Use shell exec so we can escape the fortune output.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@10020 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/plugins/fortune/functions.php b/plugins/fortune/functions.php
index ec8f4fe9fc277f38e916207c3dfaca7b6c2d90a5..fe1b9c627428c134400fde15faa36bee89564224 100644 (file)
--- a/plugins/fortune/functions.php
+++ b/plugins/fortune/functions.php
@@ -55,9 +55,9 @@ function fortune_function() {
     if (!$exist) {
         printf(_("%s is not found."),$fortune_location);
     } else {
-        echo "<center><em>" . _("Today's Fortune") . "</em></center><pre>\n";
-        htmlspecialchars(system($fortune_command));
-        echo "</pre>\n";
+        echo "<center><em>" . _("Today's Fortune") . "</em></center><pre>\n" .
+            htmlspecialchars(shell_exec($fortune_command)) .
+            "</pre>\n";
     }
 
     echo '</td></tr></table></td></tr></table></td></tr></table></center>';
@@ -90,4 +90,4 @@ function fortune_function_load() {
 
     $fortune_visible = getPref($data_dir, $username, 'fortune_visible');
 }
-?>
\ No newline at end of file
+?>