pilprint.py allows Shell Command Injection

[TheRegRunner]

With the the "-P" option, any shell command can get into the printer variable %a and will be executed.
In this screenshot you can see that i could inject the command ';xeyes;' wich starts the program xeyes.

So please remove "os.popen" and use "subprocess" instead.

[radarhere]

Thanks for the suggestion. I've created a PR.

[TheRegRunner]

Please change Version infos, and history too. Thank you.

History:
0.1 1996-04-20 fl Created
0.2 1996-10-04 fl Use draft mode when converting.
0.3 2003-05-06 fl Fixed a typo or two.

...

VERSION = "pilprint 0.3/2003-05-05"
...

print("PIL Print 0.2a1/96-10-04 -- print image files")

[radarhere]

If you look at some of the other files, you'll notice that this is not the only one with version and history info like that. Without consensus to begin updating the version and history data across all files, I don't think that such a PR would be approved.

You're welcome to present an argument for why this change should be made across the system, ideally in a new issue since it's unrelated to the injection problem.

[wiredfool]

I'd actually prefer to kill the changelog banner on all the files, since it's so out of date on anything that we're actually working on. The only thing it's actually useful for is determining which prehistoric layer of PIL the file is actually from.

Probably only retain a license and any copyright info, but I'd have to spot check more to see if there's any other useful info there.