Command check

couchpotato/core/_base/updater/main.py

@@ -7,6 +7,7 @@ import traceback
 import zipfile
 from datetime import datetime
 from threading import RLock
+import re
 
 from couchpotato.api import addApiView
 from couchpotato.core.event import addEvent, fireEvent, fireEventAsync
@@ -34,7 +35,10 @@ class Updater(Plugin):
         if Env.get('desktop'):
             self.updater = DesktopUpdater()
         elif os.path.isdir(os.path.join(Env.get('app_dir'), '.git')):
-            self.updater = GitUpdater(self.conf('git_command', default = 'git'))
+            git_default = 'git'
+            git_command = self.conf('git_command', default = git_default)
+            git_command = git_command if git_command != git_default and (os.path.isfile(git_command) or re.match('^[a-zA-Z0-9_/\.\-]+$', git_command)) else git_default
+            self.updater = GitUpdater(git_command)
         else:
             self.updater = SourceUpdater()
 

couchpotato/core/plugins/renamer.py

@@ -1202,7 +1202,10 @@ Remove it if you want it to be renamed (again, or at least let it try again)
 
             log.info('Archive %s found. Extracting...', os.path.basename(archive['file']))
             try:
-                rar_handle = RarFile(archive['file'], custom_path = self.conf('unrar_path'))
+                unrar_path = self.conf('unrar_path')
+                unrar_path = unrar_path if unrar_path and (os.path.isfile(unrar_path) or re.match('^[a-zA-Z0-9_/\.\-]+$', unrar_path)) else None
+
+                rar_handle = RarFile(archive['file'], custom_path = unrar_path)
                 extr_path = os.path.join(from_folder, os.path.relpath(os.path.dirname(archive['file']), folder))
                 self.makeDir(extr_path)
                 for packedinfo in rar_handle.infolist():