[elpa] externals/org 8f7efd9d7d 2/3: Merge branch 'bugfix'

[ELPA Syncer]

branch: externals/org
commit 8f7efd9d7dfbcd1eac2dc4d445b6355425a329d5
Merge: f6e3b1a805 bc3caa8f90
Author: Ihor Radchenko <yantar92@posteo.net>
Commit: Ihor Radchenko <yantar92@posteo.net>

    Merge branch 'bugfix'
---
 lisp/ol-man.el | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lisp/ol-man.el b/lisp/ol-man.el
index feb9a1c326..12ad41a992 100644
--- a/lisp/ol-man.el
+++ b/lisp/ol-man.el
@@ -44,13 +44,27 @@
   :group 'org-link
   :type '(choice (const man) (const :tag "WoMan (obsolete)" woman)))
 
+(declare-function Man-translate-references "man" (ref))
 (defun org-man-open (path _)
   "Visit the manpage on PATH.
 PATH should be a topic that can be thrown at the man command.
 If PATH contains extra ::STRING which will use `occur' to search
 matched strings in man buffer."
+  (require 'man) ; For `Man-translate-references'
   (string-match "\\(.*?\\)\\(?:::\\(.*\\)\\)?$" path)
   (let* ((command (match-string 1 path))
+         ;; FIXME: Remove after we drop Emacs 29 support.
+         ;; Working around security bug #66390.
+         (command (if (org-man-store-link (equal (Man-translate-references 
";id") "\\;id"))
+                      ;; We are on Emacs that properly escapes man
+                      ;; command args (see Emacs commit 820f0793f0b).
+                      command
+                    ;; Older Emacs without the fix - escape the
+                    ;; arguments ourselves.
+                    (mapconcat 'identity
+                               (mapcar #'shell-quote-argument
+                                       (split-string command "\\s-+"))
+                               " ")))
          (search (match-string 2 path))
          (buffer (funcall org-man-command command)))
     (when search