* Check command injection.

module/repo/lang/zh-cn.php

@@ -215,7 +215,7 @@ $lang->repo->error->clientVersion = "客户端版本过低，请升级或更换S
 $lang->repo->error->encoding      = "编码可能错误，请更换编码重试。";
 $lang->repo->error->deleted       = "删除代码库失败，当前代码库有提交记录与设计关联";
 $lang->repo->error->linkedJob     = "删除代码库失败，当前代码库与构建有关联，请取消关联或删除构建。";
-$lang->repo->error->clientPath    = "客户端安装目录不能有空格！";
+$lang->repo->error->clientPath    = "客户端安装目录不能有空格和特殊字符！";
 $lang->repo->error->notFound      = "代码库『%s』路径 %s 不存在，请确认此代码库是否已在本地服务器被删除";
 $lang->repo->error->noWritable    = '%s 不可写！请检查该目录权限，否则无法下载。';
 $lang->repo->error->noCloneAddr   = '该项目克隆地址未找到';

module/repo/model.php

@@ -1452,7 +1452,8 @@ class repoModel extends model
             return false;
         }
 
-        if(strpos($this->post->client, ' '))
+        /* Check command injection. */
+        if(preg_match('/[ #&;`,\|*?~<>^()\[\]{}$]/', $this->post->client))
         {
             dao::$errors['client'] = $this->lang->repo->error->clientPath;
             return false;