diff -uNr opennebula-4.12.0.orig/src/datastore_mad/remotes/downloader.sh opennebula-4.12.0-fixdownloader-1addquoting/src/datastore_mad/remotes/downloader.sh
--- opennebula-4.12.0.orig/src/datastore_mad/remotes/downloader.sh	2015-03-09 12:58:29.000000000 -0500
+++ opennebula-4.12.0-fixdownloader-1addquoting/src/datastore_mad/remotes/downloader.sh	2015-03-30 10:45:34.326506389 -0500
@@ -20,19 +20,23 @@
 # to determine the file type
 function get_type
 {
+	local command
+
     if [ "$NO_DECOMPRESS" = "yes" ]; then
         echo "application/octet-stream"
     else
-        command=$1
+        command=("$@")
 
-        ( $command | head -n 1024 | file -b --mime-type - ) 2>/dev/null
+        ( "${command[@]}" | head -n 1024 | file -b --mime-type - ) 2>/dev/null
     fi
 }
 
 # Gets the command needed to decompress an stream.
 function get_decompressor
 {
-    type=$1
+	local type
+
+    type="$1"
 
     case "$type" in
     "application/x-gzip"|"application/gzip")
@@ -52,6 +56,8 @@
 # - for stdout.
 function decompress
 {
+	local command to
+
     command="$1"
     to="$2"
 
@@ -65,8 +71,11 @@
 # Function called to hash a stream. First parameter is the algorithm name.
 function hasher
 {
+	local algorithm
+	algorithm="$1"
+
     if [ -n "$1" ]; then
-        openssl dgst -$1 | awk '{print $NF}' > $HASH_FILE
+        openssl dgst "-${algorithm}" | awk '{print $NF}' > $HASH_FILE
     else
         # Needs something consuming stdin or the pipe will break
         cat >/dev/null
@@ -76,9 +85,11 @@
 # Unarchives a tar or a zip a file to a directpry with the same name.
 function unarchive
 {
+	local TO file_type tmp IN OUT command
+
     TO="$1"
 
-    file_type=$(get_type "cat $TO")
+    file_type=$(get_type cat "$TO")
 
     tmp="$TO"
 
@@ -92,21 +103,21 @@
 
     case "$file_type" in
     "application/x-tar")
-        command="tar -xf $IN -C $OUT"
+        command=(tar -xf "$IN" -C "$OUT")
         ;;
     "application/zip")
-        command="unzip -d $OUT $IN"
+        command=(unzip -d "$OUT" "$IN")
         ;;
     *)
-        command=""
+        command=()
         ;;
     esac
 
-    if [ -n "$command" ]; then
+    if [ -n "${command[*]}" ]; then
         mv "$OUT" "$IN"
         mkdir "$OUT"
 
-        $command
+        "${command[@]}"
 
         if [ "$?" != "0" ]; then
             echo "Error uncompressing archive" >&2
@@ -168,27 +179,27 @@
     # -L  to follow redirects
     # -sS to hide output except on failure
     # --limit_rate to limit the bw
-    curl_args="-sS -k -L $FROM"
+    curl_args=(-sS -k -L "$FROM")
 
     if [ -n "$LIMIT_RATE" ]; then
-        curl_args="--limit-rate $LIMIT_RATE $curl_args"
+        curl_args=(--limit-rate "$LIMIT_RATE" "${curl_args[@]}")
     fi
 
-    command="curl $curl_args"
+    command=(curl "${curl_args[@]}")
     ;;
 *)
-    if [ ! -r $FROM ]; then
+    if [ ! -r "$FROM" ]; then
         echo "Cannot read from $FROM" >&2
         exit -1
     fi
-    command="cat $FROM"
+    command=(cat "$FROM")
     ;;
 esac
 
-file_type=$(get_type "$command")
+file_type=$(get_type "${command[@]}")
 decompressor=$(get_decompressor "$file_type")
 
-$command | tee >( hasher $HASH_TYPE) | decompress "$decompressor" "$TO"
+"${command[@]}" | tee >( hasher "$HASH_TYPE") | decompress "$decompressor" "$TO"
 
 if [ "$?" != "0" ]; then
     echo "Error copying" >&2
@@ -197,7 +208,7 @@
 
 if [ -n "$HASH_TYPE" ]; then
     HASH_RESULT=$( cat $HASH_FILE)
-    rm $HASH_FILE
+    rm "$HASH_FILE"
     if [ "$HASH_RESULT" != "$HASH" ]; then
         echo "Hash does not match" >&2
         exit -1