From 30afcf5d59bb3600bbdc5f27e7ad49bdd4c5a57f Mon Sep 17 00:00:00 2001 From: lily Date: Mon, 14 Sep 2026 11:23:46 -0400 Subject: [PATCH] fixes for command inject --- nyaa-tools-old/web/server.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/nyaa-tools-old/web/server.py b/nyaa-tools-old/web/server.py index beb8c51..12948cb 100644 --- a/nyaa-tools-old/web/server.py +++ b/nyaa-tools-old/web/server.py @@ -2,6 +2,7 @@ import os import re import secrets +import subprocess import xml.dom.minidom from dataclasses import dataclass from datetime import datetime, timedelta @@ -241,8 +242,8 @@ def batch(): except ValueError: return "Invalid season", 400 - ret = os.system(" ".join(["nyaa-batch", "-t", "'{}'".format(title), "-s", str(season), "-l", "'{}'".format(link)])) - if ret == 0: + result = subprocess.run(["nyaa-batch", "-t", title, "-s", str(season), "-l", link]) + if result.returncode == 0: return "OK", 200 else: return "Error", 500