++ b/ajax/executecommand.php
@@ -1,6 +1,8 @@
 <?php
     session_start();
     $command = &$_GET['var1'];
+    $command = stripslashes($command);
+    
     $image = $_SESSION["currentimage"];
     
     $ext = end(explode('.', $image));
diff --git a/upload.php b/upload.php
index ba9a8dc..d994479 100644
--- a/upload.php
+++ b/upload.php
@@ -3,7 +3,8 @@
     $image = $_SESSION["myemail"];
     
     $target = "bank/".$image."/original/";
-    
+    $target = escapeshellarg($target);
+
     echo $target;
     
     $target = $target . basename( $_FILES['uploaded']['name']) ; 
@@ -16,4 +17,4 @@
         echo "Sorry, there was a problem uploading your file.";
     }
     echo "<meta http-equiv='refresh' content='2;url=registeredarea.php'>";
-    ?>
\ No newline at end of file
+    ?>