From 95053c1edcfa416ff272a4e5afd421316410a715 Mon Sep 17 00:00:00 2001
From: ivan <ivan>
Date: Tue, 3 Nov 2009 19:56:47 +0000
Subject: check for zip and unzip commands, use multi-arg version of system to
 prevent the shell getting its hands on things (metacharacters in pw or
 whatnot), RT#5650

---
 FS/bin/freeside-paymentech-download | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'FS/bin/freeside-paymentech-download')

diff --git a/FS/bin/freeside-paymentech-download b/FS/bin/freeside-paymentech-download
index 8fb4bccb8..f4e0391ab 100755
--- a/FS/bin/freeside-paymentech-download
+++ b/FS/bin/freeside-paymentech-download
@@ -30,6 +30,8 @@ if ( $opt_a ) {
     unless -w $opt_a;
 }
 
+my $unzip_check = `which unzip` or die "can't find unzip executable\n";
+
 #my $tmpdir = File::Temp->newdir();
 my $tmpdir = tempdir( CLEANUP => 1 ); #DIR=>somewhere?
 
@@ -64,9 +66,10 @@ BATCH: foreach my $filename (@files) {
   }
 
   #unzip file
-  system("unzip -P $password -q $tmpdir/${filename}_resp.zip -d $tmpdir");
+  system('unzip', '-P', '$password', '-q',
+           "$tmpdir/${filename}_resp.zip", '-d', $tmpdir);
   if(! -f "$tmpdir/${filename}_resp.xml") {
-    warn "failed to extract ${filename}_resp.xml\n";
+    warn "failed to extract ${filename}_resp.xml from ${filename}_resp.zip\n";
     next BATCH;
   }
 
-- 
cgit v1.2.1