Prevent shell injection by escaping backticks + dollar sign

Signed-off-by: Jan Pokorný <jpokorny@redhat.com>

1 files changed, 5 insertions, 3 deletions

diff --git a/notify.pl b/notify.pl
index 1178307..e93633e 100644
--- a/notify.pl
+++ b/notify.pl
@@ -10,14 +10,14 @@ use Irssi;
 use vars qw($VERSION %IRSSI);
 use HTML::Entities;
 
-$VERSION = "0.01";
+$VERSION = "0.01_jpokorny";
 %IRSSI = (
-    authors     => 'Luke Macken, Paul W. Frields',
+    authors     => 'Luke Macken, Paul W. Frields (+ minor ad-hoc tweaking by Jan Pokorny)',
     contact     => 'lewk@csh.rit.edu, stickster@gmail.com',
     name        => 'notify.pl',
     description => 'Use libnotify to alert user to hilighted messages',
     license     => 'GNU General Public License',
-    url         => 'http://lewk.org/log/code/irssi-notify',
+    url         => 'http://fedorapeople.org/cgit/jpokorny/public_git/irssi-notify.git',
 );
 
 Irssi::settings_add_str('notify', 'notify_icon', 'gtk-dialog-info');
@@ -25,6 +25,8 @@ Irssi::settings_add_str('notify', 'notify_time', '5000');
 
 sub sanitize {
   my ($text) = @_;
+  $text =~ s/`/\\`/g;
+  $text =~ s/\$/\\\$/g;
   encode_entities($text);
   return $text;
 }