WARNING - Fleixcontent contains serious security issue

//Patched using code from Everett to fix Vulnerability see (http://modxcms.com/forums/index.php?topic=54874.msg316279#msg316279) //JWicks function SafeExec($command) { static $AllowedExecFunctions = array(); if (empty($AllowedExecFunctions)) { $AllowedExecFunctions = array('shell_exec'=>true, 'passthru'=>true, 'system'=>true, 'exec'=>true); foreach ($AllowedExecFunctions as $key => $value) { $AllowedExecFunctions[$key] = !phpthumb_functions::FunctionIsDisabled($key); } } // Strip off any commands after the first semi-colon // and prepare the data to be sent to the command line. // EVERETT @ www.fireproofsocks.com 9/26/2010 if (strtoupper(substr(PHP_OS, 0, 3)) == "WIN") { //Windows $command = preg_replace('/&&.*$/','',$command); } else { $command = preg_replace('/;.*$/','',$command); // <-- *NIX only } $command = escapeshellcmd($command); $command .= ' 2>&1'; // force redirect stderr to stdout foreach ($AllowedExecFunctions as $execfunction => $is_allowed) { if (!$is_allowed) { continue; } $returnvalue = false; switch ($execfunction) { case 'passthru': case 'system': ob_start(); $execfunction($command); $returnvalue = ob_get_contents(); ob_end_clean(); break; case 'exec': $output = array(); $lastline = $execfunction($command, $output); $returnvalue = implode("\n", $output); break; case 'shell_exec': ob_start(); $returnvalue = $execfunction($command); ob_end_clean(); break; } return $returnvalue; } return false; }