backport fix for BZ#1276321

.gitignore

@@ -2,3 +2,4 @@ Pygments-1.3.1.tar.gz
 /Pygments-1.4.tar.gz
 /Pygments-1.6.tar.gz
 /Pygments-2.0.2.tar.gz
+/fix-shell-injection-in-font-manager.patch

python-pygments.spec

@@ -22,13 +22,14 @@
 
 Name:           python-pygments
 Version:        2.0.2
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        Syntax highlighting engine written in Python
 
 Group:          Development/Libraries
 License:        BSD
 URL:            http://pygments.org/
 Source0:        http://pypi.python.org/packages/source/P/%{upstream_name}/%{upstream_name}-%{version}.tar.gz
+Patch0:         fix-shell-injection-in-font-manager.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 BuildArch:      noarch
@@ -99,6 +100,7 @@ need to prettify source code. Highlights are:
 
 %prep
 %setup -q -n Pygments-%{version}
+%patch0 -p 1
 
 %if 0%{?with_python3}
 rm -rf %{py3dir}
@@ -206,6 +208,9 @@ popd
 
 
 %changelog
+* Thu Oct 29 2015 Steve Milner <smilner@redhat.com> - 2.0.2-3
+- Backport patch to fix font manager shell injection for BZ#1276321
+
 * Mon Oct 12 2015 Robert Kuska <rkuska@redhat.com> - 2.0.2-2
 - Rebuilt for Python3.5 rebuild
 - Also remove python3-sphinx from BR as docs are built only with python2-sphinx

sources

@@ -1 +1,2 @@
 238587a1370d62405edabd0794b3ec4a  Pygments-2.0.2.tar.gz
+1d33104797add7b5b9e3a7feda7631ee  fix-shell-injection-in-font-manager.patch