new restricted mode for \write18

git-svn-id: svn://tug.org/texlive/trunk@12244 c570f23f-e606-0410-a88d-b1316a301751

19 files changed, 959 insertions, 308 deletions

diff --git a/Build/source/texk/web2c/ChangeLog b/Build/source/texk/web2c/ChangeLog
index fff9dff3078..f34d249a006 100644
--- a/Build/source/texk/web2c/ChangeLog
+++ b/Build/source/texk/web2c/ChangeLog
@@ -1,3 +1,11 @@
+2009-02-26  Karl Berry  <karl@tug.org>
+
+	* texmfmp-help.h: mention --shell-restricted.
+	* tex.ch (c_int_type, shell_enabled_p, address_of): remove _'s
+	to reduce differences with luatex.
+	(restrictedshell): new global.
+	(system): replace with runsystem, for restricted mode.
+
 2009-01-26  Karl Berry  <karl@tug.org>
 
 	* configure.in (with_cxx_runtime_hack): use
diff --git a/Build/source/texk/web2c/NEWS b/Build/source/texk/web2c/NEWS
index 923b3c8c75e..dc70659df86 100644
--- a/Build/source/texk/web2c/NEWS
+++ b/Build/source/texk/web2c/NEWS
@@ -1,5 +1,7 @@
-This file records noteworthy changes.
+This file records noteworthy changes.  (Public domain.)
 
+* --shell-restricted aka shell_escape=p for restricted shell access.
+
 7.5.7 (for TeX Collection 2008, 7 July 2008)
 * Include Knuth's 2008 updates.
 * Include LuaTeX.
diff --git a/Build/source/texk/web2c/alephdir/ChangeLog b/Build/source/texk/web2c/alephdir/ChangeLog
index f6ba3e512f3..882b5323501 100644
--- a/Build/source/texk/web2c/alephdir/ChangeLog
+++ b/Build/source/texk/web2c/alephdir/ChangeLog
@@ -1,3 +1,9 @@
+2009-02-26  Karl Berry  <karl@tug.org>
+
+	* comsrcspec.ch, com16bit-rc2.ch:
+	Use runsystem() instead of system(), etc.  See tex.ch entry in
+	../ChangeLog
+
 2008-03-23  Karl Berry  <karl@freefriends.org>
 
 	* Update to TeX 3.1415926; compile in pool files.
diff --git a/Build/source/texk/web2c/alephdir/com16bit-rc2.ch b/Build/source/texk/web2c/alephdir/com16bit-rc2.ch
index 2b5c63d0923..d8f80265e7d 100644
--- a/Build/source/texk/web2c/alephdir/com16bit-rc2.ch
+++ b/Build/source/texk/web2c/alephdir/com16bit-rc2.ch
@@ -1008,7 +1008,7 @@ if_eof_code: begin scan_four_bit_int; b:=(read_open[cur_val]=closed);
   end;
 @y
 if_eof_code: begin scan_four_bit_int_or_18;
-  if cur_val=18 then b:=not shell_enabled_p
+  if cur_val=18 then b:=not shellenabledp
   else b:=(read_open[cur_val]=closed);
   end;
 @z
@@ -2361,7 +2361,7 @@ print(" (format="); print(job_name); print_char(" ");
 @d setup_bound_var(#)==bound_default:=#; setup_bound_var_end
 @d setup_bound_var_end(#)==bound_name:=#; setup_bound_var_end_end
 @d setup_bound_var_end_end(#)==
-  setup_bound_variable(address_of(#), bound_name, bound_default);
+  setup_bound_variable(addressof(#), bound_name, bound_default);
 
 @p procedure main_body;
 begin @!{|start_here|}
@@ -2581,6 +2581,7 @@ begin @<Expand macros in the token list
 @y
 @!d:integer; {number of characters in incomplete current string}
 @!clobbered:boolean; {system string is ok?}
+@!runsystem_ret:integer; {return value from |runsystem|}
 begin @<Expand macros in the token list
 @z
 
@@ -2603,34 +2604,39 @@ if j=18 then
   {If the log file isn't open yet, we can only send output to the terminal.
    Calling |open_log_file| from here seems to result in bad data in the log.}
   if not log_opened then selector:=term_only;
-  print_nl("system(");
+  print_nl("runsystem(");
   for d:=0 to cur_length-1 do
     begin {|print| gives up if passed |str_ptr|, so do it by hand.}
     print(so(str_pool[str_start(str_ptr)+d])); {N.B.: not |print_char|}
     end;
   print(")...");
-  if shell_enabled_p then
-    begin str_room(1); append_char(0); {Append a null byte to the expansion.}
+  if shellenabledp then begin
+    str_room(1); append_char(0); {Append a null byte to the expansion.}
     clobbered:=false;
     for d:=0 to cur_length-1 do {Convert to external character set.}
-      begin str_pool[str_start(str_ptr)+d]:=xchr[str_pool[str_start(str_ptr)+d]];
-      if (str_pool[str_start(str_ptr)+d]=null_code)
-         and (d<cur_length-1) then clobbered:=true;
+      begin
+        str_pool[str_start(str_ptr)+d]:=xchr[str_pool[str_start(str_ptr)+d]];
+        if (str_pool[str_start(str_ptr)+d]=null_code)
+           and (d<cur_length-1) then clobbered:=true;
         {minimal checking: NUL not allowed in argument string of |system|()}
       end;
     if clobbered then print("clobbered")
-    else begin {We have the string; run system(3). We don't have anything
-            reasonable to do with the return status, unfortunately discard it.}
+    else begin {We have the command.  See if we're allowed to execute it,
+         and report in the log.  We don't check the actual exit status of
+         the command, or do anything with the output.}
       for d:=0 to cur_length-1 do {Convert to external character set.}
         begin
         outside_string_array[d]:=xchr[str_pool[str_start(str_ptr)+d]];
         end;
       outside_string_array[cur_length]:=null_code;
-      system(outside_string_array);
-      print("executed");
-      end;
-    end
-  else begin print("disabled");
+      runsystem_ret := runsystem(outside_string_array);
+      if runsystem_ret = -1 then print("quotation error in system command")
+      else if runsystem_ret = 0 then print("disabled (restricted)")
+      else if runsystem_ret = 1 then print("executed")
+      else if runsystem_ret = 2 then print("executed (allowed)")
+    end;
+  end else begin
+    print("disabled"); {|shellenabledp| false}
   end;
   print_char("."); print_nl(""); print_ln;
   pool_ptr:=str_start(str_ptr);  {erase the string}
@@ -2682,7 +2688,7 @@ system-dependent section allows easy integration of Web2c and e-\TeX, etc.)
 @<Glob...@>=
 @!edit_name_start: pool_pointer; {where the filename to switch to starts}
 @!edit_name_length,@!edit_line: integer; {what line to start editing at}
-@!ipc_on: c_int_type; {level of IPC action, 0 for none [default]}
+@!ipc_on: cinttype; {level of IPC action, 0 for none [default]}
 @!stop_at_space: boolean; {whether |more_name| returns false for space}
 
 @ The |edit_name_start| will be set to point into |str_pool| somewhere after
@@ -2698,7 +2704,8 @@ strings.
 @<Global...@> =
 @!save_str_ptr: str_number;
 @!save_pool_ptr: pool_pointer;
-@!shell_enabled_p: c_int_type;
+@!shellenabledp: cinttype;
+@!restrictedshell: cinttype;
 @!output_comment: ^char;
 @!k,l: 0..65535; {used by `Make the first 256 strings', etc.}
 
diff --git a/Build/source/texk/web2c/alephdir/comsrcspec.ch b/Build/source/texk/web2c/alephdir/comsrcspec.ch
index 1a4999b3878..97583491f57 100644
--- a/Build/source/texk/web2c/alephdir/comsrcspec.ch
+++ b/Build/source/texk/web2c/alephdir/comsrcspec.ch
@@ -7,8 +7,8 @@
 @!special_loc:pointer;
 @!special_token:halfword;
 
-@!parse_first_line_p:c_int_type; {parse the first line for options}
-@!file_line_error_style_p:c_int_type; {format messages as file:line:error}
+@!parse_first_line_p:cinttype; {parse the first line for options}
+@!file_line_error_style_p:cinttype; {format messages as file:line:error}
 @!halt_on_error_p:boolean; {allow only on error.}
 
 @!src_specials_p : boolean;
@@ -35,8 +35,12 @@ else
 wterm(version_string);
 if format_ident>0 then slow_print(format_ident);
 print_ln;
-if shell_enabled_p then begin
-  wterm_ln(' \write18 enabled.')
+if shellenabledp then begin
+  wterm(' ');
+  if restrictedshell then begin
+    wterm('restricted ');
+  end;
+  wterm_ln('\write18 enabled.');
 end;
 if src_specials_p then begin
   wterm_ln(' Source specials enabled.')
@@ -96,10 +100,14 @@ then
 else
   wlog(eTeX_banner);
 wlog(version_string);
-if shell_enabled_p then begin
+if shellenabledp then begin
   wlog_cr;
+  wlog(' ');
+  if restrictedshell then begin
+    wlog('restricted ');
+  end;
   wlog('\write18 enabled.')
-end;
+  end;
 if src_specials_p then begin
   wlog_cr;
   wlog(' Source specials enabled.')
diff --git a/Build/source/texk/web2c/doc/web2c.info b/Build/source/texk/web2c/doc/web2c.info
index c10f40efd81..51a0b5aadbc 100644
--- a/Build/source/texk/web2c/doc/web2c.info
+++ b/Build/source/texk/web2c/doc/web2c.info
@@ -1,4 +1,4 @@
-This is web2c.info, produced by makeinfo version 4.12 from web2c.texi.
+This is web2c.info, produced by makeinfo version 4.13 from web2c.texi.
 
 INFO-DIR-SECTION TeX
 START-INFO-DIR-ENTRY
@@ -62,7 +62,7 @@ Web2c
 
 This document describes how to install and use the programs in the Web2c
 implementation of the TeX system, especially for Unix systems.  It
-corresponds to Web2c version 7.5.7, released in July 2008.
+corresponds to Web2c version 7.5.7, released in February 2009.
 
 * Menu:
 
@@ -87,7 +87,7 @@ File: web2c.info,  Node: Introduction,  Next: Installation,  Prev: Top,  Up: Top
 **************
 
 This manual corresponds to version 7.5.7 of Web2c, released in
-July 2008.
+February 2009.
 
    "Web2c" is the name of a TeX implementation, originally for Unix,
 but now also running under DOS, Amiga, and other operating systems. By
@@ -934,6 +934,7 @@ are available.
 * Initial TeX::                 Making format files.
 * Formats::                     Major TeX macro packages.
 * Languages and hyphenation::   TeX supports many human languages.
+* Shell escapes::               DVI output to a socket.
 * IPC and TeX::                 DVI output to a socket.
 * TeX extensions::              Changes to the TeX language.
 
@@ -1065,21 +1066,10 @@ suffice.)
 
 `-shell-escape'
 `-no-shell-escape'
-     Enable (or disable) the `\write18{SHELL-COMMAND}' feature.  This
-     is also enabled if the environment variable or config file value
-     `shell_escape' is set to `t' (but the `-no-shell-escape' command
-     line option overrides this).  (For backwards compatibility, `y'
-     and `1' are accepted as synonyms of `t').  It is disabled by
-     default to avoid security problems.  When enabled, the
-     SHELL-COMMAND string (which first undergoes the usual TeX
-     expansions, just as in `\special') is passed to the command shell
-     (via the C library function `system').  The output of
-     SHELL-COMMAND is not diverted anywhere, so it will not appear in
-     the log file.  The system call either happens at `\output' time or
-     right away, according to the absence or presence of the
-     `\immediate' prefix, as usual for `\write'.  (If you as a TeX
-     administrator wish to implement more stringent rules on what can
-     be executed, you will need to modify `tex.ch'.)
+`-shell-restricted'
+     Enable, or disable, or enable with restrictions the
+     `\write18{SHELL-COMMAND}' feature for external executing shell
+     commands.  *Note Shell escapes::.
 
