With Pager pardes, a terminal's shell also gets SYSTEMD_PAGER and SYSTEMD_PAGERSECURE=0, and the pager's path is quoted only when it needs it

journalctl and systemctl read SYSTEMD_PAGER, not PAGER, and in their
secure mode run only less, so a pty/run of either still waited in it;
and systemd, splitting a pager on blanks and exec'ing it, never ran the
quoted path. Where the user's environment sets neither, a terminal now
gets SYSTEMD_PAGER as PAGER is set and secure mode off (this pager has
no shell to escape to), and the path is single-quoted only when it holds
a blank or shell character. Command panes keep cat.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

1 files changed, 9 insertions, 0 deletions

diff --git a/test/fs.py b/test/fs.py
index 282cca8b..fce315fc 100644
--- a/test/fs.py
+++ b/test/fs.py
@@ -495,6 +495,15 @@ def run_file(binary):
                 assert b'paged-commit-subject' in client.read(f'/pane/{pager[0]}/body')
                 assert b'\x1b' not in client.read(f'/pane/{pager[0]}/body')
                 client.remove(f'/pane/{pager[0]}')
+            # systemd's tools page through their own variable: set too, its
+            # secure mode off, the path unquoted where it needs none.
+            systemd_pager = run(client, term, b'printenv SYSTEMD_PAGER SYSTEMD_PAGERSECURE\n')
+            assert systemd_pager.startswith(b'exit 0\n') and systemd_pager.rstrip().endswith(b' -\n0'), systemd_pager
+            if shutil.which('journalctl'):
+                assert run(client, term, b'journalctl -n 3 --no-hostname\n').startswith(b'exit ')
+                for row in client.read('/index').splitlines():
+                    if row.split()[3:4] == [f'{root}/+Pager'.encode()]:
+                        client.remove(f'/pane/{row.split()[0].decode()}')
             # A pty is not given one row (it loses the prompt's input mark,
             # and the shell would read busy for ever): refused, and said.
             try: