From 4bf17edc2f5f44f5fe1ac53494bc7a2d6effaff7 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Thu, 9 Jun 2016 10:08:22 -0400
Subject: [PATCH] One more escapeshellarg for auth.inc on 2.4. Ticket #6475

---
 src/etc/inc/auth.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/etc/inc/auth.inc b/src/etc/inc/auth.inc
index 5225f91764..bb42ca2bb7 100644
--- a/src/etc/inc/auth.inc
+++ b/src/etc/inc/auth.inc
@@ -552,7 +552,7 @@ function local_user_set(& $user) {
 
 	/* determine add or mod */
 	if (($userattrs[0] != $user['name']) || (!strncmp($pwread, "pw:", 3))) {
-		$user_op = "useradd -m -k {$skel_dir} -o";
+		$user_op = "useradd -m -k " . escapeshellarg($skel_dir) . " -o";
 	} else {
 		$user_op = "usermod";
 	}