From c77a66c18e01422f5071bfa1de0e7fb70e9525c7 Mon Sep 17 00:00:00 2001
From: Ben van de Vusse <vandevusse@gmail.com>
Date: Sat, 28 Feb 2026 09:37:40 +0100
Subject: [PATCH 1/2] Patch issue with escapeshellcmd namespacing in modern
 versions of PHP

---
 .DS_Store       | Bin 0 -> 8196 bytes
 public/User.php |   8 ++++----
 2 files changed, 4 insertions(+), 4 deletions(-)
 create mode 100644 .DS_Store

diff --git a/.DS_Store b/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..ae9ceaa70615fdd840f8ef121d7b84c3df1246f9
GIT binary patch
literal 8196
zcmeHM!EO^V5FMv!yCJkH0;C>SaIHcrs4B!Ir0Jm&aA*)50EOLT)o#1pjgk$i6h+Dz
zZhQbA!HF;71NaemGj^-pO)7DLB4J0K@!In|_VaihCq$&0quw^rCJ{NvtT(C<3lg_;
zo=YWDa~oO#PZS?SN!O1Of6mrcSOzQumI2FvWxz7<Z!mx}o0D_JxvyKTv<z4V{!0e<
z{oo?AZWuk&T3#Ixas_}cqgoQmxCaQvHM(K+OlyInPknn(2CB>zLuokLT{eeq7(LTk
z!%1m4DdSn08;TO|z`0^hs-d-&mI2GaJOg}pUnY-wbVgzB{>~eziCp_BNuVpR9O4sD
zO2f=upKZSuY}cqu33}~AGGahAIzcHZdQta&0~rC=rPI7m^|^q&1)BkUc^F?n9Vtih
z%p<75`*FU962C^WGjx~*^b*ksoCL*LmIej;irBN|Ir{I@G4%@`e#{{vj4!4mc<><S
zd@LOn5LJ3c2ee1~^n%)uHO%gu(!3v8t1p?gx~WHlIj7>U2A{z^`?79X+zN0b^1(nz
z-MkN3sVi;$@vv`x`}yYgqi~qk>)%yrsl2?h>a03d=Uw|a8Mjj}9Sxh_;0-^$Op?gI
zD0}{^Fc^0>?(8LT>V<JI5J1=qVDk2L826HKGa1Fbp<vs(!KpZv&c^0s@^JUjmiu^T
zy5&x`x9dA7@9s>e73c2#2Tu+=r_ouQd<3&d${ZrJrk^k6CzNvY|Ii-9Q4$|92zlK^
zR~MZ2rOdlw;krv~X1S`+A=d6GwdlF5;TiSv>`E+V5jP5m1*<Ocn8j2i@_E;Bl<_Vo
z?9&p*V-~Tjtso1Q5{FsKHN-_M@vdVkf{%rB=U7zh7qQrYLuPNLwdUTQ|ICI>mVxVI
zU`e~)<oo~r)xZB=-vF&=%YbFzk29dkt#%7XwtU4|<gJ8C7x_IhCqBYwTFYq;!6sZU
f*Kz2}KMYZJO<Tk0nbv4QvR?#*1}iKBf0cn>QcgO`

literal 0
HcmV?d00001

diff --git a/public/User.php b/public/User.php
index beed90b..f8767f2 100644
--- a/public/User.php
+++ b/public/User.php
@@ -169,8 +169,8 @@ function repr_load_react_app() {
 			foreach ($suitable_apps as $app_index => $current_app) {
 
 				// Setting path variables.
-				$appname = $current_app['appname'];
-				$plugin_app_dir_url = escapeshellcmd(REPR_APPS_URL . "/{$appname}/");
+				$appname = sanitize_file_name($current_app['appname']);
+				$plugin_app_dir_url = REPR_APPS_URL . "/{$appname}/";
 				$apptype = Utils::get_app_type($appname);
 				$css_files = [];
 				$js_files = [];
@@ -301,8 +301,8 @@ private function setup_cra_application_files(string $appname): array
 		$js_files = [];
 		$css_files = [];
 
-		$react_app_build = escapeshellcmd(REPR_APPS_URL . "/{$appname}/") . 'build/';
-		$manifest_path = escapeshellcmd(REPR_APPS_PATH . "/{$appname}/build/asset-manifest.json");
+		$react_app_build = REPR_APPS_URL . "/{$appname}/build/";
+		$manifest_path = REPR_APPS_PATH . "/{$appname}/build/asset-manifest.json";
 
 		// Request manifest file.
 		set_error_handler(

From 75c6beba058ff45e07467a4ef9010efc0f37de9a Mon Sep 17 00:00:00 2001
From: Ben van de Vusse <vandevusse@gmail.com>
Date: Sat, 28 Feb 2026 09:38:00 +0100
Subject: [PATCH 2/2] Remove DS Store

---
 .DS_Store | Bin 8196 -> 0 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 .DS_Store

diff --git a/.DS_Store b/.DS_Store
deleted file mode 100644
index ae9ceaa70615fdd840f8ef121d7b84c3df1246f9..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 8196
zcmeHM!EO^V5FMv!yCJkH0;C>SaIHcrs4B!Ir0Jm&aA*)50EOLT)o#1pjgk$i6h+Dz
zZhQbA!HF;71NaemGj^-pO)7DLB4J0K@!In|_VaihCq$&0quw^rCJ{NvtT(C<3lg_;
zo=YWDa~oO#PZS?SN!O1Of6mrcSOzQumI2FvWxz7<Z!mx}o0D_JxvyKTv<z4V{!0e<
z{oo?AZWuk&T3#Ixas_}cqgoQmxCaQvHM(K+OlyInPknn(2CB>zLuokLT{eeq7(LTk
z!%1m4DdSn08;TO|z`0^hs-d-&mI2GaJOg}pUnY-wbVgzB{>~eziCp_BNuVpR9O4sD
zO2f=upKZSuY}cqu33}~AGGahAIzcHZdQta&0~rC=rPI7m^|^q&1)BkUc^F?n9Vtih
z%p<75`*FU962C^WGjx~*^b*ksoCL*LmIej;irBN|Ir{I@G4%@`e#{{vj4!4mc<><S
zd@LOn5LJ3c2ee1~^n%)uHO%gu(!3v8t1p?gx~WHlIj7>U2A{z^`?79X+zN0b^1(nz
z-MkN3sVi;$@vv`x`}yYgqi~qk>)%yrsl2?h>a03d=Uw|a8Mjj}9Sxh_;0-^$Op?gI
zD0}{^Fc^0>?(8LT>V<JI5J1=qVDk2L826HKGa1Fbp<vs(!KpZv&c^0s@^JUjmiu^T
zy5&x`x9dA7@9s>e73c2#2Tu+=r_ouQd<3&d${ZrJrk^k6CzNvY|Ii-9Q4$|92zlK^
zR~MZ2rOdlw;krv~X1S`+A=d6GwdlF5;TiSv>`E+V5jP5m1*<Ocn8j2i@_E;Bl<_Vo
z?9&p*V-~Tjtso1Q5{FsKHN-_M@vdVkf{%rB=U7zh7qQrYLuPNLwdUTQ|ICI>mVxVI
zU`e~)<oo~r)xZB=-vF&=%YbFzk29dkt#%7XwtU4|<gJ8C7x_IhCqBYwTFYq;!6sZU
f*Kz2}KMYZJO<Tk0nbv4QvR?#*1}iKBf0cn>QcgO`