further password disclosure avoidance

action.sh

@@ -31,7 +31,7 @@ source config.cfg
 
 ACTION="$1"   # adduser, changepw, listusers, userdetail, deluser, sizeall, sizeuser, viewdata
 USER="$2"
-PASS=$(cat "$3")
+PASS=$(cat "$3")  # $3 is a file containing the password
 
 ## FUNCTIONS
 function checkaction {

submit.php

@@ -34,7 +34,7 @@ file_put_contents($PASSFILE, $PASS);
 if($SURE == "yes")
 {
   // Creates full command
-  $command = '/bin/bash action.sh ' . $ACTION . ' ' . $USER . ' ' . $PASS;
+  $command = '/bin/bash action.sh ' . $ACTION . ' ' . $USER . ' ' . $PASSFILE;
 
   // Execute command and give output
   $output = shell_exec($command);