 `-src-specials'
 `-src-specials=STRING'
@@ -1214,7 +1204,7 @@ slitex
 
 
 
-File: web2c.info,  Node: Languages and hyphenation,  Next: IPC and TeX,  Prev: Formats,  Up: TeX
+File: web2c.info,  Node: Languages and hyphenation,  Next: Shell escapes,  Prev: Formats,  Up: TeX
 
 4.4 Languages and hyphenation
 =============================
@@ -1472,13 +1462,89 @@ Frank Liang (*note References::), and also the `patgen.web' source file.
    The only options are `-help' and `-version' (*note Common options::).
 
 
-File: web2c.info,  Node: IPC and TeX,  Next: TeX extensions,  Prev: Languages and hyphenation,  Up: TeX
+File: web2c.info,  Node: Shell escapes,  Next: IPC and TeX,  Prev: Languages and hyphenation,  Up: TeX
 
-4.5 IPC and TeX
+4.5 Shell escapes
+=================
+
+TeX can execute "shell escapes", that is, arbitrary shell commands.
+Although tremendously useful, this also has obvious security
+implications.  Therefore, as of TeX Live 2009, a "restricted" mode for
+shell escapes is the default mode of operation, which allows executing
+only certain commands, as specified in the `texmf.cnf' configuration
+file.
+
+   * Unrestricted shell escapes are allowed if the option
+     `--shell-escape' is specified, or if the environment variable or
+     config file value `shell_escape' is set to `t' or `y' and `1'.
+
+   * Restricted shell escapes are allowed if `shell_escape' is set to
+     `p'.  This is the default.
+
+   * Shell escapes are completely disabled if `--no-shell-escape' is
+     specified, or if `shell_escape' is set to anything else.
+
+   When enabled, the TeX construct to execute a system command is
+`\write18{SHELL-COMMAND}'; for example:
+
+     \write18{echo "hello, world"}
+
+   From TeX's point of view, this is a normal `\write' command, and is
+therefore subject to the usual TeX expansions.  Also, the system call
+either happens during the `\output' routine or right away, according to
+the absence or presence of the `\immediate' prefix, as usual for
+`\write'.
+
+   The SHELL-COMMAND string is passed to the command shell (via the C
+library function `system').  The output of SHELL-COMMAND is not
+diverted anywhere, so it will not appear in the log file, or anywhere
+but the terminal output.  The exit status of the system call is also
+not available to TeX.
+
+   In unrestricted mode, the argument is simply passed straight to
+`system' unaltered.
+
+   In restricted mode, ASCII double quote characters (") should always
+be used in the argument to `\write18' where quoting of arguments is
+needed, as in the example above.  This is to achieve some measure of
+system independence.  On Unix systems, these are replaced with single
+quote (') characters to avoid insecure further expansion.  Care is also
+taken on Windows to avoid additional expansions (from, e.g., `...`).
+Mismatched quotation marks in the command string result in a diagnostic
+message in the log file; no execution is performed.
+
+   After quotation processing, if the first word (delimited by a space
+or tab) of the command is in the list specified by the
+`shell_escape_commands' configuration value, the command is executed.
+Otherwise it is not.  In any case, a message is written to the log file.
+
+   The `shell_escape_commands' value is a comma-separated list of
+words.  Whitespace is significant, and typically should not be present.
+The default definition looks like this, but with more commands included:
+
+     shell_escape_commands = bibtex,dvips,epstopdf,...,tex
+
+   pdfTeX and luaTeX support reading (via `\input' and `\openin') and
+writing (via `\openout') from pipes if the first character is `|'.  The
+following command is then treated exactly the same as the argument to
+`\write18'.  In these engines, the primitive variable `\pdfshellescape'
+is set to 0 if shell escapes are disabled, 1 if they are enabled, and 2
+if they are enabled with restrictions.
+
+   The purpose of this feature is to make it possible for TeX documents
+to perform useful external actions in the common case of an individual
+user running a known document on his or her own machine.  In such
+environments as CGI scripts or wikis where the input has to be
+considered untrustworthy, shell escapes should be completely disabled.
+
+
+File: web2c.info,  Node: IPC and TeX,  Next: TeX extensions,  Prev: Shell escapes,  Up: TeX
+
+4.6 IPC and TeX
 ===============
 
-(Sorry, but I'm not going to write this unless someone actually uses
-this feature. Let me know.)
+(If anyone uses this feature and needs documentation, write
+<tex-k@tug.org>.)
 
    This functionality is available only if the `--enable-ipc' option
 was specified to `configure' during installation of Web2c (*note
@@ -1491,38 +1557,34 @@ its socket operations.  This may be helpful if you are, well, debugging.
 
 File: web2c.info,  Node: TeX extensions,  Prev: IPC and TeX,  Up: TeX
 
-4.6 TeX extensions
+4.7 TeX extensions
 ==================
 
 The base TeX program has been extended in many ways.  Here's a partial
-list.  Please send information on extensions not listed here to the
-address in *note Reporting bugs: (kpathsea)Reporting bugs.
+list.
 
 e-TeX
-     Adds many new primitives, including right-to-left typesetting.
-     Available from `http://www.vms.rhbnc.ac.uk/e-TeX/' and
-     `CTAN:/systems/e-tex'.
+     Adds many new primitives, including right-to-left typesetting and
+     more registers.  Now frozen.
 
 Omega
-     Adds Unicode support, right-to-left typesetting, and more.
-     Available from `http://www.ens.fr/omega' and `CTAN:/systems/omega'.
+Aleph
+     These add Unicode support, right-to-left typesetting, and more.
+     Omega was the original program.  Aleph is an updated version with
+     a variety of bug fixes, and includes e-TeX.  Neither is actively
+     maintained.
 
 pdfTeX
-     A variant of TeX that produces PDF instead of DVI files.  It also
-     includes primitives for hypertext and micro-typography.  Available
-     from `CTAN:/systems/pdftex'.
-
-`TeX--XeT'
-     Adds primitives and DVI opcodes for right-to-left typesetting (as
-     used in Arabic, for example).  An old version for TeX 3.1415 is
-     available from `CTAN:/systems/knuth/tex--xet'.  A newer version is
-     included in e-TeX.
-
-File-handling TeX
-     Adds primitives for creating multiple DVI files in a single run;
-     and appending to output files as well as overwriting.  Web2c
-     implementation available in the distribution file
-     `web2c/contrib/file-handling-tex'.
+     Can produce PDF as well as DVI files.  It also incorporates the
+     e-TeX extensions, new primitives for hypertext and
+     micro-typography, reading/writing from pipes, and much more.  Home
+     page: `http://pdftex.org'.
+
+luaTeX
+     Based on pdfTeX, this also embeds the Lua programming language
+     (`http://lua.org') and opens up the TeX typesetting engine to
+     control from Lua.  Home page: `http://luatex.org'.
+
 
