support files with (some) sorts of special characters in them

[iblech]

This still doesn't make the script safe to use on repositories containing arbitrarily bad file names (because of the for file in $(...) construct). However it's better than not protecting at all.

My personal first rule for writing shell scripts is: Never use a variable unquoted.