From 6e69b0a82bbf06042f18cfc493984de66b14a176 Mon Sep 17 00:00:00 2001
From: Torsten Dittmann <torsten.dittmann@googlemail.com>
Date: Thu, 15 Jul 2021 18:12:18 +0200
Subject: [PATCH] fix(install): escape shell args

---
 app/tasks/install.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/tasks/install.php b/app/tasks/install.php
index 755e0b7e2c..483f5c5e04 100644
--- a/app/tasks/install.php
+++ b/app/tasks/install.php
@@ -129,7 +129,7 @@ $cli
             $httpsPort = Console::confirm('Choose your server HTTPS port: (default: '.$defaultHTTPSPort.')');
             $httpsPort = ($httpsPort) ? $httpsPort : $defaultHTTPSPort;
         }
-    
+
         $input = [];
 
         foreach($vars as $key => $var) {
@@ -196,7 +196,7 @@ $cli
 
         foreach ($input as $key => $value) {
             if($value) {
-                $env .= $key.'='.$value.' ';
+                $env .= $key.'='.\escapeshellarg($value).' ';
             }
         }