Fixed it some more

model.py

@@ -295,12 +295,13 @@ class Action(DBObject):
         args['escaped_values'] = {k: v.replace('\\', '\\\\').replace('\'', '\\\'') for k, v in
                 values.items()}
         cmd = render_template_string(self.a1, **args)
+        print "dbg: ", cmd
         if not self.a2:
-			proc = subprocess.Popen(cmd, shell=True)
+			proc = subprocess.Popen(['bash', '-c', cmd])
 			return 'forked'
         else:
 			try:
-				return subprocess.check_output(cmd, stderr=subprocess.STDOUT, shell=True)
+				return subprocess.check_output(['bash', '-c', cmd], stderr=subprocess.STDOUT)
 			except subprocess.CalledProcessError as e:
 				return e.output