From e028ac13639faf703922ce3ed728a85d2e27655e Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Wed, 14 Dec 2016 09:28:26 -0500
Subject: [PATCH] passing in arguments to npm instead of command string, closes
 #5286

---
 src/plugins/install.js | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/src/plugins/install.js b/src/plugins/install.js
index c9b57909c9..9638dbc0dd 100644
--- a/src/plugins/install.js
+++ b/src/plugins/install.js
@@ -89,8 +89,7 @@ module.exports = function (Plugins) {
 				next();
 			},
 			function (next) {
-				var command = installed ? ('npm uninstall ' + id) : ('npm install ' + id + '@' + (version || 'latest'));
-				runNpmCommand(command, next);
+				runNpmCommand(type, id, version || 'latest', next);
 			},
 			function (next) {
 				Plugins.get(id, next);
@@ -102,12 +101,13 @@ module.exports = function (Plugins) {
 		], callback);
 	}
 
-	function runNpmCommand(command, callback) {
-		require('child_process').exec(command, function (err, stdout) {
+	function runNpmCommand(command, pkgName, version, callback) {
+		require('child_process').execFile('npm', [command, pkgName + (command === 'install' ? '@' + version : '')], function (err, stdout) {
 			if (err) {
 				return callback(err);
 			}
-			winston.verbose('[plugins] ' + stdout);
+
+			winston.verbose('[plugins/' + command + '] ' + stdout);
 			callback();
 		 });
 	}
@@ -119,9 +119,7 @@ module.exports = function (Plugins) {
 
 	function upgrade(id, version, callback) {
 		async.waterfall([
-			function (next) {
-				runNpmCommand('npm install ' + id + '@' + (version || 'latest'), next);
-			},
+			async.apply(runNpmCommand, 'install', id, version || 'latest'),
 			function (next) {
 				Plugins.isActive(id, next);
 			},