#! /bin/sh /usr/share/dpatch/dpatch-run
## 14_maketorrent_remote_command.dpatch by  <camrdale@gmail.com>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Fix a remote command execution in maketorrent.php.

@DPATCH@
diff -urNad torrentflux~/html/maketorrent.php torrentflux/html/maketorrent.php
--- torrentflux~/html/maketorrent.php	2006-12-09 15:45:47.000000000 -0800
+++ torrentflux/html/maketorrent.php	2006-12-09 15:46:32.000000000 -0800
@@ -97,7 +97,7 @@
         }
         
         // This is the command to execute
-        $app = "nohup " . $cfg["pythonCmd"] . " -OO " . $cfg["btmakemetafile"] . " " . $announce . " " . escapeshellarg( $cfg['path'] . $file ) . " ";
+        $app = "nohup " . $cfg["pythonCmd"] . " -OO " . $cfg["btmakemetafile"] . " " . escapeshellarg($announce) . " " . escapeshellarg( $cfg['path'] . $file ) . " ";
         
         // Is there comments to add?
         if( !empty( $comment ) )