Hello community,

here is the log from the commit of package yast2-instserver for 
openSUSE:Factory checked in at 2019-01-08 12:19:45
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/yast2-instserver (Old)
 and      /work/SRC/openSUSE:Factory/.yast2-instserver.new.28833 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "yast2-instserver"

Tue Jan  8 12:19:45 2019 rev:58 rq:653868 version:4.1.5

Changes:
--------
--- /work/SRC/openSUSE:Factory/yast2-instserver/yast2-instserver.changes        
2018-11-26 10:30:56.780982963 +0100
+++ 
/work/SRC/openSUSE:Factory/.yast2-instserver.new.28833/yast2-instserver.changes 
    2019-01-08 12:19:46.780846570 +0100
@@ -1,0 +2,13 @@
+Tue Dec  4 11:07:15 UTC 2018 - [email protected]
+
+- always use absolute path to binaries (bsc#1118291)
+- escape properly shell arguments (bsc#1118291)
+- 4.1.5
+
+-------------------------------------------------------------------
+Sun Nov 25 02:18:52 UTC 2018 - Stasiek Michalski <[email protected]>
+
+- Provide icon with module (boo#1109310)
+- 4.1.4
+
+-------------------------------------------------------------------

Old:
----
  yast2-instserver-4.1.3.tar.bz2

New:
----
  yast2-instserver-4.1.5.tar.bz2

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ yast2-instserver.spec ++++++
--- /var/tmp/diff_new_pack.VTItYy/_old  2019-01-08 12:19:47.184846121 +0100
+++ /var/tmp/diff_new_pack.VTItYy/_new  2019-01-08 12:19:47.184846121 +0100
@@ -17,7 +17,7 @@
 
 
 Name:           yast2-instserver
-Version:        4.1.3
+Version:        4.1.5
 Release:        0
 
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
@@ -82,5 +82,6 @@
 %doc %{yast_docdir}/CONTRIBUTING.md
 %license COPYING
 %doc %{yast_docdir}/README.md
+%{_datadir}/icons/*
 
 %changelog

++++++ yast2-instserver-4.1.3.tar.bz2 -> yast2-instserver-4.1.5.tar.bz2 ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/yast2-instserver-4.1.3/package/yast2-instserver.changes 
new/yast2-instserver-4.1.5/package/yast2-instserver.changes
--- old/yast2-instserver-4.1.3/package/yast2-instserver.changes 2018-11-23 
12:19:14.000000000 +0100
+++ new/yast2-instserver-4.1.5/package/yast2-instserver.changes 2018-12-04 
14:50:55.000000000 +0100
@@ -1,4 +1,17 @@
 -------------------------------------------------------------------
+Tue Dec  4 11:07:15 UTC 2018 - [email protected]
+
+- always use absolute path to binaries (bsc#1118291)
+- escape properly shell arguments (bsc#1118291)
+- 4.1.5
+
+-------------------------------------------------------------------
+Sun Nov 25 02:18:52 UTC 2018 - Stasiek Michalski <[email protected]>
+
+- Provide icon with module (boo#1109310)
+- 4.1.4
+
+-------------------------------------------------------------------
 Wed Nov 21 16:19:19 UTC 2018 - [email protected]
 
 - Use the nfs-server service real name instead an alias
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/yast2-instserver-4.1.3/package/yast2-instserver.spec 
new/yast2-instserver-4.1.5/package/yast2-instserver.spec
--- old/yast2-instserver-4.1.3/package/yast2-instserver.spec    2018-11-23 
12:19:14.000000000 +0100
+++ new/yast2-instserver-4.1.5/package/yast2-instserver.spec    2018-12-04 
14:50:55.000000000 +0100
@@ -17,7 +17,7 @@
 
 
 Name:           yast2-instserver
-Version:        4.1.3
+Version:        4.1.5
 Release:        0
 
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
@@ -83,3 +83,4 @@
 %doc %{yast_docdir}/CONTRIBUTING.md
 %license COPYING
 %doc %{yast_docdir}/README.md
+%{_datadir}/icons/*
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/yast2-instserver-4.1.3/src/icons/hicolor/scalable/apps/yast-instserver.svg 
new/yast2-instserver-4.1.5/src/icons/hicolor/scalable/apps/yast-instserver.svg
--- 
old/yast2-instserver-4.1.3/src/icons/hicolor/scalable/apps/yast-instserver.svg  
    1970-01-01 01:00:00.000000000 +0100
+++ 
new/yast2-instserver-4.1.5/src/icons/hicolor/scalable/apps/yast-instserver.svg  
    2018-12-04 14:50:55.000000000 +0100
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="128" height="128" version="1.1" viewBox="0 0 128 128.00001" 
xmlns="http://www.w3.org/2000/svg";>
+<defs>
+<linearGradient id="a" x1="2" x2="30" y1="27" y2="27" 
gradientTransform="matrix(4,0,0,4,0,-4)" gradientUnits="userSpaceOnUse">
+<stop stop-color="#5e5c64" offset="0"/>
+<stop stop-color="#9a9996" offset=".035714"/>
+<stop stop-color="#5e5c64" offset=".071429"/>
+<stop stop-color="#5e5c64" offset=".92857"/>
+<stop stop-color="#9a9996" offset=".96429"/>
+<stop stop-color="#5e5c64" offset="1"/>
+</linearGradient>
+</defs>
+<rect x="8" y="24" width="112" height="24" ry="4" fill="#5e5c64"/>
+<rect x="8" y="48" width="112" height="24" ry="4" fill="#5e5c64"/>
+<rect x="8" y="72" width="112" height="24" ry="4.2348" fill="#5e5c64"/>
+<rect x="8" y="92" width="112" height="20" ry="4" fill="url(#a)"/>
+<rect x="8" y="12" width="112" height="20" ry="4" fill="#9a9996"/>
+<rect x="8" y="36" width="112" height="20" ry="4" fill="#9a9996"/>
+<rect x="8" y="60" width="112" height="20" ry="4" fill="#9a9996"/>
+<rect x="8" y="84" width="112" height="20" ry="4" fill="#9a9996"/>
+<rect x="56" y="16" width="60" height="12" ry="0" fill="#3d3846"/>
+<rect x="56" y="20" width="60" height="8" ry="0" fill="#5e5c64"/>
+<rect x="56" y="40" width="60" height="12" ry="0" fill="#3d3846"/>
+<rect x="56" y="44" width="60" height="8" ry="0" fill="#5e5c64"/>
+<rect x="56" y="64" width="60" height="12" ry="0" fill="#3d3846"/>
+<rect x="56" y="68" width="60" height="8" ry="0" fill="#5e5c64"/>
+<rect x="56" y="88" width="60" height="12" ry="0" fill="#3d3846"/>
+<rect x="56" y="92" width="60" height="8" ry="0" fill="#5e5c64"/>
+<rect x="16" y="16" width="4" height="8" ry="2" fill="#5e5c64"/>
+<rect x="16" y="20" width="4" height="4" ry="2" fill="#f6d32d"/>
+<rect x="24" y="16" width="4" height="8" ry="2" fill="#5e5c64"/>
+<rect x="24" y="20" width="4" height="4" ry="2" fill="#33d17a"/>
+<rect x="16" y="40" width="4" height="8" ry="2" fill="#5e5c64"/>
+<rect x="16" y="44" width="4" height="4" ry="2" fill="#33d17a"/>
+<rect x="24" y="40" width="4" height="8" ry="2" fill="#5e5c64"/>
+<rect x="24" y="44" width="4" height="4" ry="2" fill="#e01b24"/>
+<rect x="16" y="64" width="4" height="8" ry="2" fill="#5e5c64"/>
+<rect x="16" y="68" width="4" height="4" ry="2" fill="#e01b24"/>
+<rect x="24" y="64" width="4" height="8" ry="2" fill="#5e5c64"/>
+<rect x="24" y="68" width="4" height="4" ry="2" fill="#f6d32d"/>
+<rect x="16" y="88" width="4" height="8" ry="2" fill="#5e5c64"/>
+<rect x="16" y="92" width="4" height="4" ry="2" fill="#f6d32d"/>
+<rect x="24" y="88" width="4" height="8" ry="2" fill="#5e5c64"/>
+<rect x="24" y="92" width="4" height="4" ry="2" fill="#33d17a"/>
+<rect x="60" y="44" width="4" height="8" fill="#3d3846"/>
+<rect x="60" y="40" width="4" height="4" fill="#241f31"/>
+<rect x="68" y="44" width="4" height="8" fill="#3d3846"/>
+<rect x="68" y="40" width="4" height="4" fill="#241f31"/>
+<rect x="76" y="44" width="4" height="8" fill="#3d3846"/>
+<rect x="76" y="40" width="4" height="4" fill="#241f31"/>
+<rect x="84" y="44" width="4" height="8" fill="#3d3846"/>
+<rect x="84" y="40" width="4" height="4" fill="#241f31"/>
+<rect x="92" y="44" width="4" height="8" fill="#3d3846"/>
+<rect x="92" y="40" width="4" height="4" fill="#241f31"/>
+<rect x="100" y="44" width="4" height="8" fill="#3d3846"/>
+<rect x="100" y="40" width="4" height="4" fill="#241f31"/>
+<rect x="108" y="44" width="4" height="8" fill="#3d3846"/>
+<rect x="108" y="40" width="4" height="4" fill="#241f31"/>
+<rect x="60" y="20" width="4" height="8" fill="#3d3846"/>
+<rect x="60" y="16" width="4" height="4" fill="#241f31"/>
+<rect x="68" y="20" width="4" height="8" fill="#3d3846"/>
+<rect x="68" y="16" width="4" height="4" fill="#241f31"/>
+<rect x="76" y="20" width="4" height="8" fill="#3d3846"/>
+<rect x="76" y="16" width="4" height="4" fill="#241f31"/>
+<rect x="84" y="20" width="4" height="8" fill="#3d3846"/>
+<rect x="84" y="16" width="4" height="4" fill="#241f31"/>
+<rect x="92" y="20" width="4" height="8" fill="#3d3846"/>
+<rect x="92" y="16" width="4" height="4" fill="#241f31"/>
+<rect x="100" y="20" width="4" height="8" fill="#3d3846"/>
+<rect x="100" y="16" width="4" height="4" fill="#241f31"/>
+<rect x="108" y="20" width="4" height="8" fill="#3d3846"/>
+<rect x="108" y="16" width="4" height="4" fill="#241f31"/>
+<rect x="60" y="68" width="4" height="8" fill="#3d3846"/>
+<rect x="60" y="64" width="4" height="4" fill="#241f31"/>
+<rect x="68" y="68" width="4" height="8" fill="#3d3846"/>
+<rect x="68" y="64" width="4" height="4" fill="#241f31"/>
+<rect x="76" y="68" width="4" height="8" fill="#3d3846"/>
+<rect x="76" y="64" width="4" height="4" fill="#241f31"/>
+<rect x="84" y="68" width="4" height="8" fill="#3d3846"/>
+<rect x="84" y="64" width="4" height="4" fill="#241f31"/>
+<rect x="92" y="68" width="4" height="8" fill="#3d3846"/>
+<rect x="92" y="64" width="4" height="4" fill="#241f31"/>
+<rect x="100" y="68" width="4" height="8" fill="#3d3846"/>
+<rect x="100" y="64" width="4" height="4" fill="#241f31"/>
+<rect x="108" y="68" width="4" height="8" fill="#3d3846"/>
+<rect x="108" y="64" width="4" height="4" fill="#241f31"/>
+<rect x="60" y="92" width="4" height="8" fill="#3d3846"/>
+<rect x="60" y="88" width="4" height="4" fill="#241f31"/>
+<rect x="68" y="92" width="4" height="8" fill="#3d3846"/>
+<rect x="68" y="88" width="4" height="4" fill="#241f31"/>
+<rect x="76" y="92" width="4" height="8" fill="#3d3846"/>
+<rect x="76" y="88" width="4" height="4" fill="#241f31"/>
+<rect x="84" y="92" width="4" height="8" fill="#3d3846"/>
+<rect x="84" y="88" width="4" height="4" fill="#241f31"/>
+<rect x="92" y="92" width="4" height="8" fill="#3d3846"/>
+<rect x="92" y="88" width="4" height="4" fill="#241f31"/>
+<rect x="100" y="92" width="4" height="8" fill="#3d3846"/>
+<rect x="100" y="88" width="4" height="4" fill="#241f31"/>
+<rect x="108" y="92" width="4" height="8" fill="#3d3846"/>
+<rect x="108" y="88" width="4" height="4" fill="#241f31"/>
+<rect x="64" y="64" width="64" height="64" ry="4" fill="#f6f5f4"/>
+<path d="m96 68a28 28 0 0 0 -28 28 28 28 0 0 0 28 28 28 28 0 0 0 28 -28 28 28 
0 0 0 -28 -28zm0 4a24 24 0 0 1 24 24 24 24 0 0 1 -24 24 24 24 0 0 1 -24 -24 24 
24 0 0 1 24 -24z" fill="#3d3846"/>
+<path d="m96 76a20 20 0 0 0 -20 20 20 20 0 0 0 20 20 20 20 0 0 0 20 -20 20 20 
0 0 0 -20 -20zm0 4a16 16 0 0 1 16 16 16 16 0 0 1 -16 16 16 16 0 0 1 -16 -16 16 
16 0 0 1 16 -16z" fill="#3d3846"/>
+<path d="m96 84a12 12 0 0 0 -12 12 12 12 0 0 0 12 12 12 12 0 0 0 12 -12 12 12 
0 0 0 -12 -12zm0 4a8 8 0 0 1 8 8 8 8 0 0 1 -8 8 8 8 0 0 1 -8 -8 8 8 0 0 1 8 
-8z" fill="#3d3846"/>
+<circle cx="96" cy="96" r="4" fill="#3d3846"/>
+</svg>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/yast2-instserver-4.1.3/src/icons/hicolor/symbolic/apps/yast-instserver-symbolic.svg
 
new/yast2-instserver-4.1.5/src/icons/hicolor/symbolic/apps/yast-instserver-symbolic.svg
--- 
old/yast2-instserver-4.1.3/src/icons/hicolor/symbolic/apps/yast-instserver-symbolic.svg
     1970-01-01 01:00:00.000000000 +0100
+++ 
new/yast2-instserver-4.1.5/src/icons/hicolor/symbolic/apps/yast-instserver-symbolic.svg
     2018-12-04 14:50:55.000000000 +0100
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/";
+   xmlns:cc="http://creativecommons.org/ns#";
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#";
+   xmlns:svg="http://www.w3.org/2000/svg";
+   xmlns="http://www.w3.org/2000/svg";
+   id="svg4"
+   version="1.1"
+   height="16"
+   width="16">
+  <metadata
+     id="metadata10">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage"; />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <defs
+     id="defs8" />
+  <path
+     style="fill:#c0bfbc"
+     id="path2"
+     d="m 11,11 v 5 h 5 v -5 z m 1,1 h 1 v 1 h 1 v -1 h 1 v 2 h -1 v 1 h -1 v 
-1 h -1 z" />
+  <path
+     id="path824"
+     d="M 8 0 A 8 8 0 0 0 0 8 A 8 8 0 0 0 8 16 A 8 8 0 0 0 10 15.734375 L 10 
13.650391 A 6 6 0 0 1 8 14 A 6 6 0 0 1 2 8 A 6 6 0 0 1 8 2 A 6 6 0 0 1 14 8 A 6 
6 0 0 1 13.648438 10 L 15.740234 10 A 8 8 0 0 0 16 8 A 8 8 0 0 0 8 0 z M 8 4 A 
4 4 0 0 0 4 8 A 4 4 0 0 0 8 12 A 4 4 0 0 0 10 11.458984 L 10 10 L 11.458984 10 
A 4 4 0 0 0 12 8 A 4 4 0 0 0 8 4 z M 8 6 A 2 2 0 0 1 10 8 A 2 2 0 0 1 8 10 A 2 
2 0 0 1 6 8 A 2 2 0 0 1 8 6 z "
+     
style="opacity:1;fill:#c0bfbc;fill-opacity:1;stroke:none;stroke-width:4;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
 />
+</svg>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/yast2-instserver-4.1.3/src/include/instserver/dialogs.rb 
new/yast2-instserver-4.1.5/src/include/instserver/dialogs.rb
--- old/yast2-instserver-4.1.3/src/include/instserver/dialogs.rb        
2018-11-23 12:19:14.000000000 +0100
+++ new/yast2-instserver-4.1.5/src/include/instserver/dialogs.rb        
2018-12-04 14:50:55.000000000 +0100
@@ -7,6 +7,7 @@
 #
 
 require "fileutils"
+require "shellwords"
 
 module Yast
   module InstserverDialogsInclude
@@ -69,7 +70,7 @@
     def LinkTarget(source)
       ret = ""
 
-      command = Ops.add("ls -l ", source)
+      command = "/usr/bin/ls -l #{source.shellescape}"
       res = Convert.to_map(SCR.Execute(path(".target.bash_output"), command))
       out = Builtins.splitstring(Ops.get_string(res, "stdout", ""), "\n")
 
@@ -429,12 +430,12 @@
             end
           end
 
-          Builtins.foreach(media) do |m|
-            if Builtins.substring(m, 0, 5) == "MEDIA"
-              m = Builtins.substring(m, 7)
+          Builtins.foreach(media) do |medium|
+            if Builtins.substring(medium, 0, 5) == "MEDIA"
+              medium = Builtins.substring(medium, 7)
 
-              if !Builtins.contains(medianames, m)
-                medianames = Builtins.add(medianames, m)
+              if !Builtins.contains(medianames, medium)
+                medianames = Builtins.add(medianames, medium)
               end
             end
           end
@@ -499,7 +500,7 @@
 
               found = true if IsBaseProduct(content, cont_file)
             end
-          end 
+          end
 
 
           if !found &&
@@ -511,10 +512,8 @@
                 0
               )
             # check also subdirectories
-            cmd = Builtins.sformat(
-              "cd %1; find -maxdepth 1 -type d",
-              Ops.add(Installation.sourcedir, "/yast")
-            )
+            yast_subdir = File.join(Installation.sourcedir, "yast")
+            cmd = "cd #{yast_subdir.shellescape}; /usr/bin/find -maxdepth 1 
-type d",
             Builtins.y2milestone("find command: %1", cmd)
             out = Convert.to_map(SCR.Execute(path(".target.bash_output"), cmd))
 
@@ -525,10 +524,7 @@
             Builtins.y2milestone("found product subdirectories: %1", dirs)
 
             Builtins.foreach(dirs) do |d|
-              cont_file = Ops.add(
-                Ops.add(Ops.add(Installation.sourcedir, "/yast/"), d),
-                "/content"
-              )
+              cont_file = File.join(yast_subdir, d, "content")
               Builtins.y2milestone("Trying content file: %1", cont_file)
               found = true if IsBaseProduct(content, cont_file)
             end
@@ -680,19 +676,19 @@
         if Instserver.test
           cmds = Builtins.add(
             cmds,
-            Builtins.sformat("cp -pR %1/media.%2 %3", cdpath, current_cd, tgt)
+            Builtins.sformat("/usr/bin/cp -pR %1/media.%2 %3", 
cdpath.shellescape, current_cd.shellescape, tgt.shellescape)
           )
           cmds = Builtins.add(
             cmds,
-            Builtins.sformat("cp  %1/content %2", cdpath, tgt)
+            Builtins.sformat("/usr/bin/cp  %1/content %2", cdpath.shellescape, 
tgt.shellescape)
           )
         else
           cmds = Builtins.add(
             cmds,
             Builtins.sformat(
-              "cd %1 && tar cf - . | (cd %2  && tar xBf -)",
-              cdpath,
-              tgt
+              "cd %1 && /usr/bin/tar cf - . | (cd %2  && /usr/bin/tar xBf -)",
+              cdpath.shellescape,
+              tgt.shellescape
             )
           )
         end
@@ -758,8 +754,8 @@
 
           # workaround for flat directory structure (NLD9) - preserve the 
original content
           move = Builtins.sformat(
-            "cd %1; test -d boot -a ! -L boot && mv -b boot boot.old && ln -s 
boot.old boot",
-            dir
+            "cd %1; /usr/bin/test -d boot -a ! -L boot && /usr/bin/mv -b boot 
boot.old && /usr/bin/ln -s boot.old boot",
+            dir.shellescape
           )
           SCR.Execute(path(".target.bash"), move)
 
@@ -770,7 +766,7 @@
           # remove the old "boot" link
           SCR.Execute(
             path(".target.bash"),
-            Builtins.sformat("rm -rf %1/boot", dir)
+            Builtins.sformat("/usr/bin/rm -rf %1/boot", dir.shellescape)
           )
 
           # if there are "root" and "rescue" images both then just create a 
new link
@@ -794,7 +790,7 @@
             end
             cmds = []
           else
-            mkdir = Builtins.sformat("mkdir %1/boot", dir)
+            mkdir = Builtins.sformat("/usr/bin/mkdir %1/boot", dir.shellescape)
             SCR.Execute(path(".target.bash"), mkdir)
 
             relprod = Builtins.substring(tgt, Ops.add(Builtins.size(dir), 1))
@@ -802,17 +798,17 @@
 
             # link the new content there (link every file/directory)
             linkcommand = Builtins.sformat(
-              "cd %1/boot; ln -s ../%2/boot/* .",
-              dir,
-              relprod
+              "cd %1/boot; /usr/bin/ln -s ../%2/boot/* .",
+              dir.shellescape,
+              relprod.shellescape
             )
             SCR.Execute(path(".target.bash"), linkcommand)
 
             # add missing links from the original product
             linkcommand = Builtins.sformat(
-              "cd %1/boot; ln -s ../%2/* .",
-              dir,
-              linktgt
+              "cd %1/boot; /usr/bin/ln -s ../%2/* .",
+              dir.shellescape,
+              linktgt.shellescape
             )
             SCR.Execute(path(".target.bash"), linkcommand)
 
@@ -820,8 +816,8 @@
             SCR.Execute(
               path(".target.bash"),
               Builtins.sformat(
-                "rm -f %1/boot/directory.yast; cd %1/boot; ls | grep -v -e 
'^\\.$' -e '^\\.\\.$' > %1/boot/directory.yast",
-                dir
+                "/usr/bin/rm -f %1/boot/directory.yast; cd %1/boot; 
/usr/bin/ls | /usr/bin/grep -v -e '^\\.$' -e '^\\.\\.$' > 
%1/boot/directory.yast",
+                dir.shellescape
               )
             )
           end
@@ -881,8 +877,8 @@
         SCR.Execute(
           path(".target.bash"),
           Builtins.sformat(
-            "rm -f %1/directory.yast; cd %1; ls -p | grep -v -e '^\\.$' -e 
'^\\.\\.$' -e 'directory.yast' > %1/directory.yast",
-            dir
+            "/usr/bin/rm -f %1/directory.yast; cd %1; /usr/bin/ls -p | 
/usr/bin/grep -v -e '^\\.$' -e '^\\.\\.$' -e 'directory.yast' > 
%1/directory.yast",
+            dir.shellescape
           )
         )
 
@@ -894,7 +890,7 @@
           out = Convert.to_map(
             SCR.Execute(
               path(".target.bash_output"),
-              Builtins.sformat("find %1 -type f -name MD5SUMS", dir)
+              Builtins.sformat("/usr/bin/find %1 -type f -name MD5SUMS", 
dir.shellescape)
             )
           )
           Builtins.foreach(
@@ -915,7 +911,7 @@
 
               SCR.Execute(path(".target.remove"), file)
 
-              command = Builtins.sformat("cd %1; md5sum * > MD5SUMS", md5dir)
+              command = Builtins.sformat("cd %1; /usr/bin/md5sum * > MD5SUMS", 
md5dir.shellescape)
               Builtins.y2milestone("Command: %1", command)
               SCR.Execute(path(".target.bash"), command, { "LANG" => "C" })
             end
@@ -1139,7 +1135,7 @@
             )
           else
             # copying has been aborted, remove the repository
-            cmd = Ops.add("/bin/rm -rf ", target)
+            cmd = "/bin/rm -rf #{target.shellescape}"
             Builtins.y2milestone("Removing directory %1", target)
 
             if SCR.Execute(path(".target.bash"), cmd) != 0
@@ -1241,7 +1237,7 @@
             next
           # create directory only for a new repository
           elsif Instserver.Config == {}
-            mkdircmd = Ops.add("mkdir -p ", target)
+            mkdircmd = "mkdir -p #{target.shellescape}"
 
             Builtins.y2debug("executing: %1", mkdircmd)
             if SCR.Execute(path(".target.bash"), mkdircmd) != 0
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/yast2-instserver-4.1.3/src/modules/Instserver.rb 
new/yast2-instserver-4.1.5/src/modules/Instserver.rb
--- old/yast2-instserver-4.1.3/src/modules/Instserver.rb        2018-11-23 
12:19:14.000000000 +0100
+++ new/yast2-instserver-4.1.5/src/modules/Instserver.rb        2018-12-04 
14:50:55.000000000 +0100
@@ -10,6 +10,7 @@
 require "yast"
 require "y2firewall/firewalld"
 require "yast2/systemd/socket"
+require "shellwords"
 
 module Yast
   class InstserverClass < Module
@@ -102,7 +103,7 @@
     def vsftpd_is_standalone
       ret = SCR.Execute(
         path(".target.bash"),
-        "grep -q '^listen=YES$' /etc/vsftpd.conf"
+        "/usr/bin/grep -q '^listen=YES$' /etc/vsftpd.conf"
       ) == 0
 
       Builtins.y2milestone("vsftpd in standalone mode: %1", ret)
@@ -342,14 +343,14 @@
       # create repository directory if it doesn't exist
       SCR.Execute(
         path(".target.bash"),
-        Builtins.sformat("[ -d %1 ] || /bin/mkdir %1", dir)
+        "/usr/bin/mkdir -p #{dir.shellescape}"
       )
 
       if !Builtins.issubstring(dir, ftproot)
         if ftpalias != ""
           a = ""
           a = Ops.add(Ops.add(ftproot, "/"), ftpalias)
-          SCR.Execute(path(".target.bash"), Ops.add("mkdir -p ", a))
+          SCR.Execute(path(".target.bash"), "/usr/bin/mkdir -p 
#{a.shellescape}")
           ftproot = a
         end
         Builtins.y2milestone("binding dir")
@@ -691,7 +692,7 @@
 
     def GetHostname
       output = Convert.to_map(
-        SCR.Execute(path(".target.bash_output"), "/bin/hostname --long")
+        SCR.Execute(path(".target.bash_output"), "/usr/bin/hostname --long")
       )
       Builtins.y2milestone("hostname --long: %1", output)
       hostname = Ops.get_string(output, "stdout", "")
@@ -917,17 +918,6 @@
           :from => "map",
           :to   => "map <string, string>"
         )
-
-        # TODO: checking?
-        #      // don't check the overwritten config file
-        #      // get names of all config files except the rewritten one
-        #      map lsout = (map)SCR::Execute(.target.bash_output, "/bin/ls 
/etc/slp.reg.d/* | grep -v /etc/slp.reg.d/YaST-sles9.reg");
-        #      if (lsout["exit"]:-1 == 0)
-        #      {
-        #          // merge the output into single line
-        #          checkfiles = mergestring(splitstring(lsout["stdout"]:"", 
"\n"), " ");
-        #          y2debug("files to check: %1", checkfiles);
-        #      }
       end
 
       # escape invalid characters
@@ -955,9 +945,8 @@
     def DetectMedia
       if Ops.get_string(@ServerSettings, "directory", "") != ""
         f = Builtins.sformat(
-          "find %1 -maxdepth 2 -name %2 | grep -v yast",
-          Ops.get_string(@ServerSettings, "directory", ""),
-          "content"
+          "/usr/bin/find %1 -maxdepth 2 -name content | /usr/bin/grep -v yast",
+          @ServerSettings["directory"].shellescape
         )
         ret = Convert.to_map(SCR.Execute(path(".target.bash_output"), f))
         found = Builtins.splitstring(Ops.get_string(ret, "stdout", ""), "\n")
@@ -1211,7 +1200,7 @@
           c2
         )
         Builtins.y2milestone("removing directory: %1", dir)
-        rm = Ops.add("rm -rf ", dir)
+        rm = Ops.add("/usr/bin/rm -rf ", dir.shellescape)
         SCR.Execute(path(".target.bash"), rm)
       end
 
@@ -1251,13 +1240,13 @@
         # remove old reg file
         old_regfile = Builtins.sformat("/etc/slp.reg.d/YaST-%1.reg", orig)
         Builtins.y2milestone("removing old reg file: %1", old_regfile)
-        SCR.Execute(path(".target.bash"), Ops.add("rm -f ", old_regfile))
+        SCR.Execute(path(".target.bash"), "/usr/bin/rm -f 
#{old_regfile.shellescape}")
         # rename the directory
         cmd = Builtins.sformat(
-          "mv %1/%2 %1/%3",
-          Ops.get_string(@ServerSettings, "directory", ""),
-          orig,
-          new
+          "/usr/bin/mv %1/%2 %1/%3",
+          Ops.get_string(@ServerSettings, "directory", "").shellescape,
+          orig.shellescape,
+          new.shellescape
         )
         Builtins.y2milestone("moving directory: %1", cmd)
         if SCR.Execute(path(".target.bash"), cmd) != 0


Reply via email to