Quote and escape the binary path.

diff --git a/includes/DjVuImage.php b/includes/DjVuImage.php
index 7872cf0..8033c32 100644 (file)
--- a/includes/DjVuImage.php
+++ b/includes/DjVuImage.php
@@ -220,7 +220,7 @@ class DjVuImage {
        function retrieveMetaData() {
                global $wgDjvuToXML;
                if ( isset( $wgDjvuToXML ) ) {
-                       $cmd = $wgDjvuToXML . ' --without-anno --without-text ' .
+                       $cmd = wfEscapeShellArg( $wgDjvuToXML ) . ' --without-anno --without-text ' .
                                wfEscapeShellArg( $this->mFilename );
                        $xml = wfShellExec( $cmd );
                } else {