diff -urN teTeX-src-beta-20001218.orig/texk/kpathsea/tex-make.c teTeX-src-beta-20001218/texk/kpathsea/tex-make.c --- teTeX-src-beta-20001218.orig/texk/kpathsea/tex-make.c Tue Jan 26 21:31:23 1999 +++ teTeX-src-beta-20001218/texk/kpathsea/tex-make.c Thu Oct 24 18:50:06 2002 @@ -138,14 +138,6 @@ int save_stderr = -1; #endif - /* If the user snuck `backquotes` or $(command) substitutions into the - name, foil them. */ - for (i = 0; i < strlen (cmd); i++) { - if (cmd[i] == '`' || (cmd[i] == '$' && cmd[i+1] == '(')) { - cmd[i] = '#'; - } - } - /* Tell the user we are running the script, so they have a clue as to what's going on if something messes up. But if they asked to discard output, they probably don't want to see this, either. */ @@ -259,10 +251,31 @@ string args, cmd; const_string prog = spec.program; const_string arg_spec = spec.program_args; + unsigned int i; if (format <= kpse_any_glyph_format) set_maketex_mag (); + /* If the user snuck `backquotes` or $(command) substitutions etc + into the name, foil them. + Thwart ../ in file names too. + */ + for (i = 0; i < strlen (base); i++) { + char c = base[i]; + + if (c == '.' && base[i+1] == '.' && base[i+2] == '/') { + base[i] = base[i+1] = '_'; + continue; + } + + if (('A' <= c && c <= 'Z') + || ('a' <= c && c <= 'z') + || ('0' <= c && c <= '9') + || strchr("_-.", c)) + continue; + base[i] = '#'; + } + /* Here's an awful kludge: if the mode is `/', mktexpk recognizes it as a special case. `kpse_prog_init' sets it to this in the first place when no mode is otherwise specified; this is so