From 3eb749398945d9d012396a526dbc64f174a3dbe8 Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Mon, 14 Sep 2026 19:40:24 -0700
Subject: [PATCH] Disallow multiple null-separate parameter values

---
 custom/custom-lib.pl | 1 +
 custom/lang/en       | 1 +
 2 files changed, 2 insertions(+)

diff --git a/custom/custom-lib.pl b/custom/custom-lib.pl
index f435dc27b..7a49e322f 100755
--- a/custom/custom-lib.pl
+++ b/custom/custom-lib.pl
@@ -480,6 +480,7 @@ foreach my $a (@{$cmd->{'args'}}) {
 	if ($rv eq '' && $a->{'must'} && $a->{'type'} != 7) {
 		&error(&text('run_emust', $a->{'desc'}));
 		}
+	$rv =~ /\0/ && &error($text{'run_ezero'});
 	$ENV{$n} = $rv;
 	$env .= "$n=".quotemeta($rv)."\n";
 	$export .= " $n";
diff --git a/custom/lang/en b/custom/lang/en
index d9763f05f..c8ad447b1 100644
--- a/custom/lang/en
+++ b/custom/lang/en
@@ -95,6 +95,7 @@ run_ecmduser=User '$1' to run command as does not exist
 run_eopt=Invalid option selected
 run_eupload=No file to upload selected
 run_emust=Missing value for parameter '$1'
+run_ezero=Multiple values for parameters are not allowed
 run_timeout=Command failed to complete before $1 second timeout.
 run_failed=Command failed with exit status $1