Pluma Plugin "Snippets" Manager - Shell Command Injection

The Plugin "Snippets" in Pluma 1.8.1 is vulnerabe to Shell Commands.

If you activate the "snippet" Plugin , you can use "tools -> manage snippets" from the main menu of pluma.

Example :
========
If you import a snippet with the manager wich has a filename like this :

";xterm;"#Snippets Archive.tar.gz

the Shell command ";xterm;"# will be injected and will execute the program xterm as a exploid demo.

reason is a bug in the Importer.py Python script :
/usr/lib/x86_64-linux-gnu/pluma/plugins/snippets/Importer.py
https://github.com/mate-desktop/pluma/blob/master/plugins/snippets/snippets/Importer.py

        def import_archive(self, cmd):
                dirname = tempfile.mkdtemp()
                status = os.system('cd %s; %s "%s"' % (dirname, cmd, self.filename))

The os.system command puts the filename in "%s" to a shell and executes it.
============================================================

The "dirname" should be checked, too.

So, please do not use os.system in the Importer an Exporter Scripts,
use Subprocess.Popen() with Shell=False
or use quote() to workaround this Bug.

Thanks :-)

---
Remark :
Because of there seems to be an other Bug (1357735) in pluma,
i could not enable the python snippets in Kubuntu 15.04 or Ubuntu-Mate 15.04.
So i attached a screenshot where i reproduced it in an other OS called "HardenedBSD" with Mate Desktop.
----

ProblemType: Bug
DistroRelease: Ubuntu 15.04
Package: pluma 1.8.1+dfsg1-2
ProcVersionSignature: Ubuntu 3.19.0-21.21-generic 3.19.8
Uname: Linux 3.19.0-21-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.17.2-0ubuntu1.1
Architecture: amd64
CurrentDesktop: KDE
Date: Thu Jun 18 21:24:29 2015
InstallationDate: Installed on 2015-05-15 (33 days ago)
InstallationMedia: Kubuntu 15.04 "Vivid Vervet" - Release amd64 (20150422)
SourcePackage: pluma
UpgradeStatus: No upgrade log present (probably fresh install)