 
 File: web2c.info,  Node: Metafont,  Next: MetaPost,  Prev: TeX,  Up: Top
@@ -3781,6 +3843,7 @@ Index
 * -progname=STRING:                      Common options.      (line  83)
 * -recorder:                             Common options.      (line  90)
 * -shell-escape:                         tex invocation.      (line 127)
+* -shell-restricted:                     tex invocation.      (line 129)
 * -show-opcodes:                         dvitype invocation.  (line  56)
 * -strict:                               tangle invocation.   (line  46)
 * -style=MFTFILE:                        mft invocation.      (line  68)
@@ -3829,15 +3892,20 @@ Index
 * \countN:                               dvicopy invocation.  (line  28)
 * \font and dynamic generation:          tex invocation.      (line  44)
 * \fontdimen:                            tftopl invocation.   (line 100)
-* \immediate\write18:                    tex invocation.      (line 128)
+* \immediate\write18:                    Shell escapes.       (line   6)
 * \input filenames:                      \input filenames.    (line   6)
+* \input, and pipes:                     Shell escapes.       (line  63)
 * \mag <1>:                              dvitype invocation.  (line  28)
 * \mag:                                  dvicopy invocation.  (line  20)
+* \openin, and pipes:                    Shell escapes.       (line  63)
 * \openout and security:                 tex invocation.      (line  51)
+* \openout, and pipes:                   Shell escapes.       (line  63)
+* \output routine, and \write:           Shell escapes.       (line  28)
+* \pdfshellescape:                       Shell escapes.       (line  63)
 * \string:                               \input filenames.    (line  60)
 * \tracingcharsubdef and MLTeX:          \tracingcharsubdef.  (line   6)
 * \tracinglostchars and MLTeX:           \tracingcharsubdef.  (line  11)
-* \write18 shell escape extension:       tex invocation.      (line 128)
+* \write18 shell escape extension:       Shell escapes.       (line   6)
 * ^^ notation, avoiding:                 TCX files.           (line  88)
 * `Computer Modern Typefaces', production of: mft invocation. (line  75)
 * abbrv.bst:                             Basic BibTeX style files.
@@ -3862,7 +3930,6 @@ Index
 * AMSTeX:                                Formats.             (line  39)
 * apalike.bst:                           Basic BibTeX style files.
                                                               (line  25)
-* Arabic typesetting:                    TeX extensions.      (line  25)
 * architecture dependencies:             Hardware and memory dumps.
                                                               (line   6)
 * array limit, fixed:                    Runtime options.     (line  36)
@@ -3902,7 +3969,6 @@ Index
                                                               (line   6)
 * binaries, linking:                     Common options.      (line  83)
 * blank lines, in TCX files:             TCX files.           (line  67)
-* Bourne shell commands in TeX:          tex invocation.      (line 128)
 * boxes, memory for:                     Runtime options.     (line  20)
 * breakpoints, memory for:               Runtime options.     (line  20)
 * Breitenlohner, Peter:                  Introduction.        (line   9)
@@ -4011,7 +4077,6 @@ Index
 * dumping memory:                        Memory dumps.        (line   6)
 * DVI comment, specifying:               tex invocation.      (line 120)
 * DVI files, converting to MPX:          dvitomp invocation.  (line   6)
-* DVI files, creating multiple:          TeX extensions.      (line  31)
 * DVI files, explained:                  Font file formats.   (line  30)
 * DVI format definition:                 DVI utilities.       (line  14)
 * DVI opcodes, showing:                  dvitype invocation.  (line  56)
@@ -4032,7 +4097,7 @@ Index
 * dynamic packing variable:              pktype invocation.   (line  44)
 * e response at error prompt:            Editor invocation.   (line   6)
 * e-circumflex:                          \charsubdef.         (line  21)
-* e-TeX:                                 TeX extensions.      (line  11)
+* e-TeX:                                 TeX extensions.      (line  10)
 * e.mft:                                 mft invocation.      (line  75)
 * EC fonts <1>:                          mf invocation.       (line  24)
 * EC fonts:                              tex invocation.      (line  44)
@@ -4054,6 +4119,7 @@ Index
 * etex and label extraction:             mpto invocation.     (line   6)
 * etex for MetaPost labels:              mpost invocation.    (line  50)
 * executables, shared initial and virgin: Initial and virgin. (line   6)
+* exit status, of shell escape:          Shell escapes.       (line  34)
 * expanded plain format:                 Formats.             (line  54)
 * extensions to TeX:                     TeX extensions.      (line   6)
 * extra_mem_bot:                         Runtime options.     (line  19)
@@ -4063,7 +4129,6 @@ Index
 * file formats for fonts:                Font file formats.   (line   6)
 * file mtimes, comparing:                newer invocation.    (line   6)
 * file recorder:                         Common options.      (line  90)
-* File-handling TeX:                     TeX extensions.      (line  31)
 * filename conventions, in input files:  \input filenames.    (line   6)
 * filenames starting with -:             Option conventions.  (line  19)
 * first line of the main input file:     Common options.      (line  96)
@@ -4107,7 +4172,7 @@ Index
 * Free Software Foundation documentation system: Formats.     (line  47)
 * freedom of Web2c:                      Introduction.        (line  23)
 * ftp.math.utah.edu:                     bibtex invocation.   (line  54)
-* generating source specials:            tex invocation.      (line 146)
+* generating source specials:            tex invocation.      (line 135)
 * geometric designs:                     Metafont.            (line   6)
 * geometric font scaling:                Font file formats.   (line  22)
 * geometry for Metafont:                 Online Metafont graphics.
@@ -4160,6 +4225,7 @@ Index
 * human-readable text, converting PK to: pktype invocation.   (line   6)
 * human-readable text, converting TFM to: tftopl invocation.  (line   6)
 * human-readable text, converting VF to: vftovp invocation.   (line   6)
+* hypertext:                             TeX extensions.      (line  21)
 * hyphenation and languages:             Languages and hyphenation.
                                                               (line   6)
 * hyphenation patterns, creating:        patgen invocation.   (line   6)
@@ -4225,6 +4291,8 @@ Index
 * LittleEndian machines:                 Hardware and memory dumps.
                                                               (line   6)
 * log file, BibTeX:                      bibtex invocation.   (line  14)
+* Lua:                                   TeX extensions.      (line  27)
+* luaTeX:                                TeX extensions.      (line  27)
 * machine dependencies:                  Hardware and memory dumps.
                                                               (line   6)
 * machine-readable, converting property lists to <1>: vptovf invocation.
@@ -4300,6 +4368,7 @@ Index
 * MFTERM:                                Online Metafont graphics.
                                                               (line  11)
 * mftmac.tex:                            mft invocation.      (line   6)
+* micro-typography:                      TeX extensions.      (line  21)
 * mktexmf, disabling:                    mf invocation.       (line  24)
 * mktextfM, disabling:                   tex invocation.      (line  44)
 * mltex:                                 MLTeX.               (line   6)
@@ -4337,7 +4406,6 @@ Index
 * mpxerr.tex:                            makempx invocation.  (line  34)
 * mtimes of files, comparing:            newer invocation.    (line   6)
 * Multi-lingual TeX:                     MLTeX.               (line   6)
-* multiple DVI files, creating:          TeX extensions.      (line  31)
 * N tilde:                               \charsubdef.         (line  37)
 * new graphics support for Metafont:     Online Metafont graphics.
                                                               (line  77)
@@ -4353,7 +4421,7 @@ Index
 * octal character codes, in TCX files:   TCX files.           (line  78)
 * offset for overflow labels:            gftodvi invocation.  (line  59)
 * older-than, file comparisons:          newer invocation.    (line   6)
-* Omega:                                 TeX extensions.      (line  16)
+* Omega:                                 TeX extensions.      (line  15)
 * online Metafont graphics:              Online Metafont graphics.
                                                               (line   6)
 * opcodes, showing DVI:                  dvitype invocation.  (line  56)
@@ -4376,8 +4444,8 @@ Index
 * patgen:                                patgen invocation.   (line   6)
 * path searching:                        Path searching.      (line   6)
 * path searching debugging:              Common options.      (line  60)
-* PDF:                                   TeX extensions.      (line  20)
-* pdfTeX:                                TeX extensions.      (line  20)
+* PDF:                                   TeX extensions.      (line  21)
+* pdfTeX:                                TeX extensions.      (line  21)
 * permissions, legal:                    Legalisms.           (line   6)
 * PFA and PFB conversion:                Font utilities available elsewhere.
                                                               (line  39)
@@ -4385,6 +4453,7 @@ Index
                                                               (line  30)
 * PiCTeX, increasing memory for:         Runtime options.     (line  20)
 * picture expressions:                   makempx invocation.  (line  43)
+* pipes, reading and writing:            Shell escapes.       (line  63)
 * pixel height:                          pktype invocation.   (line  62)
 * pixel width:                           pktype invocation.   (line  62)
 * PK bitmaps from PostScript:            Font utilities available elsewhere.
@@ -4431,7 +4500,7 @@ Index
 * predefined macros and memory dumps:    Memory dumps.        (line   6)
 * prettyprinting Metafont source:        mft invocation.      (line   6)
 * prettyprinting WEB programs:           weave invocation.    (line   6)
-* primitives, new:                       TeX extensions.      (line  11)
+* primitives, new:                       TeX extensions.      (line  10)
 * printable characters, specifying:      TCX files.           (line  88)
 * printer characteristics, for Metafont: Modes.               (line   6)
 * production use:                        Initial and virgin.  (line  20)
@@ -4468,9 +4537,9 @@ Index
 * regression testing:                    tex invocation.      (line 120)
 * repeated rows:                         pktype invocation.   (line  76)
 * representation of strings:             pooltype invocation. (line  30)
+* restricted shell escapes:              Shell escapes.       (line   6)
 * right side bearing <1>:                gftype invocation.   (line  82)
 * right side bearing:                    pktype invocation.   (line  66)
-* right-to-left typesetting:             TeX extensions.      (line  25)
 * Rokicki, Tomas:                        Introduction.        (line  41)
 * run length encoded bitmaps <1>:        gftype invocation.   (line  89)
 * run length encoded bitmaps:            pktype invocation.   (line  76)
@@ -4482,13 +4551,14 @@ Index
                                                               (line  42)
 * security, and \openout:                tex invocation.      (line  51)
 * security, and output files:            tex invocation.      (line  51)
-* security, and shell escapes:           tex invocation.      (line 128)
+* security, and shell escapes:           Shell escapes.       (line   6)
 * SetColor ditroff command:              dmp invocation.      (line  15)
 * shapes:                                Metafont.            (line   6)
 * sharing memory dumps:                  Hardware and memory dumps.
                                                               (line   6)
-* shell commands in TeX:                 tex invocation.      (line 128)
-* shell_escape enabling in TeX:          tex invocation.      (line 128)
+* shell commands in TeX:                 Shell escapes.       (line   6)
+* shell_escape enabling in TeX:          Shell escapes.       (line   6)
+* shell_escape_commands:                 Shell escapes.       (line  52)
 * siam.bst:                              Basic BibTeX style files.
                                                               (line  35)
 * side bearings <1>:                     gftype invocation.   (line  82)
@@ -4526,7 +4596,8 @@ Index
 * swapping bytes:                        Hardware and memory dumps.
                                                               (line  13)
 * syntax of TCX files:                   TCX files.           (line  66)
-* system C library function:             tex invocation.      (line 128)
+* system C library function:             Shell escapes.       (line   6)
+* system command:                        Shell escapes.       (line   6)
 * T1 encoding and ISO input:             TCX files.           (line  49)
 * Tachikawa, Elizabeth:                  Font file formats.   (line  63)
 * tangle:                                tangle invocation.   (line   6)
@@ -4555,7 +4626,6 @@ Index
 * TeX, invocation:                       tex invocation.      (line   6)
 * TeX, Metafont, and MetaPost:           Three programs.      (line   6)
 * TeX, Web2c implementation of:          Introduction.        (line   9)
-* TeX--XeT:                              TeX extensions.      (line  25)
 * tex.fmt:                               Initial TeX.         (line  15)
 * TEXBIB, search path for bib files:     bibtex invocation.   (line  18)
 * TEXEDIT:                               Editor invocation.   (line  10)
@@ -4611,7 +4681,7 @@ Index
 * typeface specimen sheets:              Font utilities available elsewhere.
                                                               (line  42)
 * typesetting:                           TeX.                 (line   6)
-* Unicode:                               TeX extensions.      (line  16)
+* Unicode:                               TeX extensions.      (line  15)
 * Unicode input:                         tex invocation.      (line  95)
 * uniterm:                               Online Metafont graphics.
                                                               (line  50)
@@ -4640,6 +4710,7 @@ Index
 * vptovf:                                vptovf invocation.   (line   6)
 * weave:                                 weave invocation.    (line   6)
 * WEB:                                   WEB.                 (line   6)
+* web environments, and security:        Shell escapes.       (line  70)
 * WEB pool files, displaying:            pooltype invocation. (line   6)
 * WEB programs, compiling:               tangle invocation.   (line   6)
 * WEB programs, typesetting:             weave invocation.    (line   6)
@@ -4689,77 +4760,78 @@ Index
 
 Tag Table:
 Node: Top3053
-Node: Introduction4048
-Node: Installation7225
-Node: configure options9389
-Node: Compile-time options11471
-Node: Additional targets12597
-Node: Triptrap13878
-Node: Runtime options15407
-Node: Commonalities17179
-Node: Option conventions17784
-Node: Common options19008
-Node: Path searching23520
-Node: Output file location24542
-Node: Three programs25582
-Node: Initial and virgin26341
-Node: Memory dumps27441
-Node: Creating memory dumps27908
-Node: Determining the memory dump to use29169
-Node: Hardware and memory dumps30793
-Node: Editor invocation33262
-Node: \input filenames33992
-Node: TeX36985
-Node: tex invocation38075
-Node: Initial TeX46007
-Node: Formats47496
-Node: Languages and hyphenation50435
-Node: MLTeX50863
-Node: \charsubdef52358
-Node: \tracingcharsubdef54684
-Node: TCX files55259
-Node: patgen invocation60683
-Node: IPC and TeX61400
-Node: TeX extensions62001
-Node: Metafont63302
-Node: mf invocation64590
-Node: Initial Metafont68473
-Node: Modes70226
-Node: Online Metafont graphics72481
-Node: gftodvi invocation75754
-Node: mft invocation78576
-Node: MetaPost82631
-Node: mpost invocation83652
-Node: Initial MetaPost88837
-Node: makempx invocation90648
-Node: dvitomp invocation94653
-Node: dmp invocation95424
-Node: mpto invocation99445
-Node: newer invocation100427
-Node: BibTeX101364
-Node: bibtex invocation101725
-Node: Basic BibTeX style files104050
-Node: WEB105392
-Node: tangle invocation106675
-Node: weave invocation108798
-Node: pooltype invocation110206
-Node: DVI utilities111336
-Node: dvicopy invocation112280
-Node: dvitype invocation113578
-Node: dvitype output example115933
-Node: Font utilities118984
-Node: Font file formats120164
-Node: gftopk invocation123463
-Node: pktogf invocation124667
-Node: pktype invocation125846
-Node: gftype invocation128681
-Node: tftopl invocation133197
-Node: pltotf invocation137831
-Node: vftovp invocation138896
-Node: vptovf invocation141180
-Node: Font utilities available elsewhere142234
-Node: Legalisms144642
-Node: References146813
-Node: Index151198
+Node: Introduction4052
+Node: Installation7233
+Node: configure options9397
+Node: Compile-time options11479
+Node: Additional targets12605
+Node: Triptrap13886
+Node: Runtime options15415
+Node: Commonalities17187
+Node: Option conventions17792
+Node: Common options19016
+Node: Path searching23528
+Node: Output file location24550
+Node: Three programs25590
+Node: Initial and virgin26349
+Node: Memory dumps27449
+Node: Creating memory dumps27916
+Node: Determining the memory dump to use29177
+Node: Hardware and memory dumps30801
+Node: Editor invocation33270
+Node: \input filenames34000
+Node: TeX36993
+Node: tex invocation38139
+Node: Initial TeX45264
+Node: Formats46753
+Node: Languages and hyphenation49692
+Node: MLTeX50122
+Node: \charsubdef51617
+Node: \tracingcharsubdef53943
+Node: TCX files54518
+Node: patgen invocation59942
+Node: Shell escapes60659
+Node: IPC and TeX64223
+Node: TeX extensions64793
+Node: Metafont65772
+Node: mf invocation67060
+Node: Initial Metafont70943
+Node: Modes72696
+Node: Online Metafont graphics74951
+Node: gftodvi invocation78224
+Node: mft invocation81046
+Node: MetaPost85101
+Node: mpost invocation86122
+Node: Initial MetaPost91307
+Node: makempx invocation93118
+Node: dvitomp invocation97123
+Node: dmp invocation97894
+Node: mpto invocation101915
+Node: newer invocation102897
+Node: BibTeX103834
+Node: bibtex invocation104195
+Node: Basic BibTeX style files106520
+Node: WEB107862
+Node: tangle invocation109145
+Node: weave invocation111268
+Node: pooltype invocation112676
+Node: DVI utilities113806
+Node: dvicopy invocation114750
+Node: dvitype invocation116048
+Node: dvitype output example118403
+Node: Font utilities121454
+Node: Font file formats122634
+Node: gftopk invocation125933
+Node: pktogf invocation127137
+Node: pktype invocation128316
+Node: gftype invocation131151
+Node: tftopl invocation135667
+Node: pltotf invocation140301
+Node: vftovp invocation141366
+Node: vptovf invocation143650
+Node: Font utilities available elsewhere144704
+Node: Legalisms147112
+Node: References149283
+Node: Index153668
 
