python-pillow/Pillow — pull request #731 by mbrown1413 (2014-06-26 02:11:07+00:00)
Title: Prevent shell injection in load_djpeg

Although `JpegImageFile.load_djpeg` isn't documented or used anywhere, it is public. This fix prevents shell injection in filenames that contain single quotes.