custom command arguments not escaped

[wommel]

the variables for to the custom should be shell-escaped or the cusom command should be called diffrently than via shell string.

currently it is possible to execute random shell code (at least on linux). for example setting:

custom command: /usr/bin/notify-send '%title' '%text' %title: %a $text: %s

now recieving an email titled "' $(echo asdf)" will cause notify-send to be called with 'asdf' as second parameter

[mkiol]

Thank you for the report.

I will fix it in the next release.

[mkiol]

The Issue has been fixed in the latest dev xpi.