diff --git a/interface/web/sites/templates/web_domain_advanced.htm b/interface/web/sites/templates/web_domain_advanced.htm
index 92a77c03bf495a529f308a1d0f4908e196ef34b4..7fb4ac31727a836842f3dee16334972cafaa4688 100644
--- a/interface/web/sites/templates/web_domain_advanced.htm
+++ b/interface/web/sites/templates/web_domain_advanced.htm
@@ -32,7 +32,7 @@
-
+
diff --git a/server/plugins-available/nginx_plugin.inc.php b/server/plugins-available/nginx_plugin.inc.php
index 3d536eaa8701772df56cd24bcb790714150540bf..0b31c6df885daf48a6d0d60d50cad1f4f7630230 100644
--- a/server/plugins-available/nginx_plugin.inc.php
+++ b/server/plugins-available/nginx_plugin.inc.php
@@ -1101,7 +1101,7 @@ class nginx_plugin {
$tpl->setVar('fpm_port', $web_config['php_fpm_start_port'] + $data['new']['domain_id']);
$tpl->setVar('fpm_user', $data['new']['system_user']);
$tpl->setVar('fpm_group', $data['new']['system_group']);
- $php_open_basedir = ($data['new']['php_open_basedir'] == '')?$data['new']['document_root']:$data['new']['php_open_basedir'];
+ $php_open_basedir = ($data['new']['php_open_basedir'] == '')?escapeshellcmd($data['new']['document_root']):escapeshellcmd($data['new']['php_open_basedir']);
$tpl->setVar('php_open_basedir', $php_open_basedir);
if($php_open_basedir != ''){
$tpl->setVar('enable_php_open_basedir', '');
@@ -1121,8 +1121,8 @@ class nginx_plugin {
foreach($ini_settings as $ini_setting){
list($key, $value) = explode('=', $ini_setting);
if($value){
- $value = trim($value);
- $key = trim($key);
+ $value = escapeshellcmd(trim($value));
+ $key = escapeshellcmd(trim($key));
switch (strtolower($value)) {
case 'on':
case 'off':