From 1e1f9982d7a0d1a7837ec6cabef49f143c8fb2a1 Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Sat, 10 Oct 2026 15:18:44 -0700
Subject: [PATCH] Properly handle filenames starting with -

---
 filemin/compress.cgi   | 2 +-
 filemin/extract.cgi    | 6 +++---
 filemin/filemin-lib.pl | 7 +++----
 3 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/filemin/compress.cgi b/filemin/compress.cgi
index 7e37aae8b..5d1ac931b 100755
--- a/filemin/compress.cgi
+++ b/filemin/compress.cgi
@@ -42,7 +42,7 @@ elsif ($in{'method'} eq 'zip') {
 	$extension = ".zip";
 	$full = &validate_filename_path($in{'arch'}.$extension);
 	$command = "cd ".quotemeta($cwd).
-		" && zip -r ".quotemeta($full);
+		" && zip -r -- ".quotemeta($full);
 	}
 else {
 	&error("Unknown method!");
diff --git a/filemin/extract.cgi b/filemin/extract.cgi
index 975f5a343..a97aa78e8 100755
--- a/filemin/extract.cgi
+++ b/filemin/extract.cgi
@@ -31,9 +31,9 @@ elsif ($archive_type =~ /x-7z/ ||
 elsif ($archive_type =~ /\/zip/) {
 	my $unzip_out = `unzip --help`;
 	my $uu = ($unzip_out =~ /-UU/ ? '-UU' : undef);
-	$cmd = "unzip $uu -q -o ".
-		quotemeta($full).
-		" -d ".quotemeta($cwd);
+	$cmd = "unzip $uu -q -o".
+		" -d ".quotemeta($cwd).
+		" -- ".quotemeta($full);
 	}
 elsif ($archive_type =~ /\/x-rar|\/vnd\.rar/) {
 	$cmd = "unrar x -r -y ".
diff --git a/filemin/filemin-lib.pl b/filemin/filemin-lib.pl
index b3bbb216e..3a3b1e6c5 100644
--- a/filemin/filemin-lib.pl
+++ b/filemin/filemin-lib.pl
@@ -1110,10 +1110,9 @@ foreach my $fref (@{$files_to_extract}) {
 			my $uu = ($unzip_out =~ /-UU/
 				? '-UU' : undef);
 			$status = system(
-				"$unzip_cmd $uu -q -o " .
-				quotemeta($archive) .
-				" -d " .
-				quotemeta($extract_to));
+				"$unzip_cmd $uu -q -o".
+				" -d " .quotemeta($extract_to).
+				" -- ".quotemeta($archive));
 			}
 		}
 	elsif ($archive_type =~ /\/x-rar|\/vnd\.rar/) {