SECURITY: force IM decoder based on file extension - part 2

app/models/optimized_image.rb

@@ -123,7 +123,7 @@ class OptimizedImage < ActiveRecord::Base
   def self.prepend_decoder!(path)
     extension = File.extname(path)[1..-1]
     raise Discourse::InvalidAccess unless extension[IM_DECODERS]
-    "#{extension}:#{path}"
+    path = "#{extension}:#{path}"
   end
 
   def self.thumbnail_or_resize

lib/upload_creator.rb

@@ -166,12 +166,12 @@ class UploadCreator
       "convert",
       from,
       "-auto-orient",
-      "-background white",
-      "-interlace none",
+      "-background", "white",
+      "-interlace", "none",
       "-flatten",
-      "-quality #{SiteSetting.png_to_jpg_quality}"
+      "-quality", SiteSetting.png_to_jpg_quality.to_s
     ]
-    command << "-debug all" if debug
+    command << "-debug" << "all" if debug
     command << to
 
     Discourse::Utils.execute_command(*command, failure_message: I18n.t("upload.png_to_jpg_conversion_failure_message"))