Merge lp:~robru/bileto/fix-authors into lp:bileto

[Robert Bruce Park]

Fix specifying multiple authors on a merge commit.

[lp:~robru/bileto/fix-authors]

700. By Robert Bruce Park on 2016-08-23

Drop failed experiment.

701. By Robert Bruce Park on 2016-08-23

Protect against commit messages being run through eval.

702. By Robert Bruce Park on 2016-08-23

Escape author names.

=== modified file 'scripts/vcs.sh'
--- scripts/vcs.sh	2016-08-17 21:02:42 +0000
+++ scripts/vcs.sh	2016-08-23 17:24:18 +0000
@@ -303,14 +303,18 @@
     stdout bzr missing --theirs "$CACHE_SOURCE" >"$missing"
     for author in $(sed -n 's/^committer: //p' <"$missing" | sort | uniq); do
         output="$author, $output"
-        authors="$authors--author=$(echo $author | sed 's/ /\ /g') "
+        # Author name must be escaped to prevent dangerous eval abuse.
+        authors="$authors--author=$(echo "$author" | perl -lpe 's/(\W)/\\$1/gi') "
     done
     loudly bzr merge "$CACHE_SOURCE" || die "Failed to merge $BRANCH"
     if loudly debcommit; then
         echo '--DEBCOMMIT--'
     else
         [ -n "$MESSAGE" ] || die "Failed to commit $BRANCH. You must supply either a Commit Message on your MP, or a custom debian/changelog entry."
-        loudly bzr commit --unchanged $authors --message "$MESSAGE$BUGS$APPROVERS" || die "Failed to commit $BRANCH."
+        msgfile="$WORKPARENT/$$-commit.message"
+        echo "$MESSAGE$BUGS$APPROVERS" > "$msgfile"
+        eval "bzr commit --unchanged $authors --file=$msgfile" 1>&2 || die "Failed to commit $BRANCH."
+        loudly bzr log --limit 1 || die "Failed to display bzr log from $BRANCH."
         echo "$output"
     fi
     rm --recursive --force "$CACHE_SOURCE"