From 5ed06227a84e9bb71320471a051c58e2b1fa611e Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Tue, 21 Oct 2025 19:47:11 -0700
Subject: [PATCH] Escape command flags

---
 fdisk/apply_hdparm.cgi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fdisk/apply_hdparm.cgi b/fdisk/apply_hdparm.cgi
index 1237ff3db..d0891bf41 100755
--- a/fdisk/apply_hdparm.cgi
+++ b/fdisk/apply_hdparm.cgi
@@ -12,7 +12,7 @@ if( $in{ 'action' } eq $text{ 'hdparm_apply' } )
 	local $key;
 	foreach $key ( 'a', 'd', 'r', 'k', 'u', 'm', 'c', 'A', 'K', 'P', 'X', 'W', 'S' )
 	{
-		$command .= "-".$key." ".$in{ $key }." " if( $in{ $key } ne "" );
+		$command .= "-".$key." ".quotemeta($in{$key})." " if ($in{$key} ne "");
 	}
 	$command .= $in{ 'drive' }."\n";