From 9f2dbef4f09f00c7043eba5fc16d26180805ccfe Mon Sep 17 00:00:00 2001
From: Bill Ferguson <wpferguson@gmail.com>
Date: Wed, 5 Jun 2024 12:15:01 -0400
Subject: [PATCH] lib/dtutils/system added local helper function
 quote_windows_command() to                    wrap a windows command in
 quotes.  Added a sanitize step                    to
 windows_external_command() plus quote_windows_command()                    to
 deal with all the windows username possibilities

---
 lib/dtutils/system.lua | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/lib/dtutils/system.lua b/lib/dtutils/system.lua
index 87a1f23..e8ce9af 100644
--- a/lib/dtutils/system.lua
+++ b/lib/dtutils/system.lua
@@ -1,6 +1,7 @@
 local dtutils_system = {}
 
 local dt = require "darktable"
+local ds = require "lib/dtutils.string"
 
 dtutils_system.libdoc = {
   Name = [[dtutils.system]],
@@ -50,9 +51,9 @@ function dtutils_system.external_command(command)
   local result = nil
 
   if dt.configuration.running_os == "windows" then
-    result = dtutils_system.windows_command(command)
+    result = dtutils_system.windows_command(ds.sanitize(command))
   else
-    result = dt.control.execute(command)
+    result = dt.control.execute(ds.sanitize(command))
   end
 
   return result
@@ -77,15 +78,20 @@ dtutils_system.libdoc.functions["windows_command"] = {
   Copyright = [[]],
 }
 
+local function quote_windows_command(command)
+  return "\"" .. command .. "\""
+end
+
 function dtutils_system.windows_command(command)
   local result = 1
 
-  local fname = dt.configuration.tmp_dir .. "/run_command.bat"
+  local fname = ds.sanitize(dt.configuration.tmp_dir .. "/run_command.bat")
 
   local file = io.open(fname, "w")
   if file then
     dt.print_log("opened file")
     command = string.gsub(command, "%%", "%%%%") -- escape % from windows shell
+    command = quote_windows-command(command)
     file:write(command)
     file:close()
 
@@ -149,7 +155,7 @@ dtutils_system.libdoc.functions["os_execute"] = {
 
 function dtutils_system.os_execute(cmd)
   if dt.configuration.running_os == "windows" then
-    cmd = "\"" .. cmd .. "\""
+    cmd = quote_windows_command(cmd)
   end
   return os.execute(cmd)
 end
@@ -174,7 +180,7 @@ dtutils_system.libdoc.functions["io_popen"] = {
 
 function dtutils_system.io_popen(cmd)
   if dt.configuration.running_os == "windows" then
-    cmd = "\"" .. cmd .. "\""
+    cmd = quote_windows_command(cmd)
   end
   return io.popen(cmd)
 end