newbamboo/rvideo — pull request #3 by infoman (2011-10-11 09:46:41+00:00)
Title: Shellescape filenames

Sometimes the filenames given to rvideo may have special characters in them like [], {}, and even '. This can happen, for example, if the file is uploaded to website by an untrusted user.

Such filenames will cause errors when transferred to shell commands from rvideo and can potentially lead to execution of attacker's code.

Using shellescape instead of just quoting likely fixes these issues.