From 95053c1edcfa416ff272a4e5afd421316410a715 Mon Sep 17 00:00:00 2001
From: ivan <ivan>
Date: Tue, 3 Nov 2009 19:56:47 +0000
Subject: check for zip and unzip commands, use multi-arg version of system to
 prevent the shell getting its hands on things (metacharacters in pw or
 whatnot), RT#5650

---
 FS/bin/freeside-paymentech-upload | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'FS/bin/freeside-paymentech-upload')

diff --git a/FS/bin/freeside-paymentech-upload b/FS/bin/freeside-paymentech-upload
index 08a59c5dc..985095e68 100755
--- a/FS/bin/freeside-paymentech-upload
+++ b/FS/bin/freeside-paymentech-upload
@@ -25,6 +25,8 @@ sub usage { "
 my $user = shift or die &usage;
 adminsuidsetup $user;
 
+my $zip_check = `which zip` or die "can't find zip executable\n";
+
 my @batches; 
 
 if($opt_a) {
@@ -60,7 +62,8 @@ foreach my $pay_batch (@batches) {
   print OUT $text;
   close OUT;
 
-  system("zip -P $password -q -j $tmpdir/$filename.zip $tmpdir/$filename.xml");
+  system('zip', '-P', '$password', '-q', '-j',
+           "$tmpdir/$filename.zip", "$tmpdir/$filename.xml");
 
   die "failed to create zip file\n" if (! -f "$tmpdir/$filename.zip" );
   push @filenames, $filename;
-- 
cgit v1.2.1