 End Tag Table
diff --git a/Build/source/texk/web2c/doc/web2c.texi b/Build/source/texk/web2c/doc/web2c.texi
index 1136b8e43d8..e6b0eeec290 100644
--- a/Build/source/texk/web2c/doc/web2c.texi
+++ b/Build/source/texk/web2c/doc/web2c.texi
@@ -12,7 +12,7 @@ The latest version is available from ftp://ftp.tug.org/tex/texinfo.tex.}
 @end tex
 
 @set version 7.5.7
-@set month-year July 2008
+@set month-year February 2009
 
 @c Define new indices for commands in auxiliary files, filenames, and options.
 @defcodeindex cm
@@ -907,6 +907,7 @@ otherwise, are available.
 * Initial TeX::                 Making format files.
 * Formats::                     Major TeX macro packages.
 * Languages and hyphenation::   TeX supports many human languages.
+* Shell escapes::               DVI output to a socket.
 * IPC and TeX::                 DVI output to a socket.
 * TeX extensions::              Changes to the TeX language.
 @end menu
@@ -1078,29 +1079,11 @@ config file value @samp{output_comment}.
 @opindex -shell-escape
 @itemx -no-shell-escape
 @opindex -no-shell-escape
-@cindex shell commands in @TeX{}
-@cindex Bourne shell commands in @TeX{}
-@vindex shell_escape @r{enabling in @TeX{}}
-@findex \immediate\write18
-@findex \write18 @r{shell escape extension}
-@findex system @r{C library function}
-@cindex security, and shell escapes
-Enable (or disable) the @samp{\write18@{@var{shell-command}@}}
-feature.  This is also enabled if the environment variable or config
-file value @samp{shell_escape} is set to @samp{t} (but the
-@samp{-no-shell-escape} command line option overrides this).  (For
-backwards compatibility, @samp{y} and @samp{1} are accepted as
-synonyms of @samp{t}).  It is disabled by default to avoid security
-problems.  When enabled, the @var{shell-command} string (which first
-undergoes the usual @TeX{} expansions, just as in @samp{\special}) is
-passed to the command shell (via the C library function
-@samp{system}).  The output of @var{shell-command} is not diverted
-anywhere, so it will not appear in the log file.  The system call
-either happens at @samp{\output} time or right away, according to the
-absence or presence of the @samp{\immediate} prefix, as usual for
-@code{\write}.  (If you as a @TeX{} administrator wish to implement
-more stringent rules on what can be executed, you will need to modify
-@file{tex.ch}.)
+@itemx -shell-restricted
+@opindex -shell-restricted
+Enable, or disable, or enable with restrictions the
+@samp{\write18@{@var{shell-command}@}} feature for external executing
+shell commands.  @xref{Shell escapes}.
 
 @item -src-specials
 @itemx -src-specials=@var{string}
@@ -1612,13 +1595,119 @@ The only options are @samp{-help} and @samp{-version} (@pxref{Common
 options}).
 
 
+@node Shell escapes
+@section Shell escapes
+
+@cindex shell commands in @TeX{}
+@cindex security, and shell escapes
+@cindex restricted shell escapes
+@cindex system command
+@vindex shell_escape @r{enabling in @TeX{}}
+@findex \immediate\write18
+@findex \write18 @r{shell escape extension}
+@findex system @r{C library function}
+
+@TeX{} can execute @dfn{shell escapes}, that is, arbitrary shell
+commands.  Although tremendously useful, this also has obvious
+security implications.  Therefore, as of @TeX{} Live 2009, a
+@dfn{restricted} mode for shell escapes is the default mode of
+operation, which allows executing only certain commands, as specified
+in the @file{texmf.cnf} configuration file.
+
+@itemize @bullet
+@item
+Unrestricted shell escapes are allowed if the option
+@option{--shell-escape} is specified, or if the environment variable
+or config file value @code{shell_escape} is set to @samp{t} or
+@samp{y} and @samp{1}.
+
+@item
+Restricted shell escapes are allowed if @code{shell_escape} is set to
+@samp{p}.  This is the default.
+
+@item
+Shell escapes are completely disabled if @option{--no-shell-escape} is
+specified, or if @code{shell_escape} is set to anything else.
+@end itemize
+
+When enabled, the @TeX{} construct to execute a system command is
+@code{\write18@{@var{shell-command}@}}; for example:
+
+@example
+\write18@{echo "hello, world"@}
+@end example
+
+@findex \output @r{routine, and @code{\write}}
+From @TeX{}'s point of view, this is a normal @code{\write} command,
+and is therefore subject to the usual @TeX{} expansions.  Also, the
+system call either happens during the @samp{\output} routine or right
+away, according to the absence or presence of the @code{\immediate}
+prefix, as usual for @code{\write}.
+
+@cindex exit status, of shell escape
+The @var{shell-command} string is passed to the command shell (via the
+C library function @code{system}).  The output of @var{shell-command}
+is not diverted anywhere, so it will not appear in the log file, or
+anywhere but the terminal output.  The exit status of the system call
+is also not available to @TeX{}.
+
+In unrestricted mode, the argument is simply passed straight to
+@code{system} unaltered.
+
+In restricted mode, ASCII double quote characters (@verb{|"|}) should
+always be used in the argument to @code{\write18} where quoting of
+arguments is needed, as in the example above.  This is to achieve some
+measure of system independence.  On Unix systems, these are replaced
+with single quote (@verb{|'|}) characters to avoid insecure further
+expansion.  Care is also taken on Windows to avoid additional
+expansions (from, e.g., @verb{|`...`|}).  Mismatched quotation marks
+in the command string result in a diagnostic message in the log file;
+no execution is performed.
+
+@findex shell_escape_commands
+After quotation processing, if the first word (delimited by a space or
+tab) of the command is in the list specified by the
+@code{shell_escape_commands} configuration value, the command is
+executed.  Otherwise it is not.  In any case, a message is written to
+the log file.
+
+The @code{shell_escape_commands} value is a comma-separated list of
+words.  Whitespace is significant, and typically should not be
+present.  The default definition looks like this, but with more
+commands included:
+
+@example
+shell_escape_commands = bibtex,dvips,epstopdf,...,tex
+@end example
+
+@cindex pipes, reading and writing
+@findex \openin@r{, and pipes}
+@findex \input@r{, and pipes}
+@findex \openout@r{, and pipes}
+@findex \pdfshellescape
+pdf@TeX{} and lua@TeX{} support reading (via @code{\input} and
+@code{\openin}) and writing (via @code{\openout}) from pipes if the
+first character is @samp{|}.  The following command is then treated
+exactly the same as the argument to @code{\write18}.  In these
+engines, the primitive variable @code{\pdfshellescape} is set to 0 if
+shell escapes are disabled, 1 if they are enabled, and 2 if they are
+enabled with restrictions.
+
+@cindex web environments, and security
+The purpose of this feature is to make it possible for @TeX{}
+documents to perform useful external actions in the common case of an
+individual user running a known document on his or her own machine.
+In such environments as CGI scripts or wikis where the input has to be
+considered untrustworthy, shell escapes should be completely disabled.
+
+
 @node IPC and TeX
 @section IPC and @TeX{}
 
 @cindex IPC
 @cindex sockets
-(Sorry, but I'm not going to write this unless someone actually uses
-this feature. Let me know.)
+(If anyone uses this feature and needs documentation, write
+@email{tex-k@@tug.org}.)
 
 This functionality is available only if the @samp{--enable-ipc} option
 was specified to @code{configure} during installation of Web2c
@@ -1638,47 +1727,40 @@ debugging.
 @cindex @TeX{}, extensions to
 
 The base @TeX{} program has been extended in many ways.  Here's a
-partial list.  Please send information on extensions not listed here to
-the address in @ref{Reporting bugs,,, kpathsea, Kpathsea}.
+partial list.
 
 @table @asis
 @item e-@TeX{}
 @cindex e-@TeX{}
 @cindex primitives, new
-Adds many new primitives, including right-to-left typesetting.
-Available from @url{http://www.vms.rhbnc.ac.uk/e-TeX/} and
-@file{@var{CTAN:}/systems/e-tex}.
+Adds many new primitives, including right-to-left typesetting and more
+registers.  Now frozen.
 
 @item Omega
+@itemx Aleph
 @cindex Omega
 @cindex Unicode
-Adds Unicode support, right-to-left typesetting, and more.  Available
-from @url{http://www.ens.fr/omega} and @file{@var{CTAN:}/systems/omega}.
+These add Unicode support, right-to-left typesetting, and more.  Omega
+was the original program.  Aleph is an updated version with a variety
+of bug fixes, and includes e-@TeX{}.  Neither is actively maintained.
 
 @item pdf@TeX{}
 @cindex pdf@TeX{}
 @cindex PDF
-A variant of @TeX{} that produces PDF instead of DVI files.  It also
-includes primitives for hypertext and micro-typography.  Available from
-@file{@var{CTAN:}/systems/pdftex}.
-
-@item @samp{TeX--XeT}
-@pindex TeX--XeT
-@cindex Arabic typesetting
-@cindex right-to-left typesetting
-Adds primitives and DVI opcodes for right-to-left typesetting (as used
-in Arabic, for example).  An old version for @TeX{} 3.1415 is available
-from @file{@var{CTAN:}/systems/knuth/tex--xet}.  A newer version is
-included in e-@TeX{}.
-
-@item File-handling @TeX{}
-@cindex File-handling @TeX{}
-@cindex DVI files, creating multiple
-@cindex multiple DVI files, creating
-Adds primitives for creating multiple DVI files in a single run; and
-appending to output files as well as overwriting.  Web2c implementation
-available in the distribution file
-@file{web2c/contrib/file-handling-tex}.
+@cindex micro-typography
+@cindex hypertext
+Can produce PDF as well as DVI files.  It also incorporates the
+e-@TeX{} extensions, new primitives for hypertext and
+micro-typography, reading/writing from pipes, and much more.  Home
+page: @url{http://pdftex.org}.
+
+@item lua@TeX{}
+@cindex lua@TeX{}
+@cindex Lua
+Based on pdf@TeX{}, this also embeds the Lua programming language
+(@url{http://lua.org}) and opens up the @TeX{} typesetting engine to
+control from Lua.  Home page: @url{http://luatex.org}.
+
 @end table
 
 
diff --git a/Build/source/texk/web2c/lib/ChangeLog b/Build/source/texk/web2c/lib/ChangeLog
index eb47250e790..cf13f906ba1 100644
--- a/Build/source/texk/web2c/lib/ChangeLog
+++ b/Build/source/texk/web2c/lib/ChangeLog
@@ -1,3 +1,12 @@
+2009-02-26  Karl Berry  <karl@tug.org>
+
+	* texmfmp.c: Implementation of restricted shell escapes from Akira.
+	(mk_shellcmdlist, init_shell_escape, char_needs_quote, Isspace,
+	shell_cmd_is_allowed, runsystem, runpopen): new fns.
+	(long_options, parse_cmd_line): new option --shell-restricted.
+	(main): call init_shell_escape.
+	(open_in_or_pipe, open_out_or_pipe): call runpopen.
+
 2009-02-06  Karl Berry  <karl@tug.org>
 
 	* texmfmp.c (maininit) [__SyncTeX__]: omit warning about no
diff --git a/Build/source/texk/web2c/lib/texmfmp.c b/Build/source/texk/web2c/lib/texmfmp.c
index 066a6301e73..ed172504314 100644
--- a/Build/source/texk/web2c/lib/texmfmp.c
+++ b/Build/source/texk/web2c/lib/texmfmp.c
@@ -105,6 +105,402 @@
 #define edit_var "MPEDIT"
 #endif /* MP */
 
