From a40a08efedf44f37155e8db85301504a1cb4690a Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Fri, 3 Jul 2026 10:15:51 -0700
Subject: [PATCH] Always quote paths

---
 webmin/webmin-lib.pl | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/webmin/webmin-lib.pl b/webmin/webmin-lib.pl
index 641c499b3..f985d0f8a 100755
--- a/webmin/webmin-lib.pl
+++ b/webmin/webmin-lib.pl
@@ -310,7 +310,7 @@ if ($type eq 'rpm' && $file =~ /\.rpm$/i &&
 		return $text{'install_erpm'};
 		}
 	$redirect_to = $name = $3;
-	$out = &backquote_logged("rpm -Uv \"$file\" 2>&1");
+	$out = &backquote_logged("rpm -Uv ".&quote_path($file)." 2>&1");
 	if ($?) {
 		unlink($file) if ($need_unlink);
 		return &text('install_eirpm', "<tt>$out</tt>");
@@ -381,7 +381,9 @@ else {
 			 !$hasfile{$m,"theme.info"});
 		push(@realmods, $m);
 		my %minfo;
-		system("cd $tmpdir ; tar xf \"$file\" $m/module.info ./$m/module.info $m/theme.info ./$m/theme.info >/dev/null 2>&1");
+		system("cd ".&quote_path($tmpdir)." && tar xf ".&quote_path($file)." ".
+		       &quote_path("$m/module.info")." ".&quote_path("./$m/module.info")." ".
+		       &quote_path("$m/theme.info")." ".&quote_path("./$m/theme.info")." >/dev/null 2>&1");
 		if (!&read_file("$tmpdir/$m/module.info", \%minfo) &&
 		    !&read_file("$tmpdir/$m/theme.info", \%minfo)) {
 			$err = &text('install_einfo', "<tt>$m</tt>");
@@ -451,7 +453,7 @@ else {
 	foreach $m (@realmods) {
 		push(@grantmods, $m) if (!&foreign_exists($m));
 		if ($m ne "webmin") {
-			system("rm -rf ".quotemeta("$install_root_directory/$m")." 2>&1 >/dev/null");
+			system("rm -rf ".&quote_path("$install_root_directory/$m")." 2>&1 >/dev/null");
 			}
 		}