-
Notifications
You must be signed in to change notification settings - Fork 22
Description
#61 seems to have broken excluding folders. 2d265e4 still works but f5b532c doesn't. This also isn't covered by the tests which might explain why it went unnoticed.
When we have a .distignore file that contains just .git the .git folder is not excluded from the archive.
Before #61 this would have resulted in the following command being actually run:
zip -r '/var/www/html/wp-content/themes/myplugin.zip' myplugin --exclude \*/.git/\*
Now what is run for .git is
zip -r '/var/www/html/wp-content/themes/myplugin.0.0.1.zip' myplugin --exclude */.git --exclude */.git/* --exclude */.git/
Also when trying the newly anchored version /.git we get
zip -r '/var/www/html/wp-content/themes/myplugin.0.0.1.zip' myplugin --exclude myplugin/.git --exclude myplugin/.git/* --exclude myplugin/.git/
The problem seems to be this line:
dist-archive-command/src/Dist_Archive_Command.php
Lines 246 to 247 in 55f14e8
| $escaped_shell_command = $this->escapeshellcmd( $cmd, array( '^', '*' ) ); | |
| $ret = WP_CLI::launch( $escaped_shell_command, false, true ); |
When I turn it back into what it was before
| $ret = WP_CLI::launch( escapeshellcmd( $cmd ), false, true ); |
we get this again which works:
zip -r '/var/www/html/wp-content/themes/myplugin.0.0.1.zip' myplugin --exclude \*/.git --exclude \*/.git/\* --exclude \*/.git/
So undoing the shell escaping seems to break things. Also I am not sure why this is needed anyway. Also feels risky from a security perspective. Maybe @BrianHenryIE or @schlessera can add some context why this was done in the first place in #61.
While we're at it: There are actually 3 excludes added now. While a single seems to also do the job:
zip -r '/var/www/html/wp-content/themes/romanesco.0.4.1.zip' romanesco --exclude \*/.git/\*
Final note: Since I already spent way more time on it today than I currently have I only tested this on Linux. I also can't find time for a PR right now, but I thought I'd at least leave this here as a brain dump in case someone else hits this as well and/or finds time for a PR before me.