From a4d66d01c2c46334986f97b5c97413c1e027dd1c Mon Sep 17 00:00:00 2001
From: Wong Hoi Sing Edison <hswong3i@gmail.com>
Date: Sat, 20 Oct 2012 17:06:20 +0800
Subject: [PATCH] Issue #1471178 by sun and hswong3i: Increases security by
 escaping shell arguments.

---
 git_deploy.module |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/git_deploy.module b/git_deploy.module
index e35ff7c..f73ad03 100644
--- a/git_deploy.module
+++ b/git_deploy.module
@@ -29,7 +29,7 @@ function git_deploy_system_info_alter(&$info, $file, $type = NULL) {
       $git_dir = "$directory/.git";
       // Theoretically /.git could exist.
       if ($directory && file_exists($git_dir)) {
-        $git = "git --git-dir $git_dir";
+        $git = "git --git-dir " . escapeshellarg($git_dir);
         // Find first the project name based on fetch URL.
         // Eat error messages. >& is valid on Windows, too. Also, $output does
         // not need initialization because it's taken by reference.
@@ -58,7 +58,7 @@ function git_deploy_system_info_alter(&$info, $file, $type = NULL) {
           // Now try to find a tag.
           exec("$git rev-list --topo-order --max-count=1 HEAD 2>&1", $last_tag_hash);
           if ($last_tag_hash) {
-            exec("$git describe  --tags $last_tag_hash[0] 2>&1", $last_tag);
+            exec("$git describe --tags " . escapeshellarg($last_tag_hash[0]) . " 2>&1", $last_tag);
             if ($last_tag) {
               $last_tag = $last_tag[0];
               // Make sure the tag starts as Drupal formatted (for eg.
@@ -77,7 +77,7 @@ function git_deploy_system_info_alter(&$info, $file, $type = NULL) {
         // The git log -1 command always succeeds and if we are not on a
         // tag this will happen to return the time of the last commit which
         // is exactly what we wanted.
-        exec("$git log -1 --pretty=format:%at $last_tag 2>&1", $datestamp);
+        exec("$git log -1 --pretty=format:%at " . escapeshellarg($last_tag) . " 2>&1", $datestamp);
         if ($datestamp && is_numeric($datestamp[0])) {
           $info['datestamp'] = $datestamp[0];
         }
-- 
1.7.9.5