From db0943a4a2c9de3ec9f5066d292a2b126129fd66 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Mon, 17 Nov 2025 21:39:54 -0500
Subject: [PATCH] net/upnp: safe execution change

shell_safe() is better than raw exec() although we do not have any
dynamic shell arguments to handle.  This call requires a new explode
extension (true parameter) that will be available in 25.7.8
---
 net/upnp/src/www/status_upnp.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/upnp/src/www/status_upnp.php b/net/upnp/src/www/status_upnp.php
index 641d23fc0..bb2997472 100644
--- a/net/upnp/src/www/status_upnp.php
+++ b/net/upnp/src/www/status_upnp.php
@@ -29,6 +29,7 @@
 
 require_once("guiconfig.inc");
 require_once("interfaces.inc");
+require_once("util.inc");
 require_once("plugins.inc.d/miniupnpd.inc");
 
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
@@ -42,8 +43,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     }
 }
 
-$rdr_entries = array();
-exec("/sbin/pfctl -P -a miniupnpd -s nat; /sbin/pfctl -P -a miniupnpd -s rules", $rdr_entries, $pf_ret);
+$rdr_entries = shell_safe('/sbin/pfctl -P -a miniupnpd -s nat; /sbin/pfctl -P -a miniupnpd -s rules', [], true);
 
 $service_hook = 'miniupnpd';
 include("head.inc");