2.1_rc8 and earlier did implicit shell expansion on script

arguments since all scripts were called by system().
The security hardening changes made to 2.1_rc9 no longer
use system(), but rather use the safer execve or CreateProcess
system calls.  The security hardening also introduced a
backward incompatibility with 2.1_rc8 and earlier in that
script parameters were no longer shell-expanded, so
for example:

  client-connect "docc CLIENT-CONNECT"

would fail to work because execve would try to execute
a script called "docc CLIENT-CONNECT" instead of "docc"
with "CLIENT-CONNECT" as the first argument.

This patch fixes the issue, bringing the script argument
semantics back to pre 2.1_rc9 behavior in order to preserve
backward compatibility while still using execve or CreateProcess
to execute the script/executable.


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@3311 e7ae566f-a301-0410-adde-c780ea21d3b5

1 files changed, 3 insertions, 3 deletions

diff --git a/multi.c b/multi.c
index 5f70b6f..78cb5f3 100644
--- a/multi.c
+++ b/multi.c
@@ -103,7 +103,7 @@ learn_address_script (const struct multi_context *m,
     {
       struct argv argv = argv_new ();
       setenv_str (es, "script_type", "learn-address");
-      argv_printf (&argv, "%s %s %s",
+      argv_printf (&argv, "%sc %s %s",
 		   m->top.options.learn_address_script,
 		   op,
 		   mroute_addr_print (addr, &gc));
@@ -473,7 +473,7 @@ multi_client_disconnect_script (struct multi_context *m,
 	{
 	  struct argv argv = argv_new ();
 	  setenv_str (mi->context.c2.es, "script_type", "client-disconnect");
-	  argv_printf (&argv, "%s", mi->context.options.client_disconnect_script);
+	  argv_printf (&argv, "%sc", mi->context.options.client_disconnect_script);
 	  openvpn_execve_check (&argv, mi->context.c2.es, S_SCRIPT, "client-disconnect command failed");
 	  argv_reset (&argv);
 	}
@@ -1568,7 +1568,7 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi
 
 	  delete_file (dc_file);
 
-	  argv_printf (&argv, "%s %s",
+	  argv_printf (&argv, "%sc %s",
 		       mi->context.options.client_connect_script,
 		       dc_file);