+/* Shell escape.
+
+   If shellenabledp == 0, all shell escapes are forbidden.
+   If (shellenabledp == 1 && restrictedshell == 0), any command
+     is allowed for a shell escape.
+   If (shellenabledp == 1 && restrictedshell == 1), only commands
+     given in the configuration file as
+   shell_escape_commands = kpsewhich,ebb,extractbb,mpost,metafun,...
+     (no spaces between commands) in texmf.cnf are allowed for a shell
+     escape in a restricted form: command name and arguments should be
+     separated by a white space. The first word should be a command
+     name. The quotation character for an argument with spaces,
+     including a pathname, should be ".  ' should not be used.
+
+     Internally, all arguments are quoted by ' (Unix) or " (Windows)
+     before calling the system() function in order to forbid execution
+     of any embedded command.  In addition, on Windows, special
+     characters of cmd.exe are escaped by using (^).
+
+   If the --shell-escape option is given, we set
+     shellenabledp = 1 and restrictedshell = 0, i.e., any command is allowed.
+   If the --shell-restricted option is given, we set
+     shellenabledp = 1 and restrictedshell = 1, i.e., only given cmds allowed.
+   If the --no-shell-escape option is given, we set
+     shellenabledp = -1 (and restrictedshell is irrelevant).
+   If none of these option are given, there are three cases:
+   (1) In the case where
+       shell_escape = y or
+       shell_escape = t or
+       shell_escape = 1
+       it becomes shellenabledp = 1 and restrictedshell = 0,
+       that is, any command is allowed.
+   (2) In the case where
+       shell_escape = p
+       it becomes shellenabledp = 1 and restrictedshell = 1,
+       that is, restricted shell escape is allowed.
+   (3) In all other cases, shellenabledp = 0, that is, shell
+       escape is forbidden. The value of restrictedshell is
+       irrelevant if shellenabledp == 0.
+*/
+
+#ifdef TeX
+
+/* cmdlist is a list of allowed commands which are given like this:
+   shell_escape_commands = kpsewhich,ebb,extractbb,mpost,metafun
+   in texmf.cnf. */
+
+static char **cmdlist = NULL;
+
+static void 
+mk_shellcmdlist (char *v)
+{
+  char **p;
+  char *q, *r;
+  int  n;
+
+  q = v;
+  n = 0;
+
+/* analyze the variable shell_escape_commands = foo,bar,...
+   spaces before and after (,) are not allowed. */
+
+  while ((r = strchr (q, ',')) != 0) {
+    n++;
+    r++;
+    q = r;
+  }
+  if (*q)
+    n++;
+  cmdlist = (char **) xmalloc ((n + 1) * sizeof (char *));
+  p = cmdlist;
+  q = v;
+  while ((r = strchr (q, ',')) != 0) {
+    *r = '\0';
+    *p = (char *) xmalloc (strlen (q) + 1);
+    strcpy (*p, q);
+    *r = ',';
+    r++;
+    q = r;
+    p++;
+  }
+  if (*q) {
+    *p = (char *) xmalloc (strlen (q) + 1);
+    strcpy (*p, q);
+    p++;
+    *p = NULL;
+  } else
+    *p = NULL;
+}
+
+/* Called from maininit.  Not static because also called from
+   luatexdir/lua/luainit.c.  */
+
+void
+init_shell_escape (void)
+{
+  if (shellenabledp < 0) {  /* --no-shell-escape on cmd line */
+    shellenabledp = 0;
+
+  } else {
+    if (shellenabledp == 0) {  /* no shell options on cmd line, check cnf */
+      char *v1 = kpse_var_value ("shell_escape");
+      if (v1) {
+        if (*v1 == 't' || *v1 == 'y' || *v1 == '1') {
+          shellenabledp = 1;
+        } else if (*v1 == 'p') {
+          shellenabledp = 1;
+          restrictedshell = 1;
+        }
+        free (v1);
+      }
+    }
+
+    /* If shell escapes are restricted, get allowed cmds from cnf.  */   
+    if (shellenabledp && restrictedshell == 1) {
+      char *v2 = kpse_var_value ("shell_escape_commands");
+      if (v2) {
+        mk_shellcmdlist (v2);
+        free (v2);
+      }
+    }
+  }
+}
+
+#ifdef WIN32
+#define QUOTE '"'
+#else
+#define QUOTE '\''
+#endif
+
+#ifdef WIN32
+static int
+char_needs_quote (int c)
+{
+/* special characters of cmd.exe */
+
+  return (c == '&' || c == '|' || c == '%' || c == '<' ||
+          c == '>' || c == ';' || c == ',' || c == '(' ||
+          c == ')');
+}
+#endif
+
+static int
+Isspace (char c)
+{
+  return (c == ' ' || c == '\t');
+}
+
+#if 0
+/* We could call this at the end of the main program, but does it matter?
+   The process is about to exit anyway.  */
+static void
+free_shellcmdlist (void)
+{
+  char **p;
+
+  if (cmdlist) {
+    p = cmdlist;
+    while (*p) {
+      free (*p);
+      p++;
+    }
+    free (cmdlist);
+  }
+}
+#endif
+
+/* return values:
+  -1 : invalid quotation of an argument
+   0 : command is not allowed
+   2 : restricted shell escape, CMD is allowed.
+   
+   We set *SAFECMD to a safely-quoted version of *CMD; this is what
+   should get executed.  And we set CMDNAME to its first word; this is
+   what is checked against the shell_escape_commands list.  */
+
+static int
+shell_cmd_is_allowed (char **cmd, char **safecmd, char **cmdname)
+{
+  char **p;
+  char *buf;
+  char *s, *d;
+  int  pre, spaces;
+  int  allow = 0;
+
+  /* pre == 1 means that the previous character is a white space
+     pre == 0 means that the previous character is not a white space */
+  buf = (char *) xmalloc (strlen (*cmd) + 1);
+  strcpy (buf, *cmd);
+  s = buf;
+  while (Isspace (*s))
+    s++;
+  d = s;
+  while (!Isspace(*d) && *d)
+    d++;
+  *d = '\0';
+
+  /* *cmdname is the first word of the command line.  For example,
+     *cmdname == "kpsewhich" for
+     \write18{kpsewhich --progname=dvipdfm --format="other text files" config}
+  */
+  *cmdname = xstrdup (s);
+  free (buf);
+
+  /* Is *cmdname listed in a texmf.cnf vriable as
+     shell_escape_commands = foo,bar,... ? */
+  p = cmdlist;
+  if (p) {
+    while (*p) {
+      if (strcmp (*p, *cmdname) == 0) {
+      /* *cmdname is found in the list, so restricted shell escape
+          is allowed */
+        allow = 2;
+        break;
+      }
+      p++;
+    }
+  }
+  if (allow == 2) {
+    spaces = 0;
+    for (s = *cmd; *s; s++) {
+      if (Isspace (*s))
+        spaces++;
+    }
+
+    /* allocate enough memory (too much?) */
+#ifdef WIN32
+    *safecmd = (char *) xmalloc (2 * strlen (*cmd) + 3 + 2 * spaces);
+#else
+    *safecmd = (char *) xmalloc (strlen (*cmd) + 3 + 2 * spaces);
+#endif
+
+    /* make a safe command line *safecmd */
+    s = *cmd;
+    while (Isspace (*s))
+      s++;
+    d = *safecmd;
+    while (!Isspace (*s) && *s)
+      *d++ = *s++;
+
+    pre = 1;
+    while (*s) {
+      /* Quotation given by a user.  " should always be used; we
+         transform it below.  On Unix, if ' is used, simply immediately
+         return a quotation error.  */
+      if (*s == '\'') {
+        return -1;
+      }
+         
+      if (*s == '"') {
+        /* All arguments are quoted as 'foo' (Unix) or "foo" (Windows)
+           before calling system(). Therefore closing QUOTE is necessary
+           if the previous character is not a white space.
+           example:
+           --format="other text files" becomes
+           '--format=''other text files' (Unix)
+           "--format=""other test files" (Windows) */
+
+        if (pre == 0)
+          *d++ = QUOTE;
+
+        pre = 0;
+        /* output the quotation mark for the quoted argument */
+        *d++ = QUOTE;
+        s++;
+
+        while (*s != '"') {
+          /* Closing quotation mark is missing */
+          if (*s == '\0')
+            return -1;
+#ifdef WIN32
+          if (char_needs_quote (*s))
+            *d++ = '^';
+#endif
+          *d++ = *s++;
+        }
+
+        /* Closing quotation mark will be output afterwards, so
+           we do nothing here */
+        s++;
+
+        /* The character after the closing quotation mark
+           should be a white space or NULL */
+        if (!Isspace (*s) && *s)
+          return -1;
+
+      /* Beginning of a usual argument */
+      } else if (pre == 1 && !Isspace (*s)) {
+        pre = 0;
+        *d++ = QUOTE;
+#ifdef WIN32
+        if (char_needs_quote (*s))
+          *d++ = '^';
+#endif
+        *d++ = *s++;
+        /* Ending of a usual argument */
+
+      } else if (pre == 0 && Isspace (*s)) {
+        pre = 1;
+        /* Closing quotation mark */
+        *d++ = QUOTE;
+        *d++ = *s++;
+      } else {
+        /* Copy a character from *cmd to *safecmd. */
+#ifdef WIN32
+        if (char_needs_quote (*s))
+          *d++ = '^';
+#endif
+        *d++ = *s++;
+      }
+    }
+    /* End of the command line */
+    if (pre == 0) {
+      *d++ = QUOTE;
+    }
+    *d = '\0';
+  }
+
+  return allow;
+}
+
+/* We should only be called with shellenabledp == 1.
+   Return value:
+   -1 if a quotation syntax error.
+   0 if CMD is not allowed; given shellenabledp==1, this is because
+      shell escapes are restricted and CMD is not allowed.
+   1 if shell escapes are not restricted, hence any command is allowed.
+   2 if shell escapes are restricted and CMD is allowed.  */
+   
+int
+runsystem (char *cmd)
+{
+  int allow = 0;
+  char *safecmd = NULL;
+  char *cmdname = NULL;
+
+  if (shellenabledp <= 0) {
+    return 0;
+  }
+  
+  /* If restrictedshell == 0, any command is allowed. */
+  if (restrictedshell == 0)
+    allow = 1;
+  else
+    allow = shell_cmd_is_allowed (&cmd, &safecmd, &cmdname);
+
+  if (allow == 1)
+    (void) system (cmd);
+  else if (allow == 2)
+    (void) system (safecmd);
+
+  if (safecmd)
+    free (safecmd);
+  if (cmdname)
+    free (cmdname);
+
+  return allow;
+}
+
+/* Like runsystem(), the runpopen() function is called only when
+   shellenabledp == 1.   Unlike runsystem(), here we write errors to
+   stderr, since we have nowhere better to use; and of course we return
+   a file handle (or NULL) instead of a status indicator.  */
+
+static FILE *
+runpopen (char *cmd, char *mode)
+{
+  FILE *f = NULL;
+  char *safecmd = NULL;
+  char *cmdname = NULL;
+  int allow;
+
+  /* If restrictedshell == 0, any command is allowed. */
+  if (restrictedshell == 0)
+    allow = 1;
+  else
+    allow = shell_cmd_is_allowed (&cmd, &safecmd, &cmdname);
+
+  if (allow == 1)
+    f = popen (cmd, mode);
+  else if (allow == 2)
+    f = popen (safecmd, mode);
+  else if (allow == -1)
+    fprintf (stderr, "\nrunpopen quotation error in command line: %s\n",
+             cmd);
+  else
+    fprintf (stderr, "\nrunpopen command not allowed: %s\n", cmdname);
+
+  if (safecmd)
+    free (safecmd);
+  if (cmdname)
+    free (cmdname);
+  return f;
+}
+#endif
+
 /* The main program, etc.  */
 
 #ifdef XeTeX
@@ -389,11 +785,8 @@ maininit P2C(int, ac, string *, av)
   kpse_set_program_enabled (kpse_fmt_format, MAKE_TEX_FMT_BY_DEFAULT,
                             kpse_src_compile);
 
