Index: subversion.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/subversion/subversion.module,v
retrieving revision 1.1.2.1
diff -u -d -b -w -r1.1.2.1 subversion.module
--- subversion.module   4 Nov 2006 21:20:32 -0000       1.1.2.1
+++ subversion.module   11 Oct 2007 18:41:02 -0000
@@ -1451,7 +1451,7 @@
   if ($repo->type == 0) {
     $path = "/{$repo->path}{$project->trunk_path}";
     $cmd = array(
-      variable_get('subversion_svn_binary', '/usr/bin/svn'),
+      escapeshellcmd(variable_get('subversion_svn_binary', '/usr/bin/svn')),
       'create',
       '--fs-type', 'fsfs',
       escapeshellarg($path)
@@ -1459,7 +1459,7 @@
   }
   else {
     $cmd = array(
-      variable_get('subversion_svn_binary', '/usr/bin/svn'),
+      escapeshellcmd(variable_get('subversion_svn_binary', '/usr/bin/svn')),
       'mkdir',
       '--non-interactive',
       '-m',
@@ -1894,7 +1894,7 @@
    $start_revision = intval($repo->last_revision);

    $cmd = array(
-      variable_get('subversion_svn_binary', '/usr/bin/svn'),
+      escapeshellcmd(variable_get('subversion_svn_binary', '/usr/bin/svn')),
       'log',
       '-r', ($start_revision > 0 ? $start_revision+1 : 0) . ":HEAD",
       '--incremental',
@@ -2117,7 +2117,7 @@
   }
   $root = escapeshellcmd("{$repo->root}{$file}");
   $cmd = array(
-    variable_get('subversion_svn_binary', '/usr/bin/svn'),
+    escapeshellcmd(variable_get('subversion_svn_binary', '/usr/bin/svn')),
     'diff',
     '-r', escapeshellarg("{$oldrev}:{$newrev}"),
     '--non-interactive',
@@ -2360,7 +2360,7 @@
   }
   $root = escapeshellcmd("{$repo->root}{$path}");
   $cmd = array(
-    variable_get('subversion_svn_binary', '/usr/bin/svn'),
+    escapeshellcmd(variable_get('subversion_svn_binary', '/usr/bin/svn')),
     'ls',
     '--non-interactive',
     '--xml',
@@ -2424,7 +2424,7 @@
   }
   $root = escapeshellcmd("{$repo->root}{$path}");
   $cmd = array(
-    variable_get('subversion_svn_binary', '/usr/bin/svn'),
+    escapeshellcmd(variable_get('subversion_svn_binary', '/usr/bin/svn')),
     'cat',
     '--non-interactive',
   );