Shell injection in trash deletion via specially crafted filenames

[James Lu]

Steps to reproduce:

1) Rename any image to the format 'test";"<command name>";".png' (e.g. test";"galculator";".png) and set it as wallpaper.
2) Attempt to delete the wallpaper via "Delete to Trash" in the Variety indicator menu.
3) The code nested in the command name will trigger 3 times as each trash command fails, as it is passed an incomplete filename.

Fortunately, the security impact of this bug is low because it requires user intervention and a weird filename in the first place. This is fixed in commit https://bazaar.launchpad.net/~variety/variety/trunk/revision/614 and will be present in the next release.