-  if (shellenabledp < 0) {
-    shellenabledp = 0;
-  } else if (!shellenabledp) {
-    shellenabledp = texmf_yesno ("shell_escape");
-  }
+  init_shell_escape ();
+
   if (!outputcomment) {
     outputcomment = kpse_var_value ("output_comment");
   }
@@ -420,14 +813,16 @@ main P2C(int, ac,  string *, av)
   lua_initialize (ac, av);
 #else
   maininit (ac, av);
-#endif
+#endif /* not luaTeX */
 
   /* Call the real main program.  */
   mainbody ();
+  
   return EXIT_SUCCESS;
 } 
 #endif /* !(WIN32 || __MINGW32__) */
 
+
 /* This is supposed to ``open the terminal for input'', but what we
    really do is copy command line arguments into TeX's or Metafont's
    buffer, so they can handle them.  If nothing is available, or we've
@@ -507,7 +902,6 @@ topenin P1H(void)
 #endif
 }
 
-
 /* IPC for TeX.  By Tom Rokicki for the NeXT; it makes TeX ship out the
    DVI file in a pipe to TeXView so that the output can be displayed
    incrementally.  Shamim Mohamed adapted it for Web2c.  */
@@ -959,6 +1353,7 @@ static struct option long_options[]
 #endif /* pdfTeX */
       { "shell-escape",              0, &shellenabledp, 1 },
       { "no-shell-escape",           0, &shellenabledp, -1 },
+      { "shell-restricted",          0, 0, 0 },
       { "debug-format",              0, &debugformatfile, 1 },
       { "src-specials",              2, 0, 0 },
 #if defined(__SyncTeX__)
@@ -1064,7 +1459,7 @@ parse_options P2C(int, argc,  string *, argv)
       } else {
         WARNING2 ("Comment truncated to 255 characters from %d. (%s)",
                   len, optarg);
-        outputcomment = (string)xmalloc (256);
+        outputcomment = (string) xmalloc (256);
         strncpy (outputcomment, optarg, 255);
         outputcomment[255] = 0;
       }
@@ -1083,6 +1478,11 @@ parse_options P2C(int, argc,  string *, argv)
         }
       }
 #endif /* IPC */
+
+    } else if (ARGUMENT_IS ("shell-restricted")) {
+      shellenabledp = 1;
+      restrictedshell = 1;
+      
     } else if (ARGUMENT_IS ("src-specials")) {
        last_source_name = xstrdup("");
        /* Option `--src" without any value means `auto' mode. */
@@ -1442,7 +1842,7 @@ open_in_or_pipe P3C(FILE **, f_ptr,  int, filefmt,  const_string, fopen_mode)
       fullnameoffile = xstrdup (fname);
 #endif
       recorder_record_input (fname + 1);
-      *f_ptr = popen(fname+1,"r");
+      *f_ptr = runpopen(fname+1,"r");
       free(fname);
       for (i=0; i<=15; i++) {
         if (pipes[i]==NULL) {
@@ -1481,10 +1881,10 @@ open_out_or_pipe P2C(FILE **, f_ptr,  const_string, fopen_mode)
            is better to be prepared */
         if (STREQ((fname+strlen(fname)-3),"tex"))
           *(fname+strlen(fname)-4) = 0;
-        *f_ptr = popen(fname+1,"w");
+        *f_ptr = runpopen(fname+1,"w");
         *(fname+strlen(fname)) = '.';
       } else {
-        *f_ptr = popen(fname+1,"w");
+        *f_ptr = runpopen(fname+1,"w");
       }
       recorder_record_output (fname + 1);
       free(fname);
@@ -1515,7 +1915,8 @@ close_file_or_pipe P1C(FILE *, f)
     /* if this file was a pipe, pclose() it and return */    
     for (i=0; i<=15; i++) {
       if (pipes[i] == f) {
-        pclose (f);
+        if (f)
+          pclose (f);
         pipes[i] = NULL;
         return;
       }
diff --git a/Build/source/texk/web2c/luatexdir/lua/luainit.c b/Build/source/texk/web2c/luatexdir/lua/luainit.c
index 8e35dca0fdb..5b38f314644 100644
--- a/Build/source/texk/web2c/luatexdir/lua/luainit.c
+++ b/Build/source/texk/web2c/luatexdir/lua/luainit.c
@@ -359,6 +359,9 @@ init_kpse (void) {
 
   kpse_set_program_name(argv[0], user_progname);
   program_name_set=1;
+
+  /* Needs program_name set.  */
+  init_shell_escape ();
 }
 
 void
diff --git a/Build/source/texk/web2c/luatexdir/luatex.ch b/Build/source/texk/web2c/luatexdir/luatex.ch
index dd1c17e44af..0ae368beb80 100644
--- a/Build/source/texk/web2c/luatexdir/luatex.ch
+++ b/Build/source/texk/web2c/luatexdir/luatex.ch
@@ -1441,6 +1441,10 @@ end
 @y
 if shellenabledp then begin
   wlog_cr;
+  wlog(' ');
+  if restrictedshell then begin
+    wlog('restricted ');
+  end;
   wlog('\write18 enabled.')
   end;
 if srcspecialsp then begin
@@ -2212,7 +2216,11 @@ end {|main_body|};
   if format_ident>0 then slow_print(format_ident);
   print_ln;
   if shellenabledp then begin
-    wterm_ln(' \write18 enabled.')
+    wterm(' ');
+    if restrictedshell then begin
+      wterm('restricted ');
+    end;
+    wterm_ln('\write18 enabled.');
   end;
   if srcspecialsp then begin
     wterm_ln(' Source specials enabled.')
@@ -2310,6 +2318,7 @@ begin @<Expand macros in the token list
 @y
 @!d:integer; {number of characters in incomplete current string}
 @!clobbered:boolean; {system string is ok?}
+@!runsystem_ret:integer; {return value from |runsystem|}
 begin @<Expand macros in the token list
 @z
 
@@ -2331,29 +2340,35 @@ if j=18 then
   {If the log file isn't open yet, we can only send output to the terminal.
    Calling |open_log_file| from here seems to result in bad data in the log.}
   if not log_opened then selector:=term_only;
-  print_nl("system(");
+  print_nl("runsystem(");
   for d:=0 to cur_length-1 do
     begin {|print| gives up if passed |str_ptr|, so do it by hand.}
     print(so(str_pool[str_start_macro(str_ptr)+d])); {N.B.: not |print_char|}
     end;
   print(")...");
-  if shellenabledp then
-    begin str_room(1); append_char(0); {Append a null byte to the expansion.}
+  if shellenabledp then begin
+    str_room(1); append_char(0); {Append a null byte to the expansion.}
     clobbered:=false;
     for d:=0 to cur_length-1 do {Convert to external character set.}
-      begin str_pool[str_start_macro(str_ptr)+d]:=xchr[str_pool[str_start_macro(str_ptr)+d]];
-      if (str_pool[str_start_macro(str_ptr)+d]=null_code)
-         and (d<cur_length-1) then clobbered:=true;
+      begin
+        str_pool[str_start_macro(str_ptr)+d]:=xchr[str_pool[str_start_macro(str_ptr)+d]];
+        if (str_pool[str_start_macro(str_ptr)+d]=null_code)
+           and (d<cur_length-1) then clobbered:=true;
         {minimal checking: NUL not allowed in argument string of |system|()}
       end;
     if clobbered then print("clobbered")
-    else begin {We have the string; run system(3). We don't have anything
-            reasonable to do with the return status, unfortunately discard it.}
-      system(stringcast(addressof(str_pool[str_start_macro(str_ptr)])));
-      print("executed");
-      end;
-    end
-  else begin print("disabled");
+    else begin {We have the command.  See if we're allowed to execute it,
+         and report in the log.  We don't check the actual exit status of
+         the command, or do anything with the output.}
+      runsystem_ret := runsystem(stringcast(addressof(
+                                         str_pool[str_start_macro(str_ptr)])));
+      if runsystem_ret = -1 then print("quotation error in system command")
+      else if runsystem_ret = 0 then print("disabled (restricted)")
+      else if runsystem_ret = 1 then print("executed")
+      else if runsystem_ret = 2 then print("executed (allowed)")
+    end;
+  end else begin
+    print("disabled"); {|shellenabledp| false}
   end;
   print_char("."); print_nl(""); print_ln;
   pool_ptr:=str_start_macro(str_ptr);  {erase the string}
@@ -2449,6 +2464,7 @@ strings.
 @!save_str_ptr: str_number;
 @!save_pool_ptr: pool_pointer;
 @!shellenabledp: cinttype;
+@!restrictedshell: cinttype;
 @!output_comment: ^char;
 @!k,l: 0..255; {used by `Make the first 256 strings', etc.}
 
diff --git a/Build/source/texk/web2c/luatexdir/luatexlib.mk b/Build/source/texk/web2c/luatexdir/luatexlib.mk
index 32e14e124cd..d16ed88a709 100644
--- a/Build/source/texk/web2c/luatexdir/luatexlib.mk
+++ b/Build/source/texk/web2c/luatexdir/luatexlib.mk
@@ -63,7 +63,7 @@ $(SLNUNICODEDEP): $(SLNUNICODEDIR)/slnunico.c $(SLNUNICODEDIR)/slnudata.c
 # because the zlib path is relative and can't be found otherwise.
 #
 # final trickyness: configure writes a Makefile in the source
-# directory. it is needed by anything, so I delete it right away
+# directory. it is not needed by anything, so I delete it right away
 
 zzipretarget=
 
diff --git a/Build/source/texk/web2c/pdftexdir/NEWS b/Build/source/texk/web2c/pdftexdir/NEWS
index 97d9bd6195c..fb85263a5c0 100644
--- a/Build/source/texk/web2c/pdftexdir/NEWS
+++ b/Build/source/texk/web2c/pdftexdir/NEWS
@@ -1,3 +1,5 @@
+  - \pdfshellescape is 2 if restricted shell escapes are enabled.
+
 --------------------------------------------------
 pdfTeX 3.1415926-1.40.9 was released on 2008-08-??
 --------------------------------------------------
diff --git a/Build/source/texk/web2c/pdftexdir/pdftex.web b/Build/source/texk/web2c/pdftexdir/pdftex.web
index 49a81e30606..a2b9f3abda2 100644
--- a/Build/source/texk/web2c/pdftexdir/pdftex.web
+++ b/Build/source/texk/web2c/pdftexdir/pdftex.web
@@ -9818,7 +9818,10 @@ if m>=input_line_no_code then
   random_seed_code:  cur_val := random_seed;
   pdf_shell_escape_code:
     begin
-    if shell_enabled_p then cur_val := 1
+    if shellenabledp then begin
+      if restrictedshell then cur_val :=2
+      else cur_val := 1;
+    end
     else cur_val := 0;
     end;
   pdf_last_link_code:   cur_val := pdf_last_link;
diff --git a/Build/source/texk/web2c/tex.ch b/Build/source/texk/web2c/tex.ch
index 3cb55a6c391..765bab70e96 100644
--- a/Build/source/texk/web2c/tex.ch
+++ b/Build/source/texk/web2c/tex.ch
@@ -44,6 +44,8 @@
 % (2) if you do make changes, you name it to something other than
 %     "mltex.ch", "char_sub.ch", or "charsub.ch".
 %
+% Except for MLTeX, the new code in this file is in the public domain.
+% 
 % The module numbers in this change file refer to TEX.WEB 3.14159 as
 % of March, 1995 (published as Donald E. Knuth, TeX: The Program,
 % Volume B of Computers & Typesetting).
@@ -600,10 +602,10 @@ tini@/
   at most |max_halfword|}
 @!dvi_buf_size:integer; {size of the output buffer; must be a multiple of 8}
 @!expand_depth:integer; {limits recursive calls to the |expand| procedure}
-@!parse_first_line_p:c_int_type; {parse the first line for options}
-@!file_line_error_style_p:c_int_type; {format messages as file:line:error}
-@!eight_bit_p:c_int_type; {make all characters printable by default}
-@!halt_on_error_p:c_int_type; {stop at first error}
+@!parse_first_line_p:cinttype; {parse the first line for options}
+@!file_line_error_style_p:cinttype; {format messages as file:line:error}
+@!eight_bit_p:cinttype; {make all characters printable by default}
+@!halt_on_error_p:cinttype; {stop at first error}
 @!quoted_filename:boolean; {current filename is quoted}
 {Variables for source specials}
 @!src_specials_p : boolean;{Whether |src_specials| are enabled at all}
@@ -824,8 +826,12 @@ else  begin slow_print(format_ident); print_ln;
 wterm(version_string);
 if format_ident>0 then slow_print(format_ident);
 print_ln;
-if shell_enabled_p then begin
-  wterm_ln(' \write18 enabled.')
+if shellenabledp then begin
+  wterm(' ');
+  if restrictedshell then begin
+    wterm('restricted ');
+  end;
+  wterm_ln('\write18 enabled.');
 end;
 if src_specials_p then begin
   wterm_ln(' Source specials enabled.')
@@ -1882,7 +1888,7 @@ if_eof_code: begin scan_four_bit_int; b:=(read_open[cur_val]=closed);
   end;
 @y
 if_eof_code: begin scan_four_bit_int_or_18;
-  if cur_val=18 then b:=not shell_enabled_p
+  if cur_val=18 then b:=not shellenabledp
   else b:=(read_open[cur_val]=closed);
   end;
 @z
@@ -2372,13 +2378,17 @@ months:='JANFEBMARAPRMAYJUNJULAUGSEPOCTNOVDEC';
 months := ' JANFEBMARAPRMAYJUNJULAUGSEPOCTNOVDEC';
 @z
 
-% Print whether we're using src-specials.
+% Print whether we're using src-specials and other such features.
 % Print TCX name if one's given.
 @x [29/536] l.10331
 end
 @y
-if shell_enabled_p then begin
+if shellenabledp then begin
   wlog_cr;
+  wlog(' ');
+  if restrictedshell then begin
+    wlog('restricted ');
+  end;
   wlog('\write18 enabled.')
   end;
 if src_specials_p then begin
@@ -4599,7 +4609,7 @@ print(" (format="); print(job_name); print_char(" ");
 @d setup_bound_var(#)==bound_default:=#; setup_bound_var_end
 @d setup_bound_var_end(#)==bound_name:=#; setup_bound_var_end_end
 @d setup_bound_var_end_end(#)==
-  setup_bound_variable(address_of(#), bound_name, bound_default);
+  setup_bound_variable(addressof(#), bound_name, bound_default);
 
 @p procedure main_body;
 begin @!{|start_here|}
@@ -4990,6 +5000,7 @@ begin @<Expand macros in the token list
 @y
 @!d:integer; {number of characters in incomplete current string}
 @!clobbered:boolean; {system string is ok?}
+@!runsystem_ret:integer; {return value from |runsystem|}
 begin
 mubyte_sout := mubyte_out;  mubyte_out := write_mubyte(p) - mubyte_zero;
 if (mubyte_out > 2) or (mubyte_out = -1) or (mubyte_out = -2) then
@@ -5030,29 +5041,35 @@ if j=18 then
   {If the log file isn't open yet, we can only send output to the terminal.
    Calling |open_log_file| from here seems to result in bad data in the log.}
   if not log_opened then selector:=term_only;
-  print_nl("system(");
+  print_nl("runsystem(");
   for d:=0 to cur_length-1 do
     begin {|print| gives up if passed |str_ptr|, so do it by hand.}
     print(so(str_pool[str_start[str_ptr]+d])); {N.B.: not |print_char|}
     end;
   print(")...");
-  if shell_enabled_p then
-    begin str_room(1); append_char(0); {Append a null byte to the expansion.}
+  if shellenabledp then begin
+    str_room(1); append_char(0); {Append a null byte to the expansion.}
     clobbered:=false;
     for d:=0 to cur_length-1 do {Convert to external character set.}
-      begin str_pool[str_start[str_ptr]+d]:=xchr[str_pool[str_start[str_ptr]+d]];
-      if (str_pool[str_start[str_ptr]+d]=null_code)
-         and (d<cur_length-1) then clobbered:=true;
+      begin
+        str_pool[str_start[str_ptr]+d]:=xchr[str_pool[str_start[str_ptr]+d]];
+        if (str_pool[str_start[str_ptr]+d]=null_code)
+           and (d<cur_length-1) then clobbered:=true;
         {minimal checking: NUL not allowed in argument string of |system|()}
       end;
     if clobbered then print("clobbered")
-    else begin {We have the string; run system(3). We don't have anything
-            reasonable to do with the return status, unfortunately discard it.}
-      system(conststringcast(address_of(str_pool[str_start[str_ptr]])));
-      print("executed");
-      end;
-    end
-  else begin print("disabled");
+    else begin {We have the command.  See if we're allowed to execute it,
+         and report in the log.  We don't check the actual exit status of
+         the command, or do anything with the output.}
+      runsystem_ret := runsystem(conststringcast(addressof(
+                                              str_pool[str_start[str_ptr]])));
+      if runsystem_ret = -1 then print("quotation error in system command")
+      else if runsystem_ret = 0 then print("disabled (restricted)")
+      else if runsystem_ret = 1 then print("executed")
+      else if runsystem_ret = 2 then print("executed (allowed)")
+    end;
+  end else begin
+    print("disabled"); {|shellenabledp| false}
   end;
   print_char("."); print_nl(""); print_ln;
   pool_ptr:=str_start[str_ptr];  {erase the string}
@@ -5104,7 +5121,7 @@ system-dependent section allows easy integration of Web2c and e-\TeX, etc.)
 @<Glob...@>=
 @!edit_name_start: pool_pointer; {where the filename to switch to starts}
 @!edit_name_length,@!edit_line: integer; {what line to start editing at}
-@!ipc_on: c_int_type; {level of IPC action, 0 for none [default]}
+@!ipc_on: cinttype; {level of IPC action, 0 for none [default]}
 @!stop_at_space: boolean; {whether |more_name| returns false for space}
 
 @ The |edit_name_start| will be set to point into |str_pool| somewhere after
@@ -5120,7 +5137,8 @@ strings.
 @<Global...@> =
 @!save_str_ptr: str_number;
 @!save_pool_ptr: pool_pointer;
-@!shell_enabled_p: c_int_type;
+@!shellenabledp: cinttype;
+@!restrictedshell: cinttype;
 @!output_comment: ^char;
 @!k,l: 0..255; {used by `Make the first 256 strings', etc.}
 
diff --git a/Build/source/texk/web2c/texmfmp-help.h b/Build/source/texk/web2c/texmfmp-help.h
index 4c5b52dd91a..1b21d627582 100644
--- a/Build/source/texk/web2c/texmfmp-help.h
+++ b/Build/source/texk/web2c/texmfmp-help.h
@@ -1,7 +1,7 @@
 /* The help messages for TeX & MF family of programs.
 
+Copyright 1995, 1996, 2008, 2009 Karl Berry.
 Copyright 2001-05 Olaf Weber.
-Copyright 1995, 96 Karl Berry.
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -64,6 +64,7 @@ const_string ALEPHHELP[] = {
     "-progname=STRING        set program (and fmt) name to STRING",
     "-recorder               enable filename recorder (always on)",
     "[-no]-shell-escape      disable/enable \\write18{SHELL COMMAND}",
+    "-shell-restricted       enable restricted \\write18",
     "-src-specials           insert source specials into the DVI file",
     "-src-specials=WHERE     insert source specials in certain places of",
     "                          the DVI file. WHERE is a comma-separated value",
@@ -122,6 +123,7 @@ const_string LUATEXHELP[] = {
     "-progname=STRING        set program (and fmt) name to STRING",
     "-recorder               enable filename recorder",
     "[-no]-shell-escape      disable/enable \\write18{SHELL COMMAND}",
+    "-shell-restricted       enable restricted \\write18",
     "-src-specials           insert source specials into the DVI file",
     "-src-specials=WHERE     insert source specials in certain places of",
     "                          the DVI file. WHERE is a comma-separated value",
@@ -180,6 +182,7 @@ const_string ETEXHELP[] = {
     "-progname=STRING        set program (and fmt) name to STRING",
     "-recorder               enable filename recorder",
     "[-no]-shell-escape      disable/enable \\write18{SHELL COMMAND}",
+    "-shell-restricted       enable restricted \\write18",
     "-src-specials           insert source specials into the DVI file",
     "-src-specials=WHERE     insert source specials in certain places of",
     "                          the DVI file. WHERE is a comma-separated value",
@@ -328,6 +331,7 @@ const_string OMEGAHELP[] = {
     "-progname=STRING        set program (and fmt) name to STRING",
     "-recorder               enable filename recorder (always on)",
     "[-no]-shell-escape      disable/enable \\write18{SHELL COMMAND}",
+    "-shell-restricted       enable restricted \\write18",
     "-src-specials           insert source specials into the DVI file",
     "-src-specials=WHERE     insert source specials in certain places of",
     "                          the DVI file. WHERE is a comma-separated value",
@@ -381,6 +385,7 @@ const_string EOMEGAHELP[] = {
     "-progname=STRING        set program (and fmt) name to STRING",
     "-recorder               enable filename recorder (always on)",
     "[-no]-shell-escape      disable/enable \\write18{SHELL COMMAND}",
+    "-shell-restricted       enable restricted \\write18",
     "-src-specials           insert source specials into the DVI file",
     "-src-specials=WHERE     insert source specials in certain places of",
     "                          the DVI file. WHERE is a comma-separated value",
@@ -440,6 +445,7 @@ const_string PDFTEXHELP[] = {
     "-progname=STRING        set program (and fmt) name to STRING",
     "-recorder               enable filename recorder",
     "[-no]-shell-escape      disable/enable \\write18{SHELL COMMAND}",
+    "-shell-restricted       enable restricted \\write18",
     "-src-specials           insert source specials into the DVI file",
     "-src-specials=WHERE     insert source specials in certain places of",
     "                          the DVI file. WHERE is a comma-separated value",
@@ -498,6 +504,7 @@ const_string XETEXHELP[] = {
     "-progname=STRING        set program (and fmt) name to STRING",
     "-recorder               enable filename recorder",
     "[-no]-shell-escape      disable/enable \\write18{SHELL COMMAND}",
+    "-shell-restricted       enable restricted \\write18",
     "-src-specials           insert source specials into the XDV file",
     "-src-specials=WHERE     insert source specials in certain places of",
     "                          the XDV file. WHERE is a comma-separated value",
@@ -558,6 +565,7 @@ const_string TEXHELP[] = {
     "-progname=STRING        set program (and fmt) name to STRING",
     "-recorder               enable filename recorder",
     "[-no]-shell-escape      disable/enable \\write18{SHELL COMMAND}",
+    "-shell-restricted       enable restricted \\write18",
     "-src-specials           insert source specials into the DVI file",
     "-src-specials=WHERE     insert source specials in certain places of",
     "                          the DVI file. WHERE is a comma-separated value",
diff --git a/Build/source/texk/web2c/web2c/ChangeLog b/Build/source/texk/web2c/web2c/ChangeLog
index 0f765a71e06..74aac9826c1 100644
--- a/Build/source/texk/web2c/web2c/ChangeLog
+++ b/Build/source/texk/web2c/web2c/ChangeLog
@@ -1,3 +1,8 @@
+2009-02-26  Karl Berry  <karl@tug.org>
+
+	* texmf.defines (runsystem): new fn.
+	(system): remove procedure.
+
 2008-05-25  Karl Berry  <karl@tug.org>
 
 	* texmf.defines (loadpoolstrings): formatting.
diff --git a/Build/source/texk/web2c/web2c/texmf.defines b/Build/source/texk/web2c/web2c/texmf.defines
index 82b9db0775f..3240b97225a 100644
--- a/Build/source/texk/web2c/web2c/texmf.defines
+++ b/Build/source/texk/web2c/web2c/texmf.defines
@@ -36,6 +36,7 @@
 @define function openoutnameok ();
 @define function roundfraction ();
 @define function roundunscaled ();
+@define function runsystem ();
 @define function wopenin ();
 @define function wopenout ();
 
@@ -59,7 +60,6 @@
 @define procedure readtcxfile;
 @define procedure remembersourceinfo ();
 @define procedure setupboundvariable ();
-@define procedure system ();
 @define procedure topenin;
 @define procedure undumphh ();
 @define procedure undumpint ();
diff --git a/Build/source/texk/web2c/xetexdir/xetex.ch b/Build/source/texk/web2c/xetexdir/xetex.ch
index fc496e54cec..1a2b433a378 100644
--- a/Build/source/texk/web2c/xetexdir/xetex.ch
+++ b/Build/source/texk/web2c/xetexdir/xetex.ch
@@ -4452,7 +4452,7 @@ if is_ot_font(g) then begin
   free_node(b, native_size(b));
   f:=g; c:=x; w:=0; n:=0;
   repeat
-    y:=get_ot_math_variant(g, x, n, address_of(u), 0);
+    y:=get_ot_math_variant(g, x, n, addressof(u), 0);
     if u>w then begin
       c:=y; w:=u;
       if u>=v then goto found;
@@ -4657,7 +4657,7 @@ if x<>null then begin
   c:=native_glyph(p);
   a:=0;
   repeat
-    g:=get_ot_math_variant(f, c, a, address_of(w2), 1);
+    g:=get_ot_math_variant(f, c, a, addressof(w2), 1);
     if (w2>0) and (w2<=wa) then begin
       native_glyph(p):=g;
       set_native_glyph_metrics(p, 1);
@@ -4788,7 +4788,7 @@ if math_type(nucleus(q))=math_char then
         c:=native_glyph(p);
         n:=0;
         repeat
-          g:=get_ot_math_variant(cur_f, c, n, address_of(h2), 0);
+          g:=get_ot_math_variant(cur_f, c, n, addressof(h2), 0);
           if h2>0 then native_glyph(p):=g;
           incr(n);
         until (h2<0) or (h2>=h1);
@@ -5867,7 +5867,7 @@ begin if tail<>head then
 @y
   if is_native_font(f) then
     begin a:=width(p);
-    if a=0 then get_native_char_sidebearings(f, cur_val, address_of(lsb), address_of(rsb))
+    if a=0 then get_native_char_sidebearings(f, cur_val, addressof(lsb), addressof(rsb))
     end
   else a:=char_width(f)(char_info(f)(character(p)));@/
 @z
@@ -5887,7 +5887,7 @@ w:=char_width(f)(i); h:=char_height(f)(height_depth(i));
 @y
 if is_native_font(f) then begin
   w:=width(q);
-  get_native_char_height_depth(f, cur_val, address_of(h), address_of(delta))
+  get_native_char_height_depth(f, cur_val, addressof(h), addressof(delta))
     {using delta as scratch space for the unneeded depth value}
 end else begin
   i:=char_info(f)(character(q));
@@ -7496,22 +7496,23 @@ token_show(def_ref); print_ln;
 @z
 
 @x
-      begin str_pool[str_start[str_ptr]+d]:=xchr[str_pool[str_start[str_ptr]+d]];
-      if (str_pool[str_start[str_ptr]+d]=null_code)
+        str_pool[str_start[str_ptr]+d]:=xchr[str_pool[str_start[str_ptr]+d]];
+        if (str_pool[str_start[str_ptr]+d]=null_code)
 @y
-      begin
       if (str_pool[str_start_macro(str_ptr)+d]=null_code)
 @z
 
-@x
-      system(conststringcast(address_of(str_pool[str_start[str_ptr]])));
+@x convert from UTF-16 to UTF-8 for system(3).
+      runsystem_ret := runsystem(conststringcast(addressof(
+                                              str_pool[str_start[str_ptr]])));
 @y
       if name_of_file then libc_free(name_of_file);
       name_of_file := xmalloc(cur_length * 3 + 2);
       k := 0;
-      for d:=0 to cur_length-1 do append_to_name(str_pool[str_start_macro(str_ptr)+d]);
+      for d:=0 to cur_length-1 do
+        append_to_name(str_pool[str_start_macro(str_ptr)+d]);
       name_of_file[k+1] := 0;
-      system(conststringcast(name_of_file+1));
+      runsystem_ret := runsystem(conststringcast(name_of_file+1));
 @z
 
 @x
@@ -7610,22 +7611,22 @@ end
 
 @d update_corners==
 	for i := 0 to 3 do
-		transform_point(address_of(corners[i]), address_of(t2))
+		transform_point(addressof(corners[i]), addressof(t2))
 
 @d do_size_requests==begin
 	{ calculate current width and height }
 	calc_min_and_max;
 	if x_size_req = 0.0 then begin
-		make_scale(address_of(t2), y_size_req / (ymax - ymin), y_size_req / (ymax - ymin));
+		make_scale(addressof(t2), y_size_req / (ymax - ymin), y_size_req / (ymax - ymin));
 	end else if y_size_req = 0.0 then begin
-		make_scale(address_of(t2), x_size_req / (xmax - xmin), x_size_req / (xmax - xmin));
+		make_scale(addressof(t2), x_size_req / (xmax - xmin), x_size_req / (xmax - xmin));
 	end else begin
-		make_scale(address_of(t2), x_size_req / (xmax - xmin), y_size_req / (ymax - ymin));
+		make_scale(addressof(t2), x_size_req / (xmax - xmin), y_size_req / (ymax - ymin));
 	end;
 	update_corners;
 	x_size_req := 0.0;
 	y_size_req := 0.0;
-	transform_concat(address_of(t), address_of(t2));
+	transform_concat(addressof(t), addressof(t2));
 end
 
 @<Declare procedures needed in |do_extension|@>=
@@ -7663,7 +7664,7 @@ begin
 	end;
 
 	{ access the picture file and check its size }
-	result := find_pic_file(address_of(pic_path), address_of(bounds), pdf_box_type, page);
+	result := find_pic_file(addressof(pic_path), addressof(bounds), pdf_box_type, page);
 
 	setPoint(corners[0], xField(bounds), yField(bounds));
 	setPoint(corners[1], xField(corners[0]), yField(bounds) + htField(bounds));
@@ -7674,30 +7675,30 @@ begin
 	y_size_req := 0.0;
 
 	{ look for any scaling requests for this picture }
-	make_identity(address_of(t));
+	make_identity(addressof(t));
 
 	check_keywords := true;
 	while check_keywords do begin
 		if scan_keyword("scaled") then begin
 			scan_int;
 			if (x_size_req = 0.0) and (y_size_req = 0.0) then begin
-				make_scale(address_of(t2), float(cur_val) / 1000.0, float(cur_val) / 1000.0);
+				make_scale(addressof(t2), float(cur_val) / 1000.0, float(cur_val) / 1000.0);
 				update_corners;
-				transform_concat(address_of(t), address_of(t2));
+				transform_concat(addressof(t), addressof(t2));
 			end
 		end else if scan_keyword("xscaled") then begin
 			scan_int;
 			if (x_size_req = 0.0) and (y_size_req = 0.0) then begin
-				make_scale(address_of(t2), float(cur_val) / 1000.0, 1.0);
+				make_scale(addressof(t2), float(cur_val) / 1000.0, 1.0);
 				update_corners;
-				transform_concat(address_of(t), address_of(t2));
+				transform_concat(addressof(t), addressof(t2));
 			end
 		end else if scan_keyword("yscaled") then begin
 			scan_int;
 			if (x_size_req = 0.0) and (y_size_req = 0.0) then begin
-				make_scale(address_of(t2), 1.0, float(cur_val) / 1000.0);
+				make_scale(addressof(t2), 1.0, float(cur_val) / 1000.0);
 				update_corners;
-				transform_concat(address_of(t), address_of(t2));
+				transform_concat(addressof(t), addressof(t2));
 			end
 		end else if scan_keyword("width") then begin
 			scan_normal_dimen;
@@ -7726,14 +7727,14 @@ begin
 		end else if scan_keyword("rotated") then begin
 			scan_decimal;
 			if (x_size_req <> 0.0) or (y_size_req <> 0.0) then do_size_requests;
-			make_rotation(address_of(t2), Fix2X(cur_val) * 3.141592653589793 / 180.0);
+			make_rotation(addressof(t2), Fix2X(cur_val) * 3.141592653589793 / 180.0);
 			update_corners;
 			calc_min_and_max;
 			setPoint(corners[0], xmin, ymin);
 			setPoint(corners[1], xmin, ymax);
 			setPoint(corners[2], xmax, ymax);
 			setPoint(corners[3], xmax, ymin);
-			transform_concat(address_of(t), address_of(t2));
+			transform_concat(addressof(t), addressof(t2));
 		end else
 			check_keywords := false;
 	end;
@@ -7741,8 +7742,8 @@ begin
 	if (x_size_req <> 0.0) or (y_size_req <> 0.0) then do_size_requests;
 
 	calc_min_and_max;
-	make_translation(address_of(t2), -xmin * 72 / 72.27, -ymin * 72 / 72.27);
-	transform_concat(address_of(t), address_of(t2));
+	make_translation(addressof(t2), -xmin * 72 / 72.27, -ymin * 72 / 72.27);
+	transform_concat(addressof(t), addressof(t2));
 
 	if result = 0 then begin
 
@@ -7765,7 +7766,7 @@ begin
 		pic_transform5(tail) := X2Fix(txField(t));
 		pic_transform6(tail) := X2Fix(tyField(t));
 
-		memcpy(address_of(mem[tail + pic_node_size]), pic_path, strlen(pic_path));
+		memcpy(addressof(mem[tail + pic_node_size]), pic_path, strlen(pic_path));
 		libc_free(pic_path);
 
 	end else begin
@@ -7792,7 +7793,7 @@ begin
 	scan_and_pack_name;
 
 	{ convert it to "mode" and "encoding" values, and apply to the current input file }
-	i := get_encoding_mode_and_info(address_of(j));
+	i := get_encoding_mode_and_info(addressof(j));
 	if i = XeTeX_input_mode_auto then begin
 	  print_err("Encoding mode `auto' is not valid for \XeTeXinputencoding.");
       help2("You can't use `auto' encoding here, only for \XeTeXdefaultencoding. ")
@@ -7807,7 +7808,7 @@ begin
 	scan_and_pack_name;
 
 	{ convert it to "mode" and "encoding" values, and store them as defaults for new input files }
-	XeTeX_default_input_mode := get_encoding_mode_and_info(address_of(j));
+	XeTeX_default_input_mode := get_encoding_mode_and_info(addressof(j));
 	XeTeX_default_input_encoding := j;
 end
 
@@ -8648,7 +8649,7 @@ begin
 			str_room(1);
 			append_char(c);
 		end;
-		len := apply_mapping(font_mapping[f], address_of(str_pool[str_start_macro(str_ptr)]), cur_length);
+		len := apply_mapping(font_mapping[f], addressof(str_pool[str_start_macro(str_ptr)]), cur_length);
 		pool_ptr := str_start_macro(str_ptr); { flush the string, as we'll be using the mapped text instead }
 
 		i := 0;
@@ -8838,11 +8839,11 @@ begin
 	font_size[font_ptr] := actual_size;
 
 	if (native_font_type_flag = aat_font_flag) then begin
-		atsu_get_font_metrics(font_engine, address_of(ascent), address_of(descent),
-								address_of(x_ht), address_of(cap_ht), address_of(font_slant))
+		atsu_get_font_metrics(font_engine, addressof(ascent), addressof(descent),
+								addressof(x_ht), addressof(cap_ht), addressof(font_slant))
 	end else begin
-		ot_get_font_metrics(font_engine, address_of(ascent), address_of(descent),
-								address_of(x_ht), address_of(cap_ht), address_of(font_slant));
+		ot_get_font_metrics(font_engine, addressof(ascent), addressof(descent),
+								addressof(x_ht), addressof(cap_ht), addressof(font_slant));
 	end;
 
 	height_base[font_ptr] := ascent;