We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent 7c79f2a commit 518d406Copy full SHA for 518d406
django/bin/compile-messages.py
@@ -19,7 +19,14 @@ def compile_messages():
19
if f.endswith('.po'):
20
sys.stderr.write('processing file %s in %s\n' % (f, dirpath))
21
pf = os.path.splitext(os.path.join(dirpath, f))[0]
22
- cmd = 'msgfmt -o "%s.mo" "%s.po"' % (pf, pf)
+ # Store the names of the .mo and .po files in an environment
23
+ # variable, rather than doing a string replacement into the
24
+ # command, so that we can take advantage of shell quoting, to
25
+ # quote any malicious characters/escaping.
26
+ # See http://cyberelk.net/tim/articles/cmdline/ar01s02.html
27
+ os.environ['djangocompilemo'] = pf + '.mo'
28
+ os.environ['djangocompilepo'] = pf + '.po'
29
+ cmd = 'msgfmt -o "$djangocompilemo" "$djangocompilepo"'
30
os.system(cmd)
31
32
if __name__ == "__main__":
0 commit comments