From 6b62841fbaddac06a2245f7a0554fba9df495535 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Tue, 29 Mar 2022 12:41:40 +0300
Subject: [PATCH 1/3] fix websocket

---
 application/Espo/Core/WebSocket/Pusher.php | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/application/Espo/Core/WebSocket/Pusher.php b/application/Espo/Core/WebSocket/Pusher.php
index bd5c4ec5d6..b5c34d7e64 100644
--- a/application/Espo/Core/WebSocket/Pusher.php
+++ b/application/Espo/Core/WebSocket/Pusher.php
@@ -223,7 +223,11 @@ class Pusher implements WampServerInterface
         $command = $this->phpExecutablePath . " command.php " . $data['accessCheckCommand'];
 
         foreach ($params as $key => $value) {
-            $command = str_replace(':' . $key, $value, $command);
+            $command = str_replace(
+                ':' . $key,
+                escapeshellarg($value),
+                $command
+            );
         }
 
         return $command;
@@ -327,8 +331,7 @@ class Pusher implements WampServerInterface
         }
 
         $authToken = preg_replace('/[^a-zA-Z0-9]+/', '', $params['authToken']);
-
-        $userId = $params['userId'];
+        $userId = preg_replace('/[^a-zA-Z0-9]+/', '', $params['userId']);
 
         $result = $this->getUserIdByAuthToken($authToken);
 

From 934b7a936985fa9b7f376585aa13ff1f1afa5ef0 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Tue, 29 Mar 2022 12:48:42 +0300
Subject: [PATCH 2/3] npm ci

---
 Gruntfile.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gruntfile.js b/Gruntfile.js
index 145e9e7dc2..8adec07807 100644
--- a/Gruntfile.js
+++ b/Gruntfile.js
@@ -367,7 +367,7 @@ module.exports = grunt => {
     });
 
     grunt.registerTask('npm-install', () => {
-        cp.execSync("npm install", {stdio: 'ignore'});
+        cp.execSync("npm ci", {stdio: 'ignore'});
     });
 
     grunt.loadNpmTasks('grunt-contrib-clean');

From 216e1061d27385843da4b9fb0f8920d7618b705e Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Tue, 29 Mar 2022 12:54:57 +0300
Subject: [PATCH 3/3] v

---
 package-lock.json | 2 +-
 package.json      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 1783043a69..afd6a37835 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "espocrm",
-  "version": "7.0.9",
+  "version": "7.0.10",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
diff --git a/package.json b/package.json
index 8128d4d462..6975d762a8 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "espocrm",
-  "version": "7.0.9",
+  "version": "7.0.10",
   "description": "Open-source CRM.",
   "repository": {
     "type": "git",