su: escape quotes and backslashes in command

In 'su -c "CMD"' CMD should become a single argument to busybox
sh -c ...

But previously, the parameter string to ShellExecute was constructed
by placing the literal value of CMD inside double quotes, which could
result in incorrect and/or more than one parameter seen by the
program, because double-quotes and (some) backslashes in CMD should
be escaped while constructing the string, but they weren't.

Now they're escaped so that the WIN32 CommandLineToArgv[W] parses it
into a single argument with value identical to the original CMD.

1 files changed, 1 insertions, 1 deletions

diff --git a/loginutils/suw32.c b/loginutils/suw32.c
index 3500c08db..df6d07232 100644
--- a/loginutils/suw32.c
+++ b/loginutils/suw32.c
@@ -61,7 +61,7 @@ int suw32_main(int argc UNUSED_PARAM, char **argv)
                 xasprintf("--busybox ash -d \"%s\" -t \"BusyBox ash (Admin)\" ", cwd);
         if (opt_command)
                 info.lpParameters =
-                        xasprintf("%s -s -c \"%s\"", info.lpParameters, opt_command);
+                        xasprintf("%s -s -c %s", info.lpParameters, quote_arg(opt_command));
         /* info.lpDirectory = NULL; */
         info.nShow = SW_SHOWNORMAL;