From f281ed3e6888b50fdaaf615a0e6065b391fb9409 Mon Sep 17 00:00:00 2001
From: Zac Medico <zmedico@gentoo.org>
Date: Sun, 29 Apr 2007 06:33:47 +0000
Subject: For bug #175058, avoid potential quoting issues by spawning
 FETCHCOMMAND without a shell.

svn path=/main/trunk/; revision=6456
---
 cnf/make.globals        |  4 ++--
 pym/portage/__init__.py | 15 +++++++++------
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/cnf/make.globals b/cnf/make.globals
index 51475f12a..45ffea680 100644
--- a/cnf/make.globals
+++ b/cnf/make.globals
@@ -29,8 +29,8 @@ RPMDIR=/usr/portage/rpm
 PORTAGE_TMPDIR=/var/tmp
 
 # Fetching command (5 tries, passive ftp for firewall compatibility)
-FETCHCOMMAND="/usr/bin/wget -t 5 -T 60 --passive-ftp -P \\\"\${DISTDIR}\\\" \\\"\${URI}\\\""
-RESUMECOMMAND="/usr/bin/wget -c -t 5 -T 60 --passive-ftp -P \\\"\${DISTDIR}\\\" \\\"\${URI}\\\""
+FETCHCOMMAND="/usr/bin/wget -t 5 -T 60 --passive-ftp -P \${DISTDIR} \${URI}"
+RESUMECOMMAND="/usr/bin/wget -c -t 5 -T 60 --passive-ftp -P \${DISTDIR} \${URI}"
 
 # Default user options
 FEATURES="sandbox distlocks metadata-transfer"
diff --git a/pym/portage/__init__.py b/pym/portage/__init__.py
index ae4f2b43e..04294ce12 100644
--- a/pym/portage/__init__.py
+++ b/pym/portage/__init__.py
@@ -2601,9 +2601,6 @@ def fetch(myuris, mysettings, listonly=0, fetchonly=0, locks_in_subdir=".locks",
 				else:
 					resumecommand=mysettings["RESUMECOMMAND"]
 
-				fetchcommand=fetchcommand.replace("${DISTDIR}",mysettings["DISTDIR"])
-				resumecommand=resumecommand.replace("${DISTDIR}",mysettings["DISTDIR"])
-
 				if not can_fetch:
 					if fetched != 2:
 						if fetched == 0:
@@ -2633,8 +2630,14 @@ def fetch(myuris, mysettings, listonly=0, fetchonly=0, locks_in_subdir=".locks",
 						locfetch=fetchcommand
 					writemsg_stdout(">>> Downloading '%s'\n" % \
 						re.sub(r'//(.+):.+@(.+)/',r'//\1:*password*@\2/', loc))
-					myfetch=locfetch.replace("${URI}",loc)
-					myfetch=myfetch.replace("${FILE}",myfile)
+					myfetch = locfetch.split()
+					variables = {"${DISTDIR}":mysettings["DISTDIR"],
+						"${URI}":loc, "${FILE}":myfile}
+					for i in xrange(len(myfetch)):
+						token = myfetch[i].strip("\"'")
+						value = variables.get(token)
+						if value is not None:
+							myfetch[i] = value
 
 					spawn_keywords = {}
 					if "userfetch" in mysettings.features and \
@@ -2652,7 +2655,7 @@ def fetch(myuris, mysettings, listonly=0, fetchonly=0, locks_in_subdir=".locks",
 							con = con.replace(mysettings["PORTAGE_T"], mysettings["PORTAGE_FETCH_T"])
 							selinux.setexec(con)
 
-						myret = portage.process.spawn_bash(myfetch,
+						myret = portage.process.spawn(myfetch,
 							env=mysettings.environ(), **spawn_keywords)
 
 						if mysettings.selinux_enabled():
-- 
cgit v1.2.3-1-g7c22