diff --git a/public_html/wp-content/plugins/wordcamp-docs/classes/class-wordcamp-docs-pdf-generator.php b/public_html/wp-content/plugins/wordcamp-docs/classes/class-wordcamp-docs-pdf-generator.php index 5c86510b9..acb0e3351 100644 --- a/public_html/wp-content/plugins/wordcamp-docs/classes/class-wordcamp-docs-pdf-generator.php +++ b/public_html/wp-content/plugins/wordcamp-docs/classes/class-wordcamp-docs-pdf-generator.php @@ -72,7 +72,8 @@ public function generate_pdf_from_file( $source_file, $filename, $args = array() $file = $this->get_tmp_folder( $filename ); $command = sprintf( - 'wkhtmltopdf -d %d -T %s -R %s -B %s -L %s %s %s', + // Allowing local file access is safe because the inputs to `$source_file` should have been escaped. + 'wkhtmltopdf --enable-local-file-access -d %d -T %s -R %s -B %s -L %s %s %s', $dpi, escapeshellarg( $margins[0] ), escapeshellarg( $margins[1] ),