security: gitolite admin can get shell access by using screwy pubkey …

…name

example: keydir/sitaram@$(some-dangerous-command; echo hi).pub

(still won't get the reward; that is only if a non-admin user gets
privs!)

src/gl-compile-conf

@@ -511,6 +511,12 @@ print $newkeys_fh "# gitolite start\n";
 wrap_chdir($GL_KEYDIR);
 for my $pubkey (glob("*"))
 {
+    # security check (thanks to divVerent for catching this)
+    unless ($pubkey =~ $USERNAME_PATT) {
+        print STDERR "$pubkey contains some unsavoury characters; ignored...\n";
+        next;
+    }
+
     # lint check 1
     unless ($pubkey =~ /\.pub$/)
     {