check for zip and unzip commands, use multi-arg version of system to prevent the shell getting its hands on things (metacharacters in pw or whatnot), RT#5650

1 files changed, 4 insertions, 1 deletions

diff --git a/FS/bin/freeside-paymentech-upload b/FS/bin/freeside-paymentech-upload
index 08a59c5dc..985095e68 100755
--- a/FS/bin/freeside-paymentech-upload
+++ b/FS/bin/freeside-paymentech-upload
@@ -25,6 +25,8 @@ sub usage { "
 my $user = shift or die &usage;
 adminsuidsetup $user;
 
+my $zip_check = `which zip` or die "can't find zip executable\n";
+
 my @batches; 
 
 if($opt_a) {
@@ -60,7 +62,8 @@ foreach my $pay_batch (@batches) {
   print OUT $text;
   close OUT;
 
-  system("zip -P $password -q -j $tmpdir/$filename.zip $tmpdir/$filename.xml");
+  system('zip', '-P', '$password', '-q', '-j',
+           "$tmpdir/$filename.zip", "$tmpdir/$filename.xml");
 
   die "failed to create zip file\n" if (! -f "$tmpdir/$filename.zip" );
   push @filenames, $filename;