From d383778c02b8f2788b7531072b02af430486b6e7 Mon Sep 17 00:00:00 2001
From: KOWX712 <leecc0503@gmail.com>
Date: Thu, 29 Jan 2026 23:03:53 +0800
Subject: [PATCH] webui/kpm: escape shell for ctl0 argument

#34
---
 webui/page/kpm.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/webui/page/kpm.js b/webui/page/kpm.js
index 5795bb4..f09bbe1 100644
--- a/webui/page/kpm.js
+++ b/webui/page/kpm.js
@@ -1,5 +1,5 @@
 import { exec, spawn, toast } from 'kernelsu-alt';
-import { modDir, persistDir, initInfo, MAX_CHUNK_SIZE, linkRedirect } from '../index.js';
+import { modDir, persistDir, initInfo, MAX_CHUNK_SIZE, escapeShell, linkRedirect } from '../index.js';
 import { getString } from '../language.js';
 import { setupPullToRefresh } from '../pull-to-refresh.js';
 
@@ -67,7 +67,7 @@ async function getKpmList() {
 }
 
 async function controlModule(moduleName, action) {
-    const result = await exec(`kpatch kpm ctl0 "${moduleName}" ${action}`, { env: { PATH: `${modDir}/bin` } });
+    const result = await exec(`kpatch kpm ctl0 "${moduleName}" ${escapeShell(action)}`, { env: { PATH: `${modDir}/bin` } });
     toast(result.errno === 0 ? result.stdout : result.stderr);
 }