Tar: do not assume exec yields a POSIX shell

plugins/_disabled/tar/tar.php

@@ -17,7 +17,7 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-$TAR_BINARY = "/usr/bin/tar";
+$TAR_BINARY = "/bin/tar";
 
 # Add arbitrary parameters to tar
 $TAR_FLAGS = "";
@@ -49,11 +49,11 @@ if ( ! is_dir($realDir) ) {
 
 function escapePath($path) {
   # same as escapeshellarg function but this supports utf8 regardless of locale
-  return str_replace("'", "'\\''", $path)."'";
+  return "'".str_replace("'", "'\\''", $path)."'";
 }
 
-$path = realpath(dirname($realDir));
-$filesarg = str_replace("'", "'\\''", basename($realDir))."'";
+$path = escapePath(realpath(dirname($realDir)));
+$filesarg = escapePath(basename($realDir));
 
 # compute and send content-length header
 if ($SEND_CONTENT_LENGTH) {