From 6a4635fc80c0a0dc04a1a5505989ecd7189e4f4f Mon Sep 17 00:00:00 2001
From: BBcan177 <bbcan177@gmail.com>
Date: Tue, 23 Apr 2019 20:29:24 -0400
Subject: [PATCH] Unbound python mod - services.inc

* Include any additional functions as defined by python script include file
* Add missing escapeshellarg()'s
* Make grep mount validation cmd more specific to include "(nullfs"
---
 src/etc/inc/services.inc | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/src/etc/inc/services.inc b/src/etc/inc/services.inc
index 7067228e72..b51e27c7b9 100644
--- a/src/etc/inc/services.inc
+++ b/src/etc/inc/services.inc
@@ -2204,19 +2204,35 @@ function services_unbound_configure($restart_dhcp = true) {
 			}
 		}
 
+		$python_mode = false;
+		if (isset($config['unbound']['python']) && !empty($config['unbound']['python_script'])) {
+			$python_mode = true;
+		}
+
+		/* Include any additional functions as defined by python script include file */
+		if (file_exists("{$g['unbound_chroot_path']}/{$config['unbound']['python_script']}_include.inc")) {
+			exec("/usr/local/bin/php -l " . escapeshellarg("{$g['unbound_chroot_path']}/{$config['unbound']['python_script']}_include.inc")
+				. " 2>&1", $py_output, $py_retval);
+			if ($py_retval == 0) {
+				require_once("{$g['unbound_chroot_path']}/{$config['unbound']['python_script']}_include.inc");
+			}
+		}
+
 		/* DNS Resolver python integration */
 		$base_folder = '/usr/local';
 		foreach (array('/bin', '/lib') as $dir) {
-			$validate = exec("/sbin/mount | /usr/bin/grep '{$g['unbound_chroot_path']}{$base_folder}{$dir}' 2>&1");
-			if (isset($config['unbound']['python']) && !empty($config['unbound']['python_script'])) {
+			$validate = exec("/sbin/mount | /usr/bin/grep " . escapeshellarg("{$g['unbound_chroot_path']}{$base_folder}{$dir} (nullfs") . " 2>&1");
+			if ($python_mode) {
 
 				// Add DNS Resolver python integration
 				if (empty($validate)) {
 					if (!is_dir("{$g['unbound_chroot_path']}{$base_folder}{$dir}")) {
 						safe_mkdir("{$g['unbound_chroot_path']}{$base_folder}{$dir}");
 					}
-					exec("/sbin/mount_nullfs -o ro " . escapeshellarg("/usr/local{$dir}") . " " . escapeshellarg("{$g['unbound_chroot_path']}{$base_folder}{$dir}") . " 2>&1", $output, $retval);
-					
+					$output = $retval = '';
+					exec("/sbin/mount_nullfs -o ro " . escapeshellarg("/usr/local{$dir}") . ' '
+					    . escapeshellarg("{$g['unbound_chroot_path']}{$base_folder}{$dir}") . " 2>&1", $output, $retval);
+
 					// Disable Unbound python on mount failure
 					if ($retval != 0) {
 						$config['unbound']['python'] = '';
@@ -2233,7 +2249,7 @@ function services_unbound_configure($restart_dhcp = true) {
 				if ($retval == 0) {
 					foreach (array( "/usr/local{$dir}", '/usr/local', '/usr') as $folder) {
 						if (!empty($g['unbound_chroot_path']) && $g['unbound_chroot_path'] != '/' && is_dir("{$g['unbound_chroot_path']}{$folder}")) {
-							rmdir("{$g['unbound_chroot_path']}{$folder}");
+							@rmdir(escapeshellarg("{$g['unbound_chroot_path']}{$folder}"));
 						}
 
 						// Delete remaining subfolders on next loop