More shell updates

system/cron

@@ -145,6 +145,7 @@ import os
 import re
 import tempfile
 import platform
+import pipes
 
 CRONCMD = "/usr/bin/crontab"
 
@@ -190,7 +191,8 @@ class CronTab(object):
             except:
                 raise CronTabError("Unexpected error:", sys.exc_info()[0])
         else:
-            (rc, out, err) = self.module.run_command(self._read_user_execute())
+            # using safely quoted shell for now, but this really should be two non-shell calls instead.  FIXME
+            (rc, out, err) = self.module.run_command(self._read_user_execute(), use_unsafe_shell=True)
 
             if rc != 0 and rc != 1: # 1 can mean that there are no jobs.
                 raise CronTabError("Unable to read crontab")
@@ -235,8 +237,8 @@ class CronTab(object):
 
         # Add the entire crontab back to the user crontab
         if not self.cron_file:
-            # os.system(self._write_execute(path))
+            # quoting shell args for now but really this should be two non-shell calls.  FIXME
-            (rc, out, err) = self.module.run_command(self._write_execute(path))
+            (rc, out, err) = self.module.run_command(self._write_execute(path), use_unsafe_shell=True)
             os.unlink(path)
 
             if rc != 0:
@@ -350,9 +352,9 @@ class CronTab(object):
         user = ''
         if self.user:
             if platform.system() == 'SunOS':
-                return "su '%s' -c '%s -l'" % (self.user, CRONCMD)
+                return "su %s -c '%s -l'" % (pipes.quote(self.user), pipes.quote(CRONCMD))
             else:
-                user = '-u %s' % self.user
+                user = '-u %s' % pipes.quote(self.user)
         return "%s %s %s" % (CRONCMD , user, '-l')
 
     def _write_execute(self, path):
@@ -362,10 +364,10 @@ class CronTab(object):
         user = ''
         if self.user:
             if platform.system() == 'SunOS':
-                return "chown %s %s ; su '%s' -c '%s %s'" % (self.user, path, self.user, CRONCMD, path)
+                return "chown %s %s ; su '%s' -c '%s %s'" % (pipes.quote(self.user), pipes.quote(path), pipes.quote(self.user), CRONCMD, pipes.quote(path))
             else:
-                user = '-u %s' % self.user
+                user = '-u %s' % pipes.quote(self.user)
-        return "%s %s %s" % (CRONCMD , user, path)
+        return "%s %s %s" % (CRONCMD , user, pipes.quote(path))
 
 
 

system/debconf

@@ -84,6 +84,8 @@ debconf: name='oracle-java7-installer' question='shared/accepted-oracle-license-
 debconf: name='tzdata'
 '''
 
+import pipes
+
 def get_selections(module, pkg):
     cmd = [module.get_bin_path('debconf-show', True), pkg]
     rc, out, err = module.run_command(' '.join(cmd))
@@ -105,11 +107,11 @@ def set_selection(module, pkg, question, vtype, value, unseen):
     data = ' '.join([ question, vtype, value ])
 
     setsel = module.get_bin_path('debconf-set-selections', True)
-    cmd = ["echo '%s %s' |" % (pkg, data), setsel]
+    cmd = ["echo '%s %s' |" % (pipes.quote(pkg), pipes.quote(data)), setsel]
     if unseen:
         cmd.append('-u')
 
-    return module.run_command(' '.join(cmd))
+    return module.run_command(' '.join(cmd), use_unsafe_shell=True)
 
 def main():
 

system/hostname

@@ -286,7 +286,7 @@ class FedoraStrategy(GenericStrategy):
 
     def get_permanent_hostname(self):
         cmd = 'hostnamectl status | awk \'/^ *Static hostname:/{printf("%s", $3)}\''
-        rc, out, err = self.module.run_command(cmd)
+        rc, out, err = self.module.run_command(cmd, use_unsafe_shell=True)
         if rc != 0:
             self.module.fail_json(msg="Command failed rc=%d, out=%s, err=%s" %
                 (rc, out, err))