mercurial: Fix buggy getctime code.

The file passed to rcs_getctime is already absolute, and it was
trying to stick the srcdir on the front.

Also, eliminated potentially unsafe shelling.

IkiWiki/Plugin/mercurial.pm

@@ -236,15 +236,13 @@ sub rcs_diff ($) {
 sub rcs_getctime ($) {
 	my ($file) = @_;
 
-	# XXX filename passes through the shell here, should try to avoid
-	# that just in case
 	my @cmdline = ("hg", "-R", $config{srcdir}, "log", "-v",
-		"--style", "default", "$config{srcdir}/$file");
-	open (my $out, "@cmdline |");
+		"--style", "default", $file);
+	open (my $out, "-|", @cmdline);
 
-	my @log = mercurial_log($out);
+	my @log = (mercurial_log($out));
 
-	if (length @log < 1) {
+	if (@log < 1) {
 		return 0;
 	}
 

debian/changelog

@@ -23,6 +23,7 @@ ikiwiki (3.20100611) UNRELEASED; urgency=low
   * attachment: Support Windows paths when taking basename of client-supplied
     file name.
   * theme: New plugin, allows easily theming a site via the underlay.
+  * mercurial: Fix buggy getctime code.
 
  -- Joey Hess <joeyh@debian.org>  Fri, 11 Jun 2010 13:39:15 -0400