fix: bad quoting in hook scripts allow word splitting, leading to hook script errors (#13679)

Fixes #13662

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13679
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>

Author: PatDyn

modules/git/hook_generate.go

@@ -20,9 +20,9 @@ func getHookTemplates() (hookNames, hookTpls, giteaHookTpls []string) {
 # AUTO GENERATED BY GITEA, DO NOT MODIFY
 data=$(cat)
 exitcodes=""
-hookname=$(basename $0)
+hookname=$(basename "$0")
 
-for hook in $(dirname $0)/${hookname}.d/*; do
+for hook in "$(dirname "$0")/${hookname}.d"/*; do
   test -x "${hook}" && test -f "${hook}" || continue
   echo "${data}" | "${hook}"
   exitcodes="${exitcodes} $?"
@@ -31,8 +31,8 @@ done
 # Custom hooks
 custom_hooks_dir="./hooks/${hookname}.d"
 if [ -d "${custom_hooks_dir}" ]; then
-  for hook in ${custom_hooks_dir}/*; do
-    if [ $(basename "${hook}") != "gitea" ]; then
+  for hook in "${custom_hooks_dir}"/*; do
+    if [ "$(basename "${hook}")" != "gitea" ]; then
       test -x "${hook}" && test -f "${hook}" || continue
       echo "${data}" | "${hook}"
       exitcodes="${exitcodes} $?"
@@ -41,36 +41,36 @@ if [ -d "${custom_hooks_dir}" ]; then
 fi
 
 for i in ${exitcodes}; do
-  [ ${i} -eq 0 ] || exit ${i}
+  [ "${i}" -eq 0 ] || exit "${i}"
 done
 `, setting.ScriptType),
 
 		// for update
 		fmt.Sprintf(`#!/usr/bin/env %s
 # AUTO GENERATED BY GITEA, DO NOT MODIFY
 exitcodes=""
-hookname=$(basename $0)
+hookname=$(basename "$0")
 
-for hook in $(dirname $0)/${hookname}.d/*; do
+for hook in "$(dirname "$0")/${hookname}.d"/*; do
   test -x "${hook}" && test -f "${hook}" || continue
-  "${hook}" $1 $2 $3
+  "${hook}" "$1" "$2" "$3"
   exitcodes="${exitcodes} $?"
 done
 
 # Custom hooks
 custom_hooks_dir="./hooks/${hookname}.d"
 if [ -d "${custom_hooks_dir}" ]; then
-  for hook in ${custom_hooks_dir}/*; do
-    if [ $(basename "${hook}") != "gitea" ]; then
+  for hook in "${custom_hooks_dir}"/*; do
+    if [ "$(basename "${hook}")" != "gitea" ]; then
       test -x "${hook}" && test -f "${hook}" || continue
-      "${hook}" $1 $2 $3
+      "${hook}" "$1" "$2" "$3"
       exitcodes="${exitcodes} $?"
     fi
   done
 fi
 
 for i in ${exitcodes}; do
-  [ ${i} -eq 0 ] || exit ${i}
+  [ "${i}" -eq 0 ] || exit "${i}"
 done
 `, setting.ScriptType),
 
@@ -79,9 +79,9 @@ done
 # AUTO GENERATED BY GITEA, DO NOT MODIFY
 data=$(cat)
 exitcodes=""
-hookname=$(basename $0)
+hookname=$(basename "$0")
 
-for hook in $(dirname $0)/${hookname}.d/*; do
+for hook in "$(dirname "$0")/${hookname}.d"/*; do
   test -x "${hook}" && test -f "${hook}" || continue
   echo "${data}" | "${hook}"
   exitcodes="${exitcodes} $?"
@@ -90,16 +90,16 @@ done
 # Custom hooks
 custom_hooks_dir="./hooks/${hookname}.d"
 if [ -d "${custom_hooks_dir}" ]; then
-  for hook in ${custom_hooks_dir}/*; do
-    if [ $(basename "${hook}") != "gitea" ]; then
+  for hook in "${custom_hooks_dir}"/*; do
+    if [ "$(basename "${hook}")" != "gitea" ]; then
       test -x "${hook}" && test -f "${hook}" || continue
       echo "${data}" | "${hook}"
       exitcodes="${exitcodes} $?"
     fi
   done
 fi
 for i in ${exitcodes}; do
-  [ ${i} -eq 0 ] || exit ${i}
+  [ "${i}" -eq 0 ] || exit "${i}"
 done
 `, setting.ScriptType),
 	}