From 1a52bf4d72f9da6d79250c66e51f41c6f5b880ee Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Wed, 29 Oct 2025 22:02:29 -0700
Subject: [PATCH] Fix quoting of args

---
 squid/cachemgr.cgi | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/squid/cachemgr.cgi b/squid/cachemgr.cgi
index 10548b50f..59a4009d8 100755
--- a/squid/cachemgr.cgi
+++ b/squid/cachemgr.cgi
@@ -14,6 +14,7 @@ my ($mgr) = glob($config{'cachemgr_path'});
 if (&has_command($mgr)) {
 	$| = 1;
 	my $temp;
+	my $args = join(" ", map { quotemeta($_) } @ARGV);
 	if ($ENV{'REQUEST_METHOD'} eq 'POST') {
 		# Deal with POST data
 		my $post;
@@ -23,10 +24,10 @@ if (&has_command($mgr)) {
 		&open_tempfile($fh, ">$temp", 0, 1);
 		&print_tempfile($fh, $post);
 		&close_tempfile($fh);
-		open(MGR, "$mgr ".join(" ", @ARGV)." <$temp |");
+		open(MGR, "$mgr $args <$temp |");
 		}
 	else {
-		open(MGR, "$mgr ".join(" ", @ARGV)." |");
+		open(MGR, "$mgr $args |");
 		}
 	while(<MGR>) {